Breaking changes in authentication from uipath-langchain v0.9.24 -> v0.10.15?

[mikael-andersson91]

For all of our UiPath LangChain agents, we are using the standard UiPathChat for our LLM models in agents. After upgrading from version 0.9.24, to version v0.10.15 of uipath-langchain, we are consistently getting errors such as this one when debugging our agents in local sessions:

HTTP Request: GET https://cloud.uipath.com/ingka/GlobalTest/agenthub_/llm/api/capabilities "HTTP/1.1 200 OK"
HTTP Request: POST https://cloud.uipath.com/ingka/GlobalTest/agenthub_/llm/api/chat/completions "HTTP/1.1 403 Forbidden"
❌ Error: Unexpected error occurred - Error: UiPathPermissionDeniedError: Forbidden (Status Code: 403) None
 
Traceback (most recent call last):
  File "C:\GIT\rpa-augmented-operations\uipath-coded-agents\ask-lattjo\.venv\Lib\site-packages\uipath\llm_client\utils\exceptions.py", line 254, in raise_for_status
    original_raise_for_status()
  File "C:\GIT\rpa-augmented-operations\uipath-coded-agents\ask-lattjo\.venv\Lib\site-packages\httpx\_models.py", line 829, in raise_for_status
    raise HTTPStatusError(message, request=request, response=self)
httpx.HTTPStatusError: Client error '403 Forbidden' for url '[https://cloud.uipath.com/ingka/GlobalTest/agenthub_/llm/api/chat/completions'](https://cloud.uipath.com/ingka/GlobalTest/agenthub_/llm/api/chat/completions%27)
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403

Are there any breaking changes between these versions of uipath-langchain in terms of how to get our LLM calls authenticated that are not documented anywhere? This happens consistently when setting up new projects and running them according to the quickstart guide too. When we downgrade to older versions of the library, we do not get this error.

And follow-up question to that: Are there any plans from UiPaths side to use semantic versioning correctly to signal when breaking changes are made in releases for uipath-langchain?

[radu-mocanu]

Thanks for the report.

We indeed introduced some big changes as part of our v0.10.0 release around LLM models, but they should not have been breaking.

The root cause of the regression you are seeing on local runs might be because of the fact that we are sending some default headers now to agenthub like: X-UiPath-AgentHub-Config: agentsruntime which our llm gateway might deny for user token calls.

Can you please set UIPATH_AGENTHUB_CONFIG="" in your .env file and re-run the agent?
That should suppresses the header entirely.

If that confirms it we'll fix the regression on our end.
Thanks

[mikael-andersson91]

I added UIPATH_AGENTHUB_CONFIG="" to my .env file now, and I'm able to debug my agents again.

[radu-mocanu]

thanks for confirming @mikael-andersson91 . We’ll publish a permanent fix soon. Are you encountering the same issue on serverless runs as well?

[mikael-andersson91]

I have not tried that yet.

[mikael-andersson91]

@radu-mocanu I just triggered one agent from Orchestrator now, and I get this error that we did not have before updating to v0.10.15 of uipath-langchain:

UiPathPermissionDeniedError(message='Forbidden', status_code=403, body={'error': 'Entitlement for PII Inflight Masking is not granted. You (or your organization) are not licensed to use this feature. Go to https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/managing-ai-trust-layer#about-pii-in-flight-masking to learn about licensing requirements for PII Inflight Masking. ', 'statusCode': 403})Traceback (most recent call last):

File "/tmp/home/.shared-packages/bf216af0-8130-4df8-8d31-181510e3f6ea/8bd112f4-d15f-4a71-953c-e5cf2d8ab773/incident-investigation-agent/4.6.1-dev278/.venv/lib/python3.11/site-packages/uipath/llm_client/utils/exceptions.py", line 254, in raise_for_status original_raise_for_status()

File "/tmp/home/.shared-packages/bf216af0-8130-4df8-8d31-181510e3f6ea/8bd112f4-d15f-4a71-953c-e5cf2d8ab773/incident-investigation-agent/4.6.1-dev278/.venv/lib/python3.11/site-packages/httpx/_models.py", line 829, in raise_for_status raise HTTPStatusError(message, request=request, response=self)

httpx.HTTPStatusError: Client error '403 Forbidden' for url 'https://cloud.uipath.com/a59380c6-8519-4e7f-8014-7d4773a448dc/bf216af0-8130-4df8-8d31-181510e3f6ea/agenthub_/llm/api/chat/completions' For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "/tmp/home/.shared-packages/bf216af0-8130-4df8-8d31-181510e3f6ea/8bd112f4-d15f-4a71-953c-e5cf2d8ab773/incident-investigation-agent/4.6.1-dev278/.venv/lib/python3.11/site-packages/langchain_core/language_models/chat_models.py", line 2056, in _agenerate_with_cache result = await self._agenerate( ^^^^^^^^^^^^^^^^^^^^^^

File "/tmp/home/.shared-packages/bf216af0-8130-4df8-8d31-181510e3f6ea/8bd112f4-d15f-4a71-953c-e5cf2d8ab773/incident-investigation-agent/4.6.1-dev278/.venv/lib/python3.11/site-packages/uipath_langchain_client/base_client.py", line 456, in _agenerate result = await self._uipath_agenerate( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/tmp/home/.shared-packages/bf216af0-8130-4df8-8d31-181510e3f6ea/8bd112f4-d15f-4a71-953c-e5cf2d8ab773/incident-investigation-agent/4.6.1-dev278/.venv/lib/python3.11/site-packages/uipath_langchain_client/clients/normalized/chat_models.py", line 519, in _uipath_agenerate response = await self.uipath_arequest(request_body=request_body, raise_status_error=True) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/tmp/home/.shared-packages/bf216af0-8130-4df8-8d31-181510e3f6ea/8bd112f4-d15f-4a71-953c-e5cf2d8ab773/incident-investigation-agent/4.6.1-dev278/.venv/lib/python3.11/site-packages/uipath_langchain_client/base_client.py", line 300, in uipath_arequest response.raise_for_status()

File "/tmp/home/.shared-packages/bf216af0-8130-4df8-8d31-181510e3f6ea/8bd112f4-d15f-4a71-953c-e5cf2d8ab773/incident-investigation-agent/4.6.1-dev278/.venv/lib/python3.11/site-packages/uipath/llm_client/utils/exceptions.py", line 256, in raise_for_status raise UiPathAPIError.from_response(response)

uipath.llm_client.utils.exceptions.UiPathPermissionDeniedError: UiPathPermissionDeniedError: Forbidden (Status Code: 403) {'error': 'Entitlement for PII Inflight Masking is not granted. You (or your organization) are not licensed to use this feature. Go to https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/managing-ai-trust-layer#about-pii-in-flight-masking to learn about licensing requirements for PII Inflight Masking. ', 'statusCode': 403}

[mikael-andersson91]

I can also confirm the same error after updating a project for unit tests running on our GitHub Actions pipeline when authenticating through external application:

=========================== short test summary info ============================
FAILED tests/test_agent_with_evaluators.py::test_trajectory_llm_as_judge - uipath.llm_client.utils.exceptions.UiPathPermissionDeniedError: UiPathPermissionDeniedError: Forbidden (Status Code: 403) {'error': 'Entitlement for PII Inflight Masking is not granted. You (or your organization) are not licensed to use this feature. Go to  https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/managing-ai-trust-layer#about-pii-in-flight-masking to learn about licensing requirements for PII Inflight Masking. ', 'statusCode': 403}
During task with name 'model' and id '19d1ca9a-d70f-7349-df38-2b601b231fa7'
During task with name 'get_processes_and_references' and id 'e1923485-72d0-4e50-ae85-efa8824be399'
FAILED tests/test_agent_with_evaluators.py::test_get_processes_and_references_node - uipath.llm_client.utils.exceptions.UiPathPermissionDeniedError: UiPathPermissionDeniedError: Forbidden (Status Code: 403) {'error': 'Entitlement for PII Inflight Masking is not granted. You (or your organization) are not licensed to use this feature. Go to  https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/managing-ai-trust-layer#about-pii-in-flight-masking to learn about licensing requirements for PII Inflight Masking. ', 'statusCode': 403}
During task with name 'model' and id '06b78a7c-aab5-4168-db07-546c63a90d30'
FAILED tests/test_agent_with_evaluators.py::test_investigate_source_code_node - uipath.llm_client.utils.exceptions.UiPathPermissionDeniedError: UiPathPermissionDeniedError: Forbidden (Status Code: 403) {'error': 'Entitlement for PII Inflight Masking is not granted. You (or your organization) are not licensed to use this feature. Go to  https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/managing-ai-trust-layer#about-pii-in-flight-masking to learn about licensing requirements for PII Inflight Masking. ', 'statusCode': 403}
During task with name 'model' and id '606cc330-40de-02f3-b25a-a8a48560df63'
============= 3 failed, 35 passed, 7 warnings in 89.77s (0:01:29) ==============

[mikael-andersson91]

@radu-mocanu I have attached a sample agent run from Orchestrator where we got the same errors noted here on a related support ticket in Customer Portal. Case #:02884193

[radu-mocanu]

we deployed a fix #826
@mikael-andersson91 please bump uipath-langchain version to >=0.10.16 and let us know if that fixes your issue.

[mikael-andersson91]

Tested the following:

• Local debugging, works fine in uipath dev web terminal
• Unit tests in GitHub Actions with external application auth - The error remains
• Agent execution from Orchestrator

I'd suggest to reopen this issue for traceability.

[mikael-andersson91]

@radu-mocanu For reference on what we are doing with our unit tests in GitHub Actions, see commands below:

uv sync
  
  orchestrator_url="https://cloud.uipath.com/"
  orchestrator_url="${orchestrator_url%%/}"
  base_url="${orchestrator_url}/ingka/GlobalTest"
  uipath auth \
    --client-id "$ORCHESTRATOR_APP_ID" \
    --client-secret "$ORCHESTRATOR_APP_SECRET" \
    --base-url "${base_url}" \
    --scope "OR.Administration.Read OR.Settings OR.Settings.Read OR.Robots OR.Robots.Read OR.Machines OR.Machines.Read OR.Execution OR.Assets OR.Jobs OR.Users OR.Users.Read OR.Monitoring OR.Tasks OR.Folders OR.Folders.Read OR.BackgroundTasks OR.TestSets OR.TestSetExecutions OR.TestSetSchedules OR.TestDataQueues"
  uipath init
  
  uv pip install coverage
  coverage run -m pytest --junit-xml="test-results.xml"
  coverage report

The unit tests include usage of load_dotenv() to get environment variables, full agent execution and evaluators from OpenEvals and AgentEvals

[radu-mocanu]

@mikael-andersson91 in your tests/evaluators, are you importing UiPathChat from:

from uipath_langchain.chat import UiPathChat 

or

from uipath_langchain_client.clients.normalized.chat_models import UiPathChat 

(or via init_chat_model("uipath:...")?)

The current fix only covers the first one. We'll also cover the upstream import path in a follow-up so this will work regardless of where you import UiPathChat from.
in the meantime, as a quick CI unblocker, you can set UIPATH_AGENTHUB_CONFIG="" in your GHA env.