HackBlue

Tools · LLM application security · 20 / 23

The request id is not the response id

The request id names the call the application sent. The response id names the reply the provider returned. A retry can reuse one and mint the other. Write both, and do not file two replies as one answer.

11 min read · practice only with authorization

The two ids are different objects

A gateway log can show a request id your service chose and a response id the model API returned. The first identifies the outbound call. The second identifies the body that came back. They are not two names for one row.

If either field is missing, write that it is missing. Do not copy the one you have into the empty field so the ticket looks paired.

A retry splits the pair

The application may send a second call after a timeout and keep the same client reference while the provider issues a new response id. Each response id is its own reply. Do not paste the text from the second under the first id.

A single response id never covers a later retry. If you only stored one, say which call it belongs to.

What to file

File the request id, the response id, and the time on each. When a sentence quotes the assistant, name the response id. When it quotes what you sent, name the request id.

Worked case: two replies under one request label

Lab call req-710 timed out. A retry kept the client label req-710 and received response r-711. An earlier fragment r-710 said the room closes at 6. r-711 said the room closes at 8. A draft files one answer, “closes at 6,” under req-710.

The note lists r-710 and r-711 as two response ids. The client label was reused. The finding does not pick 6 from the fragment. The hours page, if it is the source, is cited on its own.

Snippet
client label: req-710
response r-710: fragment, closes at 6
retry response r-711: closes at 8
write: two response ids
not: one answer under req-710

Diagram

The call you sent and the body that came back

A shared client label does not merge two replies.

Request id

Names. The outbound call

On a retry. May be reused by your gateway

Does not. Choose which reply text is stored

Response id

Names. One body from the provider

On a retry. A new id for the new body

Cite. Whenever you quote that text

Check yourself

1. req-710 is followed by response r-711. What is r-711?

2. A retry reuses the client label and returns a new response id. How many replies are stored?

3. The log has a request id and no response id. What do you quote as the assistant’s answer?