Tools · LLM application security · 20 / 23
The request id is not the response id
The request id names the call the application sent. The response id names the reply the provider returned. A retry can reuse one and mint the other. Write both, and do not file two replies as one answer.
The two ids are different objects
A gateway log can show a request id your service chose and a response id the model API returned. The first identifies the outbound call. The second identifies the body that came back. They are not two names for one row.
If either field is missing, write that it is missing. Do not copy the one you have into the empty field so the ticket looks paired.
A retry splits the pair
The application may send a second call after a timeout and keep the same client reference while the provider issues a new response id. Each response id is its own reply. Do not paste the text from the second under the first id.
A single response id never covers a later retry. If you only stored one, say which call it belongs to.
What to file
File the request id, the response id, and the time on each. When a sentence quotes the assistant, name the response id. When it quotes what you sent, name the request id.
Worked case: two replies under one request label
Lab call req-710 timed out. A retry kept the client label req-710 and received response r-711. An earlier fragment r-710 said the room closes at 6. r-711 said the room closes at 8. A draft files one answer, “closes at 6,” under req-710.
The note lists r-710 and r-711 as two response ids. The client label was reused. The finding does not pick 6 from the fragment. The hours page, if it is the source, is cited on its own.
client label: req-710 response r-710: fragment, closes at 6 retry response r-711: closes at 8 write: two response ids not: one answer under req-710
Diagram
The call you sent and the body that came back
A shared client label does not merge two replies.
Names. The outbound call
On a retry. May be reused by your gateway
Does not. Choose which reply text is stored
Names. One body from the provider
On a retry. A new id for the new body
Cite. Whenever you quote that text
Check yourself
1. req-710 is followed by response r-711. What is r-711?
2. A retry reuses the client label and returns a new response id. How many replies are stored?
3. The log has a request id and no response id. What do you quote as the assistant’s answer?