Calling a model from Apex safely

The 120-second cumulative callout budget per transaction is not a footnote. It is the reason the timeouts in this course are 25, 45, 60 and never 120.

1. VideoWhere the model lives: platform models and external endpointsPreview6 min
2. VideoThe 120-second cumulative callout budget per transaction6 min
3. VideoTimeouts of 25, 45 and 60 seconds, and why never 1206 min
4. VideoThe 90-second wall-clock stop, on top of the callout budget6 min
5. ReadingStreaming, and why you usually cannot use it here5 min
6. VideoCost per call, and instrumenting it from day one6 min
7. LabLab: make your first governed model call14 min

A custom setting field was rejected for a precise reason: in an unmanaged org it is readable by any API-enabled user. The key lives in a named credential’s password instead.

1. VideoWhy a custom setting field was rejected: readable by any API-enabled user6 min
2. VideoThe named credential’s password, merged into a header6 min
3. VideoProving the key never becomes an Apex value6 min
4. VideoThe key that cannot be logged, cannot land in an exception, cannot be echoed back6 min
5. ReadingRedeploying a named credential from source control blanks its password5 min
6. VideoThe incident: an API key in a custom setting field, and what it cost5 min
7. LabLab: wire a callout through a named credential and grep the logs for the key14 min

Nothing derived from a provider error body reaches the caller. Only a status code and a clean enum. Then a test that proves it, twice.

1. VideoNothing derived from a provider error body reaches the caller6 min
2. VideoA clean enum, and a status code. Nothing else.6 min
3. VideoThe test: an error body containing a fake key6 min
4. VideoThe sweep: zero hits for a key fragment anywhere in the table6 min
5. ReadingWriting the test before the feature, for this one exception5 min
6. LabLab: prove a secret does not leak, twice14 min

A model returns text. Everything downstream needs a type, and everything upstream can lie about the shape.

1. VideoAsking for structure, and why you still cannot trust it6 min
2. VideoParsing defensively: missing fields, extra fields, wrong types6 min
3. VideoChecking the block reason before you read anything else6 min
4. VideoEmpty candidates, a non-stop finish reason, and null content6 min
5. VideoApex classes as the contract, and deserialising into them6 min
6. VideoRejecting a response rather than storing a guess6 min
7. LabLab: parse and reject three malformed responses14 min

No person-level data leaves the org. And the project must be on a paid tier before real data is sent, because a free tier may use your prompts to improve its product.

1. VideoNo person-level data leaves the org6 min
2. VideoCompany name, city and country. Nothing else.6 min
3. VideoContact names are card-only, never prompt input6 min
4. VideoThe free-tier retention rule: a paid tier before real data goes out6 min
5. ReadingShipping the feature switched off rather than shipping the risk5 min
6. LabLab: strip a payload down to what is actually allowed14 min

The rule that makes this safe: the platform enforces the permissions, so we never reimplement them. Every call carries the calling user.

1. VideoPer-user identity, and no shared service accountThe platform already knows what this user may see. A second copy of that logic is a second copy that can be wrong.6 min
2. VideoNever source a token from application-scoped stateAn application-scoped key is shared by every user of the agent, so a token stored there runs one person’s conversation as another.6 min
3. VideoFailing closed when identity cannot be established6 min
4. VideoLocal development fallback, gated behind a flag nothing in the cloud can trip6 min
5. ReadingWhy the platform’s own permission model is the one to trust5 min
6. LabLab: prove the call runs under the caller, not an admin14 min

Three rules that outlive the code that first wrote them: cache what should not be recomputed, validate what gets written, and never let a human edit an AI opinion.

1. VideoA cache rule that is the cost control, previewed here and built in full in course 3.76 min
2. VideoModel output is validated before it is written6 min
3. VideoProvenance defaults to the weaker claim6 min
4. VideoUsers cannot edit AI advice, because the object is read-only6 min
5. ReadingWhy a read-only object is a design decision, not a missing feature5 min
6. LabLab: make an AI advice object read-only and prove it14 min

Asynchrony, retries, testing and logging. The four things that decide whether this is supportable at month six.

1. VideoGetting the call off the synchronous transaction6 min
2. VideoRate limits, backoff, and not duplicating a write on retry6 min
3. VideoDeterministic tests for a non-deterministic call6 min
4. VideoLogging a model call so a bad answer is explainable later6 min
5. VideoWhat actually goes in the log, and what never does5 min
6. LabLab: add retries and a mock-backed test suite14 min
7. ReadingA logging checklist before you ship5 min

The failure that forced the architecture. A free-tier key capped the model at 20 requests a day, so the first full run analysed 2 of 256 records and stamped 250 with an error.

1. VideoThe free tier caps the model at 20 requests per project per day6 min
2. VideoThe first full run: 2 of 256 records analysed, 250 stamped with an error6 min
3. VideoWhy Apex cannot sleep and cannot honour a retry-after6 min
4. VideoThe 120-second budget is a wall a daily quota does not care about6 min
5. ReadingReading a rate-limit payload for what it actually says5 min
6. LabLab: reproduce the quota wall against a stub endpoint14 min
7. VideoWhen this becomes a tier-three decision, not a tier-two one5 min

The worker keeps prompts, inputs and the cache rule in Apex so the two paths can never drift, and adds everything Apex structurally cannot do: pacing, backoff, batching, a heartbeat.

1. VideoKeeping prompts, inputs and the cache rule in Apex, so the two paths cannot drift6 min
2. VideoPacing requests, and backing off exponentially6 min
3. VideoStopping on a per-day quota bucket, not a per-call one6 min
4. VideoPosting results back in batches, so a crash loses nothing6 min
5. VideoA heartbeat, and a watchdog that emails when it goes quiet6 min
6. LabLab: write a unit test for the quota classifier against a real payload14 min
7. QuizCheck: calling a model from Apex21 min