fix(vision events): send assume-identity headers on Vision Events API calls

[rvirani1]

Problem

The Vision Events sink (roboflow_core/roboflow_vision_events@v1) built its own request headers, bypassing build_roboflow_api_headers(). Every other Roboflow API caller in this repo goes through that builder, which injects whatever headers are configured in ROBOFLOW_API_EXTRA_HEADERS.

That matters wherever the API key is not itself a real credential. A workflow run by an internal service on behalf of a workspace is pointed at a proxy through API_BASE_URL, handed a placeholder API key, and authenticated entirely by a token supplied in ROBOFLOW_API_EXTRA_HEADERS. The sink dropped that token, so its writes were rejected upstream — while the block still reported success and the run finished clean. The events were silently lost.

Change

inference/core/workflows/core_steps/sinks/roboflow/vision_events/v1.py:

• Both cloud calls (POST /vision-events/upload and POST /vision-events) now build their headers with build_roboflow_api_headers(). Content-Type is passed through explicit_headers rather than merged in afterwards, so a deployment's configured headers cannot be clobbered.
• The bearer token is applied with setdefault. Where a configured Authorization header is the real credential and the API key is a placeholder, the configured value wins.
• Both requests raise through api_key_safe_raise_for_status, matching the other callers.

The API key stays out of the request URL. Passing it as an api_key query parameter is how other callers in this repo send it and the API accepts that form, but a query string is recorded by proxy, gateway, and access logs before any redaction in this block could apply. A header keeps it out of that path, and nothing about this fix depends on the transport — where the placeholder key is in play, neither form is read.

The local event store path (write_to_event_store: true) is untouched. It does not talk to the Roboflow API.

Notes

This is one half of the fix, and the other half has shipped: the API now accepts that token on the Vision Events ingest routes. With both in place these writes land instead of being rejected.

Tests

New coverage:

• Both calls send the headers produced by the shared builder, and Content-Type reaches it as an explicit header rather than being appended after.
• A configured Authorization header is not overwritten by the bearer token built from the API key.
• The API key does not appear in the request URL.

pytest tests/workflows/unit_tests
4257 passed, 2 skipped

[github-actions]

👋 Thanks for the pull request! Here is how automated Claude review works here, so you spend credits (and reviewer time) wisely.

🚦 This PR is marked Ready for review, so automated Claude review will run — and every pass spends real credits.

Warning

💸 The Claude reviewer bills in credits, not vibes

Automated review spins up a real agent that reads real code and spends real credits on every pass. It is glad to help — but it is not a rubber duck, a linter you poke in a loop, or a substitute for reading the contributing guide. Treat it like an expensive senior reviewer whose time you booked, and show up prepared.

Draft when unsure, Ready when you mean it:

• 🌱 Not sure the PR is in good shape yet? Keep it (or set it back) as a draft — drafts pause review, so you can push and iterate without burning credits on a moving target.
• 💪 Feel strong about the contents? Mark it Ready for review and the reviewer will take a look.

However you get there, arrive prepared:

• 🧱 Bring a SOLID, thorough PR. Point your local agent at our skills/ to tune it to our guidelines first — or, if you are one of those fabled carbon-based contributors, read them yourself. A half-baked diff costs exactly the same to review as a finished one.
• ✅ Resolve every comment before you re-request review. Re-requesting with threads still open means paying twice for the same conversation.
• 🔁 Do not use CI review as an inner loop for a local agent. The reviewer is not a step-by-step debugger — do the unfolding locally and arrive with the answer, not the search.
• 🙋 If something looks off, ask a human. One question to a maintainer is cheaper and faster than three rounds of agent re-review chasing a misread.

Reviews are not free. A draft costs nothing to review; a Ready PR is a promise that it is worth reviewing.

• Prefer to skip automated review entirely? Add the skip-claude-review label.

[github-actions]

🤖 Claude review started at commit 50133c5af0150624ba1812e80f93545966e12593.

New commits are not auto-reviewed. Add the claude-review label (remove & re-add it to trigger again) when you want another review.

[github-actions]

😎 PR passes the vibe-check and trust-me-bro verification.