BerriAI/litellm · error · HTTPException

Forbidden. The response id is not associated with the user,

Error message

Forbidden. The response id is not associated with the user, who this key belongs to. To disable this security feature, set general_settings::disable_responses_id_security to True in the config.yaml file.

What it means

Error "Forbidden. The response id is not associated with the user, who this key belongs to. To disable this security feature, set general_settings::disable_responses_id_security to True in the config.yaml file." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/hooks/responses_id_security.py:91

        user_api_key_dict: "UserAPIKeyAuth",
    ) -> bool:
        from litellm.proxy.proxy_server import general_settings

        if (
            user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value
            or user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN
        ):
            return True

        if response_id_user_id and response_id_user_id != user_api_key_dict.user_id:
            if general_settings.get("disable_responses_id_security", False):
                verbose_proxy_logger.debug(
                    "Responses ID Security is disabled. User %s is accessing response id %s which is not associated with them.",
                    user_api_key_dict.user_id,
                    response_id_user_id,
                )
                return True
            raise HTTPException(
                status_code=403,
                detail="Forbidden. The response id is not associated with the user, who this key belongs to. To disable this security feature, set general_settings::disable_responses_id_security to True in the config.yaml file.",
            )

        if response_id_team_id and response_id_team_id != user_api_key_dict.team_id:
            if general_settings.get("disable_responses_id_security", False):
                verbose_proxy_logger.debug(
                    "Responses ID Security is disabled. Response belongs to team %s but user %s is accessing it with team id %s.",
                    response_id_team_id,
                    user_api_key_dict.user_id,
                    user_api_key_dict.team_id,
                )
                return True
            raise HTTPException(
                status_code=403,
                detail="Forbidden. The response id is not associated with the team, who this key belongs to. To disable this security feature, set general_settings::disable_responses_id_security to True in the config.yaml file.",
            )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use a response id that belongs to the same user as the API key.
2. Set general_settings::disable_responses_id_security to True in config.yaml to disable this check (not recommended).

When it happens

Trigger: Thrown at litellm/proxy/hooks/responses_id_security.py:91 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/9c730081df736d39. Report an issue: GitHub.