BerriAI/litellm · error · HTTPException

License is over limit. Please contact support@berri.ai to up

Error message

License is over limit. Please contact support@berri.ai to upgrade your license.

What it means

LiteLLM's proxy enforces enterprise license seat limits when creating internal users. Before inserting a new user, POST /user/new counts billable users via UserRepository.count_billable_users() and checks _license_check.is_over_limit(total_users=...). When the deployment's user count is at or beyond the licensed seats, creation is refused with HTTP 403 and a pointer to support@berri.ai. This is a licensing gate, not a malfunction: creation succeeds again once seats are freed or the license is upgraded.

Source

Thrown at litellm/proxy/management_endpoints/internal_user_endpoints.py:529

        if prisma_client is None:
            raise HTTPException(status_code=400, detail=CommonProxyErrors.db_not_connected_error.value)

        if prisma_client is None:
            raise HTTPException(
                status_code=500,
                detail=CommonProxyErrors.db_not_connected_error.value,
            )
        validate_budget_duration(data.budget_duration)

        # Check for duplicate user_id or email
        await _check_duplicate_user_id(data.user_id, prisma_client)
        await _check_duplicate_user_email(data.user_email, prisma_client)

        # Check if license is over limit
        billable_users: Final = await UserRepository(prisma_client).count_billable_users()
        if billable_users and _license_check.is_over_limit(total_users=billable_users):
            raise HTTPException(
                status_code=403,
                detail="License is over limit. Please contact support@berri.ai to upgrade your license.",
            )

        # Only proxy admins can create administrative users
        # Check if user_api_key_dict is actually a UserAPIKeyAuth instance (not a Depends object)
        # This can happen when the function is called directly in tests
        if (
            data.user_role in [LitellmUserRoles.PROXY_ADMIN, LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY]
            and isinstance(user_api_key_dict, UserAPIKeyAuth)
            and user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN
        ):
            raise HTTPException(
                status_code=403,
                detail=f"Only proxy admins can create administrative users (proxy_admin, proxy_admin_viewer). Attempted to create user with role: {data.user_role}. Your role: {user_api_key_dict.user_role}",
            )

        _check_permissions_caller_permission(

View on GitHub (pinned to 77b7c6c40c)

Solutions

Free seats first: delete unused users via POST /user/delete (or the admin UI), confirm the count via GET /user/list, then retry the create
Contact support@berri.ai to upgrade the license / raise the seat count
Verify the enterprise license key in general_settings.litellm_license_api_key (or the premium env var) is the correct, current one - an expired key lowers the ceiling
Audit which users count as billable and clean up deactivated or service accounts before buying more seats

Example fix

# before: license at seat limit
curl -X POST http://localhost:4000/user/new -H 'Authorization: Bearer sk-admin' -d '{"user_id": "new-user"}'
# HTTP 403 License is over limit...

# after: free a seat, then create
curl -X POST http://localhost:4000/user/delete -H 'Authorization: Bearer sk-admin' -d '{"user_ids": ["stale-user"]}'
curl -X POST http://localhost:4000/user/new -H 'Authorization: Bearer sk-admin' -d '{"user_id": "new-user"}'  # 200

Defensive patterns

Strategy: try-catch

Try / catch

try:
    resp = requests.post(f"{BASE}/user/new", json=payload, headers=hdrs, timeout=10)
    resp.raise_for_status()
except requests.HTTPError as e:
    if e.response is not None and e.response.status_code == 403 and "over limit" in e.response.text:
        raise SeatLimitReached("License seats exhausted: upgrade via support@berri.ai or delete unused users") from e
    raise

Prevention

Track billable user count against purchased seats as part of onboarding automation
Periodically delete deactivated/unused users so seats are freed
Keep the enterprise license key current and alert on license-check warnings in proxy logs

When it happens

Trigger: POST /user/new (or any UI flow that creates users) once the billable user count reaches the licensed seat count - e.g. onboarding the N+1st user on an N-seat license, or running with an expired/downgraded license key that reports fewer seats than users already stored in LiteLLM_UserTable.

Common situations: Team grew past the seats on a trial or paid plan; license key expired or was swapped for a smaller one; SSO/SCIM auto-provisioning kept creating users past the limit; stale or unused users still counting as billable.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/bb14baf635d710c7. Report an issue: GitHub.