BerriAI/litellm · error · HTTPException

Only proxy admins can access the OpenAPI registry. Your role

Error message

Only proxy admins can access the OpenAPI registry. Your role={user_api_key_dict.user_role}

What it means

Role guard on GET /v1/mcp/openapi-registry: the OpenAPI/OAuth2 registry used by the picker UI is admin-only, following the read-parity rule with other admin endpoints. Non-admins get 403 with their role in the message.

Source

Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:2786

        "openapi_registry.json",
    )

    @functools.lru_cache(maxsize=1)
    def _load_openapi_registry() -> dict[str, object]:
        with open(_OPENAPI_REGISTRY_PATH, "r") as f:
            data: Final[dict[str, object]] = json.load(f)
        return data

    @router.get(
        "/openapi-registry",
        description="Returns well-known OpenAPI APIs with OAuth 2.0 metadata for the OpenAPI MCP picker",
    )
    async def get_openapi_registry(
        user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
    ):
        # Admin Viewer follows the read-parity rule.
        if not _user_has_admin_view(user_api_key_dict):
            raise HTTPException(
                status_code=403,
                detail={
                    "error": f"Only proxy admins can access the OpenAPI registry. Your role={user_api_key_dict.user_role}"
                },
            )
        try:
            return _load_openapi_registry()
        except Exception as e:
            verbose_proxy_logger.warning("Failed to load OpenAPI registry from %s: %s", _OPENAPI_REGISTRY_PATH, e)
            return {"apis": []}

    # ---------------------------------------------------------------------------
    # MCP Toolset endpoints
    # ---------------------------------------------------------------------------

    from litellm.proxy._experimental.mcp_server.toolset_db import (
        create_mcp_toolset,
        delete_mcp_toolset,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use a PROXY_ADMIN API key to access the OpenAPI registry.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:2786 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/3aa36958d807ca8d. Report an issue: GitHub.