{"record":{"id":"11074723ba3d7faf","repo":"BerriAI/litellm","slug":"disabling-admin-endpoints-is-an-enterprise","errorCode":null,"errorMessage":"🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature\n🚨 You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/enterprise#trial. \nPricing: https://www.litellm.ai/#pricing","messagePattern":"🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature\n🚨 You must be a LiteLLM Enterprise user to use this feature\\. If you have a license please set `LITELLM_LICENSE` in your env\\. Get a 7 day trial key here: https://www\\.litellm\\.ai/enterprise#trial\\. \nPricing: https://www\\.litellm\\.ai/#pricing","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"enterprise/litellm_enterprise/proxy/auth/route_checks.py","lineNumber":37,"sourceCode":"                raise HTTPException(\n                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                    detail=f\"🚨🚨🚨 DISABLING LLM API ENDPOINTS is an Enterprise feature\\n🚨 {CommonProxyErrors.not_premium_user.value}\",\n                )\n\n        return get_secret_bool(\"DISABLE_LLM_API_ENDPOINTS\") is True\n\n    @staticmethod\n    def is_management_routes_disabled() -> bool:\n        \"\"\"\n        Check if management route is disabled\n        \"\"\"\n        from litellm.proxy._types import CommonProxyErrors\n        from litellm.proxy.proxy_server import premium_user\n        from litellm.secret_managers.main import get_secret_bool\n\n        if \"DISABLE_ADMIN_ENDPOINTS\" in os.environ:\n            if not premium_user:\n                raise HTTPException(\n                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                    detail=f\"🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature\\n🚨 {CommonProxyErrors.not_premium_user.value}\",\n                )\n\n        return get_secret_bool(\"DISABLE_ADMIN_ENDPOINTS\") is True\n\n    # Routes that should remain accessible even when LLM API endpoints are disabled.\n    # These are read-only model listing routes needed by the Admin UI.\n    LLM_API_EXEMPT_ROUTES = [\"/models\", \"/v1/models\"]\n\n    @staticmethod\n    def should_call_route(route: str):\n        \"\"\"\n        Check if management route is disabled and raise exception\n        \"\"\"\n        from litellm.proxy.auth.route_checks import RouteChecks\n\n        if (","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/enterprise/litellm_enterprise/proxy/auth/route_checks.py#L19-L55","documentation":"HTTP 500 raised by EnterpriseRouteChecks.is_management_routes_disabled: DISABLE_ADMIN_ENDPOINTS is present in the environment but premium_user is False. Like the LLM-route variant, disabling admin endpoints is enterprise-gated, so an unlicensed proxy that sets the env var fails the check.","triggerScenarios":"Setting DISABLE_ADMIN_ENDPOINTS=true (any value; mere presence triggers the premium check) on a proxy without a valid license, then issuing any request whose route checks consult this function.","commonSituations":"Trying to hide admin endpoints on OSS; migrating a licensed deployment to OSS and leaving DISABLE_ADMIN_ENDPOINTS in the compose file; CI/test environments copying enterprise env templates.","solutions":["Unset DISABLE_ADMIN_ENDPOINTS if unlicensed and protect admin routes with network rules or master-key discipline","Alternatively provide a valid LITELLM_LICENSE to legitimately enable the feature","Sweep env/compose/systemd definitions for enterprise-only variables when running OSS"],"exampleFix":"# before (docker-compose.yml)\nenvironment:\n  - DISABLE_ADMIN_ENDPOINTS=true\n# no license -> 500\n\n# after\nenvironment: []\n# plus firewall/ingress rules blocking /manage/* paths","handlingStrategy":"validation","validationCode":"assert not (os.environ.get('DISABLE_ADMIN_ENDPOINTS') and not os.environ.get('LITELLM_LICENSE')), \\\n    'DISABLE_ADMIN_ENDPOINTS requires an enterprise license'","typeGuard":null,"tryCatchPattern":"resp = httpx.get(f'{PROXY_URL}/health', headers=h)\nif resp.status_code == 500 and 'DISABLING ADMIN ENDPOINTS' in resp.text:\n    fail_deploy('unset DISABLE_ADMIN_ENDPOINTS or add license')","preventionTips":["CI check: fail builds where enterprise env vars exist without a license secret","Document which env vars are enterprise-gated next to the compose file"],"tags":["licensing","route-management","configuration","litellm-enterprise"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}