{"record":{"id":"11074723ba3d7faf","repo":"BerriAI/litellm","slug":"disabling-admin-endpoints-is-an-enterprise","errorCode":null,"errorMessage":"🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature\n🚨 You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/enterprise#trial. \nPricing: https://www.litellm.ai/#pricing","messagePattern":"🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature\n🚨 You must be a LiteLLM Enterprise user to use this feature\\. If you have a license please set `LITELLM_LICENSE` in your env\\. Get a 7 day trial key here: https://www\\.litellm\\.ai/enterprise#trial\\. \nPricing: https://www\\.litellm\\.ai/#pricing","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"enterprise/litellm_enterprise/proxy/auth/route_checks.py","lineNumber":37,"sourceCode":"                raise HTTPException(\n                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                    detail=f\"🚨🚨🚨 DISABLING LLM API ENDPOINTS is an Enterprise feature\\n🚨 {CommonProxyErrors.not_premium_user.value}\",\n                )\n\n        return get_secret_bool(\"DISABLE_LLM_API_ENDPOINTS\") is True\n\n    @staticmethod\n    def is_management_routes_disabled() -> bool:\n        \"\"\"\n        Check if management route is disabled\n        \"\"\"\n        from litellm.proxy._types import CommonProxyErrors\n        from litellm.proxy.proxy_server import premium_user\n        from litellm.secret_managers.main import get_secret_bool\n\n        if \"DISABLE_ADMIN_ENDPOINTS\" in os.environ:\n            if not premium_user:\n                raise HTTPException(\n                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,\n                    detail=f\"🚨🚨🚨 DISABLING ADMIN ENDPOINTS is an Enterprise feature\\n🚨 {CommonProxyErrors.not_premium_user.value}\",\n                )\n\n        return get_secret_bool(\"DISABLE_ADMIN_ENDPOINTS\") is True\n\n    # Routes that should remain accessible even when LLM API endpoints are disabled.\n    # These are read-only model listing routes needed by the Admin UI.\n    LLM_API_EXEMPT_ROUTES = [\"/models\", \"/v1/models\"]\n\n    @staticmethod\n    def should_call_route(route: str):\n        \"\"\"\n        Check if management route is disabled and raise exception\n        \"\"\"\n        from litellm.proxy.auth.route_checks import RouteChecks\n\n        if (","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/enterprise/litellm_enterprise/proxy/auth/route_checks.py#L19-L55","documentation":"Raised as HTTPException 500 by EnterpriseRouteChecks.is_management_routes_disabled when the DISABLE_ADMIN_ENDPOINTS env var is present in the environment but premium_user is False. Like the LLM API variant, this admin-endpoint lockdown is enterprise-only, and merely having the variable defined triggers the license check before its boolean value is even read.","triggerScenarios":"Setting DISABLE_ADMIN_ENDPOINTS in the proxy environment on a community/free deployment; inheriting it from a shared base image or helm values file; setting it to 'false' expecting it to be off (presence still triggers the check).","commonSituations":"Hardening a proxy by disabling /user, /team, /key admin routes using the env var without a license; env leftovers after a trial expired; helm chart values that define the key globally across environments.","solutions":["Remove DISABLE_ADMIN_ENDPOINTS from the environment (delete the key, do not set 'false') and restart the proxy","Set a valid LITELLM_LICENSE if you genuinely need admin endpoints disabled","Search all layers for the variable: docker inspect, helm get values, kubectl describe pod, CI secrets","As a community alternative, restrict admin routes with virtual keys/roles instead of the env var"],"exampleFix":"# before\nexport DISABLE_ADMIN_ENDPOINTS=true  # no license -> 500 on startup/requests\n# after\nunset DISABLE_ADMIN_ENDPOINTS\n# or: export LITELLM_LICENSE=<valid-key>","handlingStrategy":"validation","validationCode":"import os\nif \"DISABLE_ADMIN_ENDPOINTS\" in os.environ and not licensed():\n    # either fail the deploy loudly or strip the var\n    raise RuntimeError(\"DISABLE_ADMIN_ENDPOINTS requires an Enterprise license\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep enterprise env vars out of community deployments' base images","Pair every gated env var with a license presence assertion in deploy scripts","Use secrets management so gated vars are injected only into licensed releases"],"tags":["litellm","enterprise","license","env-var","admin-endpoints"],"backgroundTag":"license-required","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}