{"record":{"id":"2676e7d0a5bdcb71","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-update-public-model-groups","errorCode":null,"errorMessage":"Only proxy admins can update public model groups. Your role={user_api_key_dict.user_role}","messagePattern":"Only proxy admins can update public model groups\\. Your role=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/agent_endpoints/endpoints.py","lineNumber":865,"sourceCode":"    }\n    ```\n    \"\"\"\n    from litellm.proxy.proxy_server import prisma_client\n\n    if prisma_client is None:\n        raise HTTPException(status_code=500, detail=CommonProxyErrors.db_not_connected_error.value)\n\n    try:\n        # Update the public model groups\n        import litellm\n        from litellm.proxy.agent_endpoints.agent_registry import (\n            global_agent_registry as AGENT_REGISTRY,\n        )\n        from litellm.proxy.proxy_server import proxy_config\n\n        # Check if user has admin permissions\n        if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:\n            raise HTTPException(\n                status_code=403,\n                detail={\n                    \"error\": f\"Only proxy admins can update public model groups. Your role={user_api_key_dict.user_role}\"\n                },\n            )\n\n        agent = AGENT_REGISTRY.get_agent_by_id(agent_id=agent_id)\n        if agent is None:\n            # check if agent exists in DB\n            agent = await agents_table(prisma_client).find_unique(where={\"agent_id\": agent_id})\n            if agent is not None:\n                agent = AgentResponse(**agent.model_dump())\n\n            if agent is None:\n                raise HTTPException(status_code=404, detail=f\"Agent with ID {agent_id} not found\")\n\n        if litellm.public_agent_groups is None:\n            litellm.public_agent_groups = []","sourceCodeStart":847,"sourceCodeEnd":883,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/agent_endpoints/endpoints.py#L847-L883","documentation":"Raised in the public-model-groups update endpoint when the caller's role is not PROXY_ADMIN. Public agent groups are shared, proxy-wide routing surface, so mutating them is restricted to proxy admins; the caller's actual role is embedded. It is the public-groups counterpart of the general agent-management permission check.","triggerScenarios":"Thrown at litellm/proxy/agent_endpoints/endpoints.py:865 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a key with the PROXY_ADMIN role to update public model groups."],"exampleFix":"Retry with an admin key.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}