{"record":{"id":"365b842284cad3f3","repo":"BerriAI/litellm","slug":"key-is-not-in-a-team-access-groups-cannot-be-assi","errorCode":null,"errorMessage":"Key is not in a team. Access groups cannot be assigned to personal keys by non-admin callers. Disallowed access groups: {sorted(access_group_ids)}.","messagePattern":"Key is not in a team\\. Access groups cannot be assigned to personal keys by non-admin callers\\. Disallowed access groups: (.+?)\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_helpers/team_member_permission_checks.py","lineNumber":171,"sourceCode":"\n        Raises HTTPException(403) when a gated member attempts the assignment.\n        \"\"\"\n        from fastapi import HTTPException\n\n        from litellm.proxy.management_endpoints.key_management_endpoints import (\n            _get_user_in_team,\n        )\n\n        # No-op when the request does not assign any access groups.\n        if not access_group_ids:\n            return\n\n        # Proxy admins always bypass.\n        if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value:\n            return\n\n        if team_table is None:\n            raise HTTPException(\n                status_code=403,\n                detail=(\n                    \"Key is not in a team. Access groups cannot be assigned to \"\n                    \"personal keys by non-admin callers. Disallowed access groups: \"\n                    f\"{sorted(access_group_ids)}.\"\n                ),\n            )\n\n        team_member_object: Final = _get_user_in_team(team_table=team_table, user_id=user_api_key_dict.user_id)\n\n        # Team admins always bypass (consistent with other member-permission checks).\n        if team_member_object is not None and team_member_object.role == \"admin\":\n            return\n\n        permissions: Final = (\n            TeamMemberPermissionChecks._get_list_of_route_enum_as_str(\n                TeamMemberPermissionChecks.get_permissions_for_team_member(\n                    team_member_object=team_member_object,","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_helpers/team_member_permission_checks.py#L153-L189","documentation":"HTTPException(403) from the access-group assignment guard: a caller who is not a proxy admin and whose team membership is gated/non-admin tried to assign access_group_ids to a personal (teamless) key. Access groups can only be set on personal keys by proxy admins; the message lists the offending groups.","triggerScenarios":"Thrown at litellm/proxy/management_helpers/team_member_permission_checks.py:171 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Assign the key to a team first, remove the requested access groups, or call as a proxy admin."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}