{"record":{"id":"3aa36958d807ca8d","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-access-the-openapi-registry","errorCode":null,"errorMessage":"Only proxy admins can access the OpenAPI registry. Your role={user_api_key_dict.user_role}","messagePattern":"Only proxy admins can access the OpenAPI registry\\. Your role=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/mcp_management_endpoints.py","lineNumber":2786,"sourceCode":"        \"openapi_registry.json\",\n    )\n\n    @functools.lru_cache(maxsize=1)\n    def _load_openapi_registry() -> dict[str, object]:\n        with open(_OPENAPI_REGISTRY_PATH, \"r\") as f:\n            data: Final[dict[str, object]] = json.load(f)\n        return data\n\n    @router.get(\n        \"/openapi-registry\",\n        description=\"Returns well-known OpenAPI APIs with OAuth 2.0 metadata for the OpenAPI MCP picker\",\n    )\n    async def get_openapi_registry(\n        user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),\n    ):\n        # Admin Viewer follows the read-parity rule.\n        if not _user_has_admin_view(user_api_key_dict):\n            raise HTTPException(\n                status_code=403,\n                detail={\n                    \"error\": f\"Only proxy admins can access the OpenAPI registry. Your role={user_api_key_dict.user_role}\"\n                },\n            )\n        try:\n            return _load_openapi_registry()\n        except Exception as e:\n            verbose_proxy_logger.warning(\"Failed to load OpenAPI registry from %s: %s\", _OPENAPI_REGISTRY_PATH, e)\n            return {\"apis\": []}\n\n    # ---------------------------------------------------------------------------\n    # MCP Toolset endpoints\n    # ---------------------------------------------------------------------------\n\n    from litellm.proxy._experimental.mcp_server.toolset_db import (\n        create_mcp_toolset,\n        delete_mcp_toolset,","sourceCodeStart":2768,"sourceCodeEnd":2804,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/mcp_management_endpoints.py#L2768-L2804","documentation":"Role guard on GET /v1/mcp/openapi-registry: the OpenAPI/OAuth2 registry used by the picker UI is admin-only, following the read-parity rule with other admin endpoints. Non-admins get 403 with their role in the message.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:2786 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a PROXY_ADMIN API key to access the OpenAPI registry."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}