{"record":{"id":"4e6b6f3c04e9817c","repo":"BerriAI/litellm","slug":"access-denied-to-managed-resource","errorCode":null,"errorMessage":"Access denied to managed resource.","messagePattern":"Access denied to managed resource\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/pass_through_endpoints/managed_id_rewriter.py","lineNumber":393,"sourceCode":"                    row_created_by = obj_row.created_by\n                    row_team_id = obj_row.team_id\n                    found = True\n            except Exception:\n                verbose_proxy_logger.debug(\n                    \"managed_id_rewriter._resolve_one: object DB lookup failed\",\n                    exc_info=True,\n                )\n\n    # 3. Hard 404 for unknown / forged IDs — NEVER forward to upstream\n    if not found:\n        raise HTTPException(\n            status_code=404,\n            detail=\"Managed resource not found.\",\n        )\n\n    # 4. Access check\n    if not can_access_resource(user_api_key_dict, row_created_by, row_team_id):\n        raise HTTPException(\n            status_code=403,\n            detail=\"Access denied to managed resource.\",\n        )\n\n    return payload.raw_provider_id\n\n\nasync def _guard_raw_provider_id(\n    raw_id: str,\n    provider: str,\n    user_api_key_dict: UserAPIKeyAuth,\n    prisma_client: PrismaClient | None,\n    budget: _RawIdGuardBudget | None = None,\n) -> None:\n    \"\"\"Deny a raw provider ID that maps to a managed resource the caller does\n    not own, before it is forwarded upstream.\n\n    Clients only ever receive managed IDs (response bodies are rewritten), so a","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/pass_through_endpoints/managed_id_rewriter.py#L375-L411","documentation":"Access-control failure after a managed resource was found: the caller's user/team (from user_api_key_dict) does not match the row's created_by/team_id, so the resolution is refused even though the ID itself is valid.","triggerScenarios":"Thrown at litellm/proxy/pass_through_endpoints/managed_id_rewriter.py:393 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an API key/team that owns or is granted access to the managed resource.","Ask a proxy admin to grant the key or team access to the resource."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}