{"record":{"id":"51a8a0c1f51934ce","repo":"BerriAI/litellm","slug":"setting-a-model-access-group-on-a-wildcard-model-i","errorCode":null,"errorMessage":"Setting a model access group on a wildcard model is only available for LiteLLM Enterprise users.{CommonProxyErrors.not_premium_user.value}","messagePattern":"Setting a model access group on a wildcard model is only available for LiteLLM Enterprise users\\.(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/key_management_endpoints.py","lineNumber":3733,"sourceCode":"\n        return {\"key\": key, \"info\": key_info}\n    except Exception as e:\n        raise handle_exception_on_proxy(e)\n\n\ndef _check_model_access_group(models: list[str] | None, llm_router: Router | None, premium_user: bool) -> Literal[True]:\n    \"\"\"\n    if is_model_access_group is True + is_wildcard_route is True, check if user is a premium user\n\n    Return True if user is a premium user, False otherwise\n    \"\"\"\n    if models is None or llm_router is None:\n        return True\n\n    for model in models:\n        if llm_router._is_model_access_group_for_wildcard_route(model_access_group=model):\n            if not premium_user:\n                raise HTTPException(\n                    status_code=status.HTTP_403_FORBIDDEN,\n                    detail={\n                        \"error\": f\"Setting a model access group on a wildcard model is only available for LiteLLM Enterprise users.{CommonProxyErrors.not_premium_user.value}\"\n                    },\n                )\n\n    return True\n\n\nasync def generate_key_helper_fn(\n    request_type: Literal[\"user\", \"key\"],  # identifies if this request is from /user/new or /key/generate\n    duration: str | None = None,\n    models: list = [],\n    aliases: dict = {},\n    config: dict = {},\n    spend: float = 0.0,\n    key_max_budget: float | None = None,  # key_max_budget is used to Budget Per key\n    key_budget_duration: str | None = None,","sourceCodeStart":3715,"sourceCodeEnd":3751,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/key_management_endpoints.py#L3715-L3751","documentation":"_check_model_access_group rejects a key or request whose model list puts a model access group (e.g. 'openai-o1-group' defined under model_access_groups in the router config) on a wildcard route (a deployment whose model_name is a pattern like '*'). Combining access groups with wildcards is an Enterprise-gated feature; on non-premium (OSS) LiteLLM the check returns 403 with CommonProxyErrors.not_premium_user guidance. Premium status comes from the LITELLM_LICENSE env var validated against the enterprise token.","triggerScenarios":"POST /key/generate with models=['*'] or a wildcard-adjacent pattern while your config defines model_access_groups on wildcard deployments; OSS deployment with no LITELLM_LICENSE using access groups together with wildcard model routing.","commonSituations":"Config written against Enterprise docs then deployed on OSS; license key missing/expired in the container so premium_user resolves False; wildcard deployment added later under an existing access-group config.","solutions":["Set a valid LITELLM_LICENSE (Enterprise) in the proxy environment if you have one — get a trial key from litellm.ai/enterprise#trial.","If staying on OSS, stop combining model access groups with wildcard models: replace wildcards with explicit model names in the key's models list and deployment model_name.","Audit config.yaml: find deployments with wildcard model_name that also appear in model_access_groups and restructure them."],"exampleFix":"# before (config.yaml)\n# model_list:\n#   - model_name: \"*\"\n#     litellm_params: {model: openai/*}\n# and key request:\nclient.post(\"/key/generate\", json={\"models\": [\"my-access-group\"]})\n\n# after (OSS-compatible: explicit models)\nclient.post(\"/key/generate\", json={\"models\": [\"gpt-4o\", \"gpt-4o-mini\"]})","handlingStrategy":"fallback","validationCode":"def uses_access_group_with_wildcard(models: list[str] | None, access_groups: set[str]) -> bool:\n    return models is not None and any(m in access_groups for m in models) and not premium_user\n\n# guard before calling /key/generate on OSS:\nif uses_access_group_with_wildcard(models, configured_access_groups):\n    models = expand_access_group_to_model_names(models)","typeGuard":"def is_enterprise_configured() -> bool:\n    return bool(os.environ.get(\"LITELLM_LICENSE\"))","tryCatchPattern":"try:\n    client.post(\"/key/generate\", json={\"models\": models})\nexcept HTTPError as e:\n    if e.response.status_code == 403 and \"LiteLLM Enterprise\" in e.response.text:\n        models = expand_access_group_to_model_names(models)  # fall back to explicit list\n        client.post(\"/key/generate\", json={\"models\": models})\n    else:\n        raise","preventionTips":["Don't mix model_access_groups with wildcard (pattern) deployments in OSS deployments.","Set LITELLM_LICENSE via secret in every environment licensed for Enterprise features.","Validate the license at startup (premium status appears in proxy logs/UI) rather than at first key creation."],"tags":["licensing","enterprise","model-access-group","wildcard-route","litellm-proxy"],"backgroundTag":"enterprise-license-required","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}