{"record":{"id":"59cb2b538e59c704","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-set-allowed-routes-on-a-ke","errorCode":null,"errorMessage":"Only proxy admins can set `allowed_routes` on a key. Use `key_type` to pick a preset route bucket instead.","messagePattern":"Only proxy admins can set `allowed_routes` on a key\\. Use `key_type` to pick a preset route bucket instead\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/key_management_endpoints.py","lineNumber":664,"sourceCode":"    one that sends any explicit value.\n\n    Post-`handle_key_type` call sites pass `allow_safe_presets=True` with the\n    values derived by `handle_key_type`; those values are not from the request\n    body, so `allowed_routes_was_provided` stays False and the safe-preset\n    carve-out below accepts any list of tokens in\n    `_NON_ADMIN_SAFE_ALLOWED_ROUTES_PRESETS`.\n    \"\"\"\n    if not allowed_routes_was_provided and not allowed_routes:\n        return\n    if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value:\n        return\n    if (\n        allow_safe_presets\n        and allowed_routes\n        and all(r in _NON_ADMIN_SAFE_ALLOWED_ROUTES_PRESETS for r in allowed_routes)\n    ):\n        return\n    raise HTTPException(\n        status_code=403,\n        detail={\n            \"error\": (\n                \"Only proxy admins can set `allowed_routes` on a key. \"\n                \"Use `key_type` to pick a preset route bucket instead.\"\n            )\n        },\n    )\n\n\ndef _check_permissions_caller_permission(\n    data: GenerateRequestBase,\n    user_api_key_dict: UserAPIKeyAuth,\n) -> None:\n    \"\"\"\n    Require PROXY_ADMIN when `permissions` is present in the request body.\n\n    Presence is detected via `data.model_fields_set` so a caller that","sourceCodeStart":646,"sourceCodeEnd":682,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/key_management_endpoints.py#L646-L682","documentation":"Error \"Only proxy admins can set `allowed_routes` on a key. Use `key_type` to pick a preset route bucket instead.\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:664 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the key_type parameter to select a preset route bucket instead of allowed_routes.","Ask a proxy admin to set allowed_routes on the key."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}