{"record":{"id":"6b4bf9c8bef15907","repo":"BerriAI/litellm","slug":"call-not-allowed-user-not-proxy-admin-or-team-adm","errorCode":null,"errorMessage":"Call not allowed. User not proxy admin OR team admin. route={}, team_id={}","messagePattern":"Call not allowed\\. User not proxy admin OR team admin\\. route=(.+?), team_id=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/team_endpoints.py","lineNumber":2502,"sourceCode":"    Standard users can self-join an *available team*, but the bypass\n    must not be allowed to escalate them to ``role=admin`` or to add\n    other users into the team.  When access is granted via the\n    available-team bypass we therefore enforce that every member in\n    the request matches the caller's own ``user_id`` and is being\n    added with ``role=\"user\"``.\n    \"\"\"\n    if getattr(user_api_key_dict, \"user_role\", None) == LitellmUserRoles.PROXY_ADMIN.value:\n        return\n    if _is_user_team_admin(user_api_key_dict=user_api_key_dict, team_obj=complete_team_data):\n        return\n    if await _is_user_org_admin_for_team(user_api_key_dict=user_api_key_dict, team_obj=complete_team_data):\n        return\n\n    if not _is_available_team(\n        team_id=complete_team_data.team_id,\n        user_api_key_dict=user_api_key_dict,\n    ):\n        raise HTTPException(\n            status_code=403,\n            detail={\n                \"error\": \"Call not allowed. User not proxy admin OR team admin. route={}, team_id={}\".format(\n                    \"/team/member_add\",\n                    complete_team_data.team_id,\n                )\n            },\n        )\n\n    # Available-team self-join grants only the ability to join; per-member\n    # budget and model controls stay admin-only.  Reject them here so a\n    # self-joining non-admin cannot set their own cap, reset window, or model\n    # scope via the bypass.\n    if data.max_budget_in_team is not None or data.budget_duration is not None or data.allowed_models is not None:\n        raise HTTPException(\n            status_code=403,\n            detail={\n                \"error\": (","sourceCodeStart":2484,"sourceCodeEnd":2520,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/team_endpoints.py#L2484-L2520","documentation":"Error \"Call not allowed. User not proxy admin OR team admin. route={}, team_id={}\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/team_endpoints.py:2502 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Call this route with a proxy admin key or a team admin key for the given team_id."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}