{"record":{"id":"8186aa362eda5077","repo":"BerriAI/litellm","slug":"agent-agent-name-is-not-allowed-for-your-key-t","errorCode":null,"errorMessage":"Agent '{agent_name}' is not allowed for your key/team. Contact proxy admin for access.","messagePattern":"Agent '(.+?)' is not allowed for your key/team\\. Contact proxy admin for access\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/agent_endpoints/a2a_routing.py","lineNumber":64,"sourceCode":"    # Look up agent in registry\n    agent: Final = global_agent_registry.get_agent_by_name(agent_name)\n    if agent is None:\n        verbose_proxy_logger.error(\"[A2A] Agent '%s' not found in registry\", agent_name)\n        route_name = ROUTE_ENDPOINT_MAPPING.get(route_type, route_type)\n        raise ProxyModelNotFoundError(route=route_name, model_name=model_name)\n\n    # Verify the caller is permitted to use this agent (admins bypass the check)\n    is_admin: Final = user_api_key_dict is not None and (\n        user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN\n        or user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value\n    )\n    if not is_admin:\n        is_allowed: Final = await AgentRequestHandler.is_agent_allowed(\n            agent_id=agent.agent_id,\n            user_api_key_auth=user_api_key_dict,\n        )\n        if not is_allowed:\n            raise HTTPException(\n                status_code=403,\n                detail=f\"Agent '{agent_name}' is not allowed for your key/team. Contact proxy admin for access.\",\n            )\n\n    # Get API base URL from agent config\n    if not agent.agent_card_params or \"url\" not in agent.agent_card_params:\n        verbose_proxy_logger.error(\"[A2A] Agent '%s' has no URL configured\", agent_name)\n        route_name = ROUTE_ENDPOINT_MAPPING.get(route_type, route_type)\n        raise ProxyModelNotFoundError(route=route_name, model_name=model_name)\n\n    # Inject API base and route to litellm\n    data[\"api_base\"] = agent.agent_card_params[\"url\"]\n    verbose_proxy_logger.debug(\"[A2A] Routing %s to %s\", model_name, data[\"api_base\"])\n\n    return getattr(litellm, f\"{route_type}\")(**data)\n","sourceCodeStart":46,"sourceCodeEnd":80,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/agent_endpoints/a2a_routing.py#L46-L80","documentation":"Raised in A2A routing when the agent was found in the registry and the caller is not a proxy admin (admins bypass the permission check), and the key/team-level agent access check denied the request. Distinct from the registry-miss case just above it (which raises ProxyModelNotFoundError): here the agent exists, the caller just lacks permission, so the request fails with a 403-class error.","triggerScenarios":"Thrown at litellm/proxy/agent_endpoints/a2a_routing.py:64 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ask the proxy admin to grant your key/team access to this agent."],"exampleFix":"Contact admin for agent access.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}