{"record":{"id":"83d7b325adb016e0","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-discover-agent-cards-your-r","errorCode":null,"errorMessage":"Only proxy admins can discover agent cards. Your role={user_api_key_dict.user_role}","messagePattern":"Only proxy admins can discover agent cards\\. Your role=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/a2a/endpoints.py","lineNumber":92,"sourceCode":"    user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),\n) -> JSONResponse:\n    \"\"\"\n    Fetch the upstream agent's well-known card so the UI can show the admin\n    which skills/capabilities the agent exposes.\n\n    Only proxy admins can call this — the UI uses it during agent registration,\n    and we don't want arbitrary keys probing internal URLs.\n\n    Example:\n    ```bash\n    curl -X POST \"http://localhost:4000/v1/a2a/discover\" \\\\\n        -H \"Authorization: Bearer <admin_key>\" \\\\\n        -H \"Content-Type: application/json\" \\\\\n        -d '{\"url\": \"https://upstream-agent.example.com\"}'\n    ```\n    \"\"\"\n    if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:\n        raise HTTPException(\n            status_code=403,\n            detail=(f\"Only proxy admins can discover agent cards. Your role={user_api_key_dict.user_role}\"),\n        )\n\n    try:\n        card: Final = await fetch_well_known_card(\n            request.url,\n            discovery_mode=request.discovery_mode,\n            params=request.params,\n        )\n    except AgentCardDiscoveryError as exc:\n        raise HTTPException(status_code=400, detail=str(exc))\n    except Exception as exc:\n        verbose_proxy_logger.exception(\"Unexpected error during A2A discovery: %s\", exc)\n        raise HTTPException(status_code=500, detail=f\"Discovery failed: {exc}\")\n\n    return JSONResponse(\n        content={\"url\": request.url, \"agent_card\": card},","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/a2a/endpoints.py#L74-L110","documentation":"The /v1/a2a/discover endpoint is admin-only because it makes the proxy probe arbitrary caller-supplied URLs; non-admin roles are rejected 403 to prevent using the proxy to enumerate internal networks.","triggerScenarios":"Thrown at litellm/proxy/a2a/endpoints.py:92 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a key with the PROXY_ADMIN role to discover agent cards."],"exampleFix":"Retry with an admin key.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}