{"record":{"id":"9d4eeb208b145b17","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-create-update-or-delete-ag","errorCode":null,"errorMessage":"Only proxy admins can create, update, or delete agents. Your role={user_api_key_dict.user_role}","messagePattern":"Only proxy admins can create, update, or delete agents\\. Your role=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/agent_endpoints/endpoints.py","lineNumber":162,"sourceCode":"        copy.keys = None\n        if copy.litellm_params:\n            copy.litellm_params = _get_masked_values(\n                copy.litellm_params,\n                unmasked_length=4,\n                number_of_asterisks=4,\n            )\n        redacted.append(copy)\n    return redacted\n\n\ndef _check_agent_management_permission(user_api_key_dict: UserAPIKeyAuth) -> None:\n    \"\"\"\n    Raises HTTP 403 if the caller does not have permission to create, update,\n    or delete agents.  Only PROXY_ADMIN users are allowed to perform these\n    write operations.\n    \"\"\"\n    if user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN:\n        raise HTTPException(\n            status_code=403,\n            detail={\n                \"error\": f\"Only proxy admins can create, update, or delete agents. Your role={user_api_key_dict.user_role}\"\n            },\n        )\n\n\nAGENT_HEALTH_CHECK_TIMEOUT_SECONDS: Final = float(os.environ.get(\"LITELLM_AGENT_HEALTH_CHECK_TIMEOUT\", \"5.0\"))\nAGENT_HEALTH_CHECK_GATHER_TIMEOUT_SECONDS = float(os.environ.get(\"LITELLM_AGENT_HEALTH_CHECK_GATHER_TIMEOUT\", \"30.0\"))\n\n\nclass _AgentHealthResult(TypedDict, total=False):\n    agent_id: Required[str]\n    healthy: Required[bool]\n    error: str\n\n\nasync def _check_agent_url_health(","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/agent_endpoints/endpoints.py#L144-L180","documentation":"Raised by _check_agent_management_permission when a caller attempts the agent create/update/delete endpoints with any role other than PROXY_ADMIN. Agent definitions can rewrite routing and credentials, so writes are admin-only by design; the caller's actual role is embedded in the message. Read-only endpoints are unaffected.","triggerScenarios":"Thrown at litellm/proxy/agent_endpoints/endpoints.py:162 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a key with the PROXY_ADMIN role to manage agents."],"exampleFix":"Retry with an admin key.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}