{"record":{"id":"a0231a869df2de84","repo":"BerriAI/litellm","slug":"if-object-id-jwt-field-is-set-role-mappings-must","errorCode":null,"errorMessage":"if object_id_jwt_field is set, role_mappings must also be set. Needed to infer if the caller is a user or team.","messagePattern":"if object_id_jwt_field is set, role_mappings must also be set\\. Needed to infer if the caller is a user or team\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/_types.py","lineNumber":4652,"sourceCode":"        enforce_scope_based_access: Final = kwargs.get(\"enforce_scope_based_access\")\n        custom_validate: Final = kwargs.get(\"custom_validate\")\n\n        if custom_validate is not None:\n            fn: Final = get_instance_fn(custom_validate, config_file_path=config_file_path)\n            validate_custom_validate_return_type(fn)\n            kwargs[\"custom_validate\"] = fn\n\n        if invalid_keys:\n            raise ValueError(\n                f\"Invalid arguments provided: {', '.join(invalid_keys)}. Allowed arguments are: {', '.join(allowed_keys)}.\"\n            )\n        if (user_roles_jwt_field is not None and user_allowed_roles is None) or (\n            user_roles_jwt_field is None and user_allowed_roles is not None\n        ):\n            raise ValueError(\"user_allowed_roles must be provided if user_roles_jwt_field is set.\")\n\n        if object_id_jwt_field is not None and role_mappings is None:\n            raise ValueError(\n                \"if object_id_jwt_field is set, role_mappings must also be set. Needed to infer if the caller is a user or team.\"\n            )\n\n        if scope_mappings is not None and not enforce_scope_based_access:\n            raise ValueError(\"scope_mappings must be set if enforce_scope_based_access is true.\")\n\n        super().__init__(**kwargs)\n\n\nclass PrismaCompatibleUpdateDBModel(TypedDict, total=False):\n    model_name: str\n    litellm_params: str\n    model_info: str\n    blocked: bool\n    updated_at: str\n    updated_by: str\n\n","sourceCodeStart":4634,"sourceCodeEnd":4670,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_types.py#L4634-L4670","documentation":"Raised while parsing the general_settings JWT auth block when object_id_jwt_field is set (LiteLLM should treat the caller as a user or team identified by a JWT claim) but role_mappings is missing. Role mappings are the only mechanism to infer whether a caller is a user or a team, so object-id-based auth cannot function without them; config load fails immediately.","triggerScenarios":"Thrown at litellm/proxy/_types.py:4652 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set role_mappings when object_id_jwt_field is set."],"exampleFix":"role_mappings={...}","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}