{"record":{"id":"a9b95ca746deda45","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-set-permissions","errorCode":null,"errorMessage":"Only proxy admins can set `permissions`.","messagePattern":"Only proxy admins can set `permissions`\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/key_management_endpoints.py","lineNumber":691,"sourceCode":"\n\ndef _check_permissions_caller_permission(\n    data: GenerateRequestBase,\n    user_api_key_dict: UserAPIKeyAuth,\n) -> None:\n    \"\"\"\n    Require PROXY_ADMIN when `permissions` is present in the request body.\n\n    Presence is detected via `data.model_fields_set` so a caller that\n    omits the field (default flows through) is distinct from one that\n    sends any explicit value.\n    \"\"\"\n    permissions_in_request: Final = \"permissions\" in data.model_fields_set\n    if not permissions_in_request and not data.permissions:\n        return\n    if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value:\n        return\n    raise HTTPException(\n        status_code=403,\n        detail={\"error\": \"Only proxy admins can set `permissions`.\"},\n    )\n\n\ndef _check_budget_limits_delegation_ceiling(\n    budget_limits: list[BudgetLimitEntry] | None,\n    delegation_ceiling: float | None,\n    user_api_key_dict: UserAPIKeyAuth,\n    is_ui_session_team_key: bool,\n    team_table: LiteLLM_TeamTableCachedObj | None,\n) -> None:\n    \"\"\"\n    Enforce three invariants on `budget_limits`:\n\n    - Every `budget_limits[*].max_budget` must be a finite number; applies\n      to every caller including proxy admin.\n    - A CLI session token caller may not set `budget_limits` on a personal","sourceCodeStart":673,"sourceCodeEnd":709,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/key_management_endpoints.py#L673-L709","documentation":"Error \"Only proxy admins can set `permissions`.\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:691 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the permissions field from the request.","Ask a proxy admin to set permissions on the key."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}