{"record":{"id":"c087f60a0811d1b8","repo":"BerriAI/litellm","slug":"non-admin-users-cannot-remove-the-user-id-from-a-k","errorCode":null,"errorMessage":"Non-admin users cannot remove the user_id from a key.","messagePattern":"Non-admin users cannot remove the user_id from a key\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/key_management_endpoints.py","lineNumber":617,"sourceCode":"    not. Sharing the check keeps both endpoints — and any future\n    regenerate-style endpoint — consistent.\n    \"\"\"\n    if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value:\n        return\n    if data is None:\n        return\n    # Distinguish \"user_id omitted\" from \"user_id explicitly set to None\".\n    # Both leave ``getattr(data, 'user_id', None)`` at None, but only the\n    # explicit-null variant survives ``model_dump(exclude_unset=True)`` in\n    # ``prepare_key_update_data`` and writes NULL to the token row —\n    # detaching the key from its user and bypassing the user-row\n    # role check on subsequent requests.\n    fields_set: Final = getattr(data, \"model_fields_set\", None) or set()\n    if \"user_id\" not in fields_set:\n        return\n    incoming_user_id: Final = getattr(data, \"user_id\", None)\n    if incoming_user_id is None or incoming_user_id == \"\":\n        raise HTTPException(\n            status_code=403,\n            detail=\"Non-admin users cannot remove the user_id from a key.\",\n        )\n    existing_user_id: Final = getattr(existing_key_row, \"user_id\", None)\n    if incoming_user_id != existing_user_id:\n        raise HTTPException(\n            status_code=403,\n            detail=(\n                f\"Non-admin caller is not allowed to rebind the key from \"\n                f\"user={existing_user_id} to user={incoming_user_id}\"\n            ),\n        )\n\n\ndef _check_allowed_routes_caller_permission(\n    allowed_routes: list | None,\n    user_api_key_dict: UserAPIKeyAuth,\n    *,","sourceCodeStart":599,"sourceCodeEnd":635,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/key_management_endpoints.py#L599-L635","documentation":"Error \"Non-admin users cannot remove the user_id from a key.\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:617 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Keep the existing user_id on the key, or ask a proxy admin to remove it.","Create a new key without a user_id instead of stripping it from an existing key."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}