{"record":{"id":"d629c70907c010bc","repo":"BerriAI/litellm","slug":"user-user-api-key-dict-user-id-does-not-have-acc-d629c7","errorCode":null,"errorMessage":"User {user_api_key_dict.user_id} does not have access to vector store {vector_store_id}","messagePattern":"User (.+?) does not have access to vector store (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"enterprise/litellm_enterprise/proxy/hooks/managed_vector_stores.py","lineNumber":290,"sourceCode":"            True if this is a managed vector store and user has access\n            \n        Raises:\n            HTTPException: If user doesn't have access\n        \"\"\"\n        vector_store_id = cast(Optional[str], data.get(\"vector_store_id\"))\n        is_unified_id = (\n            is_base64_encoded_unified_id(vector_store_id)\n            if vector_store_id\n            else False\n        )\n        \n        if is_unified_id and vector_store_id:\n            if await self.can_user_access_unified_resource_id(\n                vector_store_id, user_api_key_dict\n            ):\n                return True\n            else:\n                raise HTTPException(\n                    status_code=403,\n                    detail=f\"User {user_api_key_dict.user_id} does not have access to vector store {vector_store_id}\",\n                )\n        \n        return False\n\n    # ============================================================================\n    #                     PRE-CALL HOOK (For Router Integration)\n    # ============================================================================\n\n    async def async_pre_call_hook(\n        self,\n        user_api_key_dict: UserAPIKeyAuth,\n        cache: Any,\n        data: Dict,\n        call_type: str,\n    ) -> Union[Exception, str, Dict, None]:\n        \"\"\"","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/enterprise/litellm_enterprise/proxy/hooks/managed_vector_stores.py#L272-L308","documentation":"Access gate for unified vector-store ids: when the id is a base64-encoded LiteLLM unified id, the hook checks can_user_access_unified_resource_id against the calling user/api-key and raises HTTP 403 on denial before any provider traffic. Raw (non-unified) ids fall through and return False instead of raising.","triggerScenarios":"An enterprise vector-store CRUD or search request referencing a unified vector store id created by a different team/user, made with a virtual key whose team does not own the store.","commonSituations":"Copying vector store ids between teams or apps without sharing them; personal keys used against team-owned stores; stale ids after a store was recreated under another owner.","solutions":["Use a vector store id owned by the caller's team, or create a new one via the managed vector-store endpoint","Ask an admin to grant the user's team access to the store","Verify ownership by listing vector stores as admin before using the id"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"stores = await admin_client.vector_stores.list()  # admin/master key\nowned = {s.id for s in stores if my_team_owns(s)}\nif vector_store_id not in owned:\n    raise PermissionError(f\"team does not own {vector_store_id}; request access or create your own\")","typeGuard":null,"tryCatchPattern":"try:\n    result = await search_vector_store(vector_store_id, ...)\nexcept HTTPStatusError as e:\n    if e.response.status_code == 403:\n        # surface 'request access' UX instead of retrying\n        ...\n    raise","preventionTips":["Create vector stores per team and never hardcode other teams' ids","Have admins grant team access before sharing store ids in configs"],"tags":["litellm","vector-stores","authorization","http-403","enterprise"],"backgroundTag":"permission-denied","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}