{"record":{"id":"d797c03e1e68f7ff","repo":"BerriAI/litellm","slug":"non-admin-caller-is-not-allowed-to-rebind-the-key","errorCode":null,"errorMessage":"Non-admin caller is not allowed to rebind the key from user={existing_user_id} to user={incoming_user_id}","messagePattern":"Non-admin caller is not allowed to rebind the key from user=(.+?) to user=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/key_management_endpoints.py","lineNumber":623,"sourceCode":"        return\n    # Distinguish \"user_id omitted\" from \"user_id explicitly set to None\".\n    # Both leave ``getattr(data, 'user_id', None)`` at None, but only the\n    # explicit-null variant survives ``model_dump(exclude_unset=True)`` in\n    # ``prepare_key_update_data`` and writes NULL to the token row —\n    # detaching the key from its user and bypassing the user-row\n    # role check on subsequent requests.\n    fields_set: Final = getattr(data, \"model_fields_set\", None) or set()\n    if \"user_id\" not in fields_set:\n        return\n    incoming_user_id: Final = getattr(data, \"user_id\", None)\n    if incoming_user_id is None or incoming_user_id == \"\":\n        raise HTTPException(\n            status_code=403,\n            detail=\"Non-admin users cannot remove the user_id from a key.\",\n        )\n    existing_user_id: Final = getattr(existing_key_row, \"user_id\", None)\n    if incoming_user_id != existing_user_id:\n        raise HTTPException(\n            status_code=403,\n            detail=(\n                f\"Non-admin caller is not allowed to rebind the key from \"\n                f\"user={existing_user_id} to user={incoming_user_id}\"\n            ),\n        )\n\n\ndef _check_allowed_routes_caller_permission(\n    allowed_routes: list | None,\n    user_api_key_dict: UserAPIKeyAuth,\n    *,\n    allowed_routes_was_provided: bool = False,\n    allow_safe_presets: bool = False,\n) -> None:\n    \"\"\"\n    Require PROXY_ADMIN when `allowed_routes` is present in the request body,\n    unless the caller went through the `key_type` preset flow.","sourceCodeStart":605,"sourceCodeEnd":641,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/key_management_endpoints.py#L605-L641","documentation":"Error \"Non-admin caller is not allowed to rebind the key from user={existing_user_id} to user={incoming_user_id}\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:623 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ask a proxy admin to reassign the key to the new user.","Create a new key for the target user instead of rebinding an existing key."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}