{"record":{"id":"db86f7150f31311e","repo":"BerriAI/litellm","slug":"user-not-allowed-to-give-access-to-all-models-sel","errorCode":null,"errorMessage":"User not allowed to give access to all models. Select models you want org to have access to.","messagePattern":"User not allowed to give access to all models\\. Select models you want org to have access to\\.","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/management_endpoints/organization_endpoints.py","lineNumber":468,"sourceCode":"            }\n        )\n\n        data.budget_id = _budget.budget_id\n\n    ## Handle Object Permission - MCP, Vector Stores etc.\n    object_permission_id: Final = await _set_object_permission(\n        data=data,\n        prisma_client=prisma_client,\n    )\n\n    \"\"\"\n    Ensure only models that user has access to, are given to org\n    \"\"\"\n    if len(user_api_key_dict.models) == 0:  # user has access to all models\n        pass\n    else:\n        if len(data.models) == 0:\n            raise HTTPException(\n                status_code=400,\n                detail={\n                    \"error\": \"User not allowed to give access to all models. Select models you want org to have access to.\"\n                },\n            )\n\n        for m in data.models:\n            await can_user_call_model(m, llm_router=llm_router, user_object=user_object_correct_type)\n\n    organization_row: Final = LiteLLM_OrganizationTable(\n        **data.json(exclude_none=True),\n        object_permission_id=object_permission_id,\n        created_by=user_api_key_dict.user_id or litellm_proxy_admin_name,\n        updated_by=user_api_key_dict.user_id or litellm_proxy_admin_name,\n    )\n\n    for field in LiteLLM_ManagementEndpoint_MetadataFields:\n        if getattr(data, field, None) is not None:","sourceCodeStart":450,"sourceCodeEnd":486,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/organization_endpoints.py#L450-L486","documentation":"Scope-narrowing guard on org creation: the caller's key restricts them to a specific model list (user_api_key_dict.models is non-empty) but the request carries an empty models list, which would grant the org all models — an escalation the caller is not entitled to. Callers with unrestricted keys may pass an empty list.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/organization_endpoints.py:468 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Select the specific models the org should access instead of granting all models."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}