{"record":{"id":"ea2e4ad7c5d14bc9","repo":"BerriAI/litellm","slug":"only-proxy-admin-can-be-used-to-generate-delete","errorCode":null,"errorMessage":"Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route={route}. Your role={user_role}. Your user_id={masked_user_id}","messagePattern":"Only proxy admin can be used to generate, delete, update info for new keys/users/teams\\. Route=(.+?)\\. Your role=(.+?)\\. Your user_id=(.+?)","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/route_checks.py","lineNumber":224,"sourceCode":"    ) -> None:\n        \"\"\"\n        Raise exception for routes that require proxy admin access\n\n        Args:\n            user_obj (Optional[LiteLLM_UserTable]): The user object\n            route (str): The route being accessed\n\n        Raises:\n            Exception: With user role and masked user_id information\n        \"\"\"\n        user_role = \"unknown\"\n        user_id = \"unknown\"\n        if user_obj is not None:\n            user_role = user_obj.user_role or \"unknown\"\n            user_id = user_obj.user_id or \"unknown\"\n\n        masked_user_id: Final = RouteChecks._mask_user_id(user_id)\n        raise Exception(\n            f\"Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route={route}. Your role={user_role}. Your user_id={masked_user_id}\"\n        )\n\n    @staticmethod\n    def non_proxy_admin_allowed_routes_check(\n        user_obj: LiteLLM_UserTable | None,\n        _user_role: LitellmUserRoles | None,\n        route: str,\n        request: Request,\n        valid_token: UserAPIKeyAuth,\n        request_data: dict,\n    ):\n        \"\"\"\n        Checks if Non Proxy Admin User is allowed to access the route\n        \"\"\"\n\n        # Check user has defined custom admin routes\n        RouteChecks.custom_admin_only_route_check(","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/route_checks.py#L206-L242","documentation":"Admin-only gate for key/user/team management routes: the caller's role is not PROXY_ADMIN (or an accepted admin tier); route, role, and a masked user_id are embedded to make audit logs useful without leaking ids.","triggerScenarios":"Thrown at litellm/proxy/auth/route_checks.py:224 when the library encounters an invalid state.","commonSituations":"A non-admin user attempted to generate, delete, or update keys/users/teams.","solutions":["Use a proxy admin key (or the master key) for key/user/team management routes.","Have an admin perform the operation or grant your user the proxy admin role."],"exampleFix":"Retry the request with Authorization: Bearer $LITELLM_MASTER_KEY.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}