tPjҋUdZddlmZmZddlmZmZddlmZmZm Z m Z m Z ddl Z ddl m Z mZmZmZddlmZmZerddlmZdd lmZdd lmZddlZdd lmZdd lmZdd l ddl!m"Z"ddl#m$Z$m%Z%ddl&m'Z'ddl(m)Z)ddl*m+Z+m,Z,ddlm-Z-ddl.m/Z/ddl0m1Z1ddl2m3Z3ddl4m5Z5m6Z6m7Z7m8Z8e ddZ9ee:d<ee;eee:d<erGdde e9Z?e de1dd fd!Z@e de/dd"fd#Z@de1e/zde=fd$Z@e ZAee:d%<d&ee<ddfd'ZBd(ee<deCeZMeAjd?d.gd/ee"g@eAjdAd.gee"ge62ee"fd3eJdBeNde6fdCZOeAjdDd.gee"ge62eAjdEd.gd/ee"g@e jdFGfdHer@intrBr1r4r+r+<s|2615 "3;'$. "S$Y'$. "_  "2615 %3;'$. %S$Y'$. %h   %26 #v+& S$Y'$.   26  "3;' "#v+& "S$Y'$.  " _  " 3;' #wsF{334    M73;+?LCLrJr+repor.z_TableOps[PrismaEndUserRow]cyr0r1rKs r4 _typed_tablerN_sLOrJz_TableOps[PrismaBudgetRow]cyr0r1rMs r4rNrNasJMrJc|jSr0)tablerMs r4rNrNcs ::rJrouter cache_keyscLKddlm}ddlm}|||d{y7w)a Every endpoint that mutates an end-user row must call this, or a newly blocked or budgeted customer keeps being served unrestricted until the TTL expires: auth reads end users cache-first, and the cached restricted-id registry decides whether the row is read at all. r)evict_and_broadcast)user_api_key_cache)rSrVN)9litellm.proxy.common_utils.auth_cache_invalidation_pubsubrUlitellm.proxy.proxy_serverrV)rSrUrVs r4_evict_end_user_cache_keysrYjs! > HZ [[[s $"$user_ids.c.gd|DtS)z]The per-id entries plus the registry, which any restriction change can move ids in or out of.c32K|]}t|ywr0)r).0user_ids r4 z'_end_user_cache_keys..zs Bg ) Bs)r)rZs r4_end_user_cache_keysr`xs m B B mDjDl mmrJrecordcHtj|jS)zValidate a raw end-user DB row into the typed customer response. object_permission reverse relations and the budget's audit fields are dropped here by the response model's field set, so callers need no manual cleanup. )r$model_validate model_dump)ras r4_to_customer_responsere}s  * *6+<+<+> ??rJz/end_user/blockzCustomer ManagementF)tags dependenciesinclude_in_schemaz/customer/block)rfrgresponse_modelr9cKddlm} g}||jD]J}tt |j d|i|ddddid d{}|j |Ltt|jd{ntd d d i d|iS7Q7#t$r3}tjd|td d t|i d}~wwxYww)a [BETA] Reject calls with this end-user id Parameters: - user_ids (List[str], required): The unique `user_id`s for the users to block (any /chat/completion call with this user={end-user-id} param, will be rejected.) ``` curl -X POST "http://0.0.0.0:8000/user/block" -H "Authorization: Bearer sk-1234" -d '{ "user_ids": [, ...] }' ``` r prisma_clientNr^T)r^blockedrm)r;r>r,r9errorzPostgres DB Not connected status_codedetail blocked_userszAn error occurred - %s)rXrlrZrNr!r@appendrYr`r ExceptionrrprF)r9rlrecordsidraes r4 block_userrzs:9G  $mm '+,=m,LMTT$b/.0T"B#,d"3 U v& '--A$---PQ Q Q!<=   )) R G""#;Q?Wc!f4EFFGsMC$AB%B!8B%B# B% C$!B%#B%% C!..CC!!C$z/end_user/unblockz/customer/unblockcK ddlmtfdtjDrtjtdddittjtr1|jD]!}tjj|#ntddd id tjiS#t$r+tdddtj j ziwxYww) z [BETA] Unblock calls with this user id Example ``` curl -X POST "http://0.0.0.0:8000/user/unblock" -H "Authorization: Bearer sk-1234" -d '{ "user_ids": [, ...] }' ``` r)_ENTERPRISE_BlockedUserListrpz:Blocked user check was never set. This call has no effect.rqc36K|]}t|ywr0) isinstance)r]xr|s r4r_zunblock_user..sVq 19:VsrozF`blocked_user_list` must be set as a list. Filepaths can't be updated.rt)-enterprise.enterprise_hooks.blocked_user_listr| ImportErrorrCommonProxyErrors!missing_enterprise_package_dockervalueanylitellm callbacksblocked_user_listrlistrZremove)r9rxr|s @r4 unblock_userrs2    VGDUDUV V  $ $ ,YZ  '++T2-- 1B  % % , ,R 0 1ef  W66 777  U#EEKKL   sC3B<B1C3<4C00C3ctjj}i}|D]}|dk(r t||d}||||<|r~tj |}t |j |jF|j :tjtt|j z|_|Sy)zE Return a new budget object if new budget params are passed. budget_idN)duration)seconds) BudgetNewRequest model_fieldskeysgetattrrcrbudget_durationbudget_reset_atrutcnowrr)r9 budget_paramsbudget_kv_pairs field_namerbudget_requests r4new_budget_requestrs,88==?MO$0  $ j$/  */OJ ' 0 0 ? ? P !?!?@  ) ) 1n6T6T6`-5__->+^5S5STB.N * rJnon_default_valuesend_user_table_data_typedupdate_end_user_table_datarlrcvKd|vr/| |jnd}t|||d{}|||d<yyy7w)a Handle object permission updates for customer endpoints. Updates the update_end_user_table_data dict in place with the new object_permission_id. Args: non_default_values: Dictionary containing the update values including object_permission end_user_table_data_typed: Existing end user table data update_end_user_table_data: Dictionary to update with new object_permission_id prisma_client: Prisma database client object_permissionN) data_jsonexisting_object_permission_idrlobject_permission_id)rr)rrrrlrrs r4)_handle_customer_object_permission_updatersg"00>W>c % : :im &-S(*G'- '  +AU &'= > ,1' s &979z /end_user/new)rfrhrgz /customer/newuser_api_key_dictc K ddlm}m}m}|'t ddt j ji |j{|'t ddt jji|j|jvr6t ddd|jd t|jii}t|}|p tt|ji|j!d |j"xs||j"xs|d  d{}|j(|d<n|j(|j(|d<t*j-|j/d } | j1D]\} } | t2j4vs| || <t*j-t7||d{}d|vr7t9j:d|j=d|j?ddttA|j|d d dd{} tCtE|j"fd{tG| S7J#t$$r}t ddt'|id}~wwxYw77d7?#t$$rP}t9jHd|dt'|vrtKd|j"ddddtM|d}~wwxYww)aF Allow creating a new Customer Parameters: - user_id: str - The unique identifier for the user. - alias: Optional[str] - A human-friendly alias for the user. - blocked: bool - Flag to allow or disallow requests for this end-user. Default is False. - max_budget: Optional[float] - The maximum budget allocated to the user. Either 'max_budget' or 'budget_id' should be provided, not both. - budget_id: Optional[str] - The identifier for an existing budget allocated to the user. Either 'max_budget' or 'budget_id' should be provided, not both. - allowed_model_region: Optional[Union[Literal["eu"], Literal["us"]]] - Require all user requests to use models in this specific region. - default_model: Optional[str] - If no equivalent model in the allowed region, default all requests to this model. - metadata: Optional[dict] = Metadata for customer, store information for customer. Example metadata = {"data_training_opt_out": True} - budget_duration: Optional[str] - Budget is reset at the end of specified duration. If not set, budget is never reset. You can set duration as seconds ("30s"), minutes ("30m"), hours ("30h"), days ("30d"). - tpm_limit: Optional[int] - [Not Implemented Yet] Specify tpm limit for a given customer (Tokens per minute) - rpm_limit: Optional[int] - [Not Implemented Yet] Specify rpm limit for a given customer (Requests per minute) - model_max_budget: Optional[dict] - [Not Implemented Yet] Specify max budget for a given model. Example: {"openai/gpt-4o-mini": {"max_budget": 100.0, "budget_duration": "1d"}} - max_parallel_requests: Optional[int] - [Not Implemented Yet] Specify max parallel requests for a given customer. - soft_budget: Optional[float] - [Not Implemented Yet] Get alerts when customer crosses given budget, doesn't block requests. - spend: Optional[float] - Specify initial spend for a given customer. - budget_reset_at: Optional[str] - Specify the date and time when the budget should be reset. - object_permission: Optional[LiteLLM_ObjectPermissionBase] - Customer-specific object permissions to control access to resources. Supported fields: * mcp_servers: List[str] - List of allowed MCP server IDs * mcp_access_groups: List[str] - List of MCP access group names * mcp_tool_permissions: Dict[str, List[str]] - Map of server ID to allowed tool names (e.g., {"server_1": ["tool_a", "tool_b"]}) * vector_stores: List[str] - List of allowed vector store IDs * agents: List[str] - List of allowed agent IDs * agent_access_groups: List[str] - List of agent access group names Example: {"mcp_servers": ["server_1", "server_2"], "vector_stores": ["vector_store_1"], "agents": ["agent_1"]} IF null or {} then no object-level restrictions apply. - Allow specifying allowed regions - Allow specifying default model Example curl: ``` curl --location 'http://0.0.0.0:4000/customer/new' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "user_id" : "ishaan-jaff-3", "allowed_region": "eu", "budget_id": "free_tier", "default_model": "azure/gpt-3.5-turbo-eu" }' # With object permissions curl -L -X POST 'http://localhost:4000/customer/new' -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' -d '{ "user_id": "user_1", "object_permission": { "mcp_servers": ["server_1"], "mcp_access_groups": ["public_group"], "vector_stores": ["vector_store_1"] } }' # return end-user object ``` NOTE: This used to be called `/end_user/new`, we will still be maintaining compatibility for /end_user/XXX for these endpoints r)litellm_proxy_admin_name llm_routerrlNrorprqizUDefault Model not on proxy. Configure via `/model/new` or config.yaml. Default_model=z, proxy_model_names=T) exclude_unset created_by updated_by)r9r) exclude_none)rrlrzLobject_permission still in new_end_user_obj after _set_object_permission: %slitellm_budget_tablerr9r-z\litellm.proxy.management_endpoints.customer_endpoints.new_end_user(): Exception occured - %sz3Unique constraint failed on the fields: (`user_id`)z(Customer already exists, passed user_id=z. Please pass a new user_id. bad_requestr}r^messagetypecodeparam)'rXrrrlrrdb_not_connected_errorr default_model no_llm_routerget_model_namessetrrNr r;rdr^rvrFrr)validate_pythondictitemsrrrrwarninggetpopr!rYr`re exceptionProxyExceptionr) r9rrrrlnew_end_user_obj _new_budget budget_recordry _user_datakvend_user_records r4 new_end_userr2std  .EEKKL  O+    )!# ##%6%D%D%J%JK##:+E+E+GG# ##xy}zLzLyMMabefpf@f@fBbCaD"E/105  " O-9:J=:Y-Z-a-a%00t0D&7&?&?&[C[&7&?&?&[C[.b.( -:,C,C [ ) ^^ ',0NN [ ),<.A K99K>>Lz/customer/infoz/end_user/infoz%End User ID in the request parameters) description end_user_idcvK ddlm}|'tddtjj it t|jd|iddd  d{}|td |d d ddt|S7$#t$r&}tjd|t|d}~wwxYww)ae Get information about an end-user. An `end_user` is a customer (external user) of the proxy. Parameters: - end_user_id (str, required): The unique identifier for the end-user Example curl: ``` curl -X GET 'http://localhost:4000/customer/info?end_user_id=test-litellm-user-4' -H 'Authorization: Bearer sk-1234' ``` rrkNrorprqr^Trr,r- End User Id= does not exist in db not_foundrrz]litellm.proxy.management_endpoints.customer_endpoints.end_user_info(): Exception occured - %s)rXrlrrrrrNr!r5rrervrrr)rrl user_inforys r4 end_user_infors6+<  !2!I!I!O!OP  "..? .N!O!Z!Zk*-1M"["    &{m3HI #  %Y//  +&& kmn (** +s;B9AB B!#BB9B B6!B11B66B9z/customer/updatez/end_user/updatecKddlm}m} tj |j }| t dtttf}|jD]\}}| |gidfvs|||<tt|jd|jiddid{}|td |jd d d d t j#|j%} | j&} tttf} tttf} |jD]@\}}|dk(r|| |<|t(j*vr|| |<)|t j*vs<|| |<Bt-|| | |d{| r| btt/|j1i| |jxs||jxs|dddid{} | j2| d<n9tt/|j5d| j2i| d{} t7j8d|d| vr7t7j:d| j=d| j?dd|jtA|jdkDr|j| d<t7j8dtt|j5d|ji| dddd{}|tCd|jt7j8d|tEtG|jfd{tI|StCd|j7777^775#t $r&}t7jJd|tM|d}~wwxYww)a Example curl Parameters: - user_id: str - alias: Optional[str] = None # human-friendly alias - blocked: bool = False # allow/disallow requests for this end-user - max_budget: Optional[float] = None - budget_id: Optional[str] = None # give either a budget_id or max_budget - allowed_model_region: Optional[AllowedModelRegion] = ( None # require all user requests to use models in this specific region ) - default_model: Optional[str] = ( None # if no equivalent model in allowed region - default all requests to this model ) - object_permission: Optional[LiteLLM_ObjectPermissionBase] - Customer-specific object permissions to control access to resources. Supported fields: * mcp_servers: List[str] - List of allowed MCP server IDs * mcp_access_groups: List[str] - List of MCP access group names * mcp_tool_permissions: Dict[str, List[str]] - Map of server ID to allowed tool names * vector_stores: List[str] - List of allowed vector store IDs * agents: List[str] - List of allowed agent IDs * agent_access_groups: List[str] - List of agent access group names Example: {"mcp_servers": ["server_1"], "vector_stores": ["vector_store_1"]} IF null or {} then no object-level restrictions apply. Example curl: ``` curl --location 'http://0.0.0.0:4000/customer/update' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "user_id": "test-litellm-user-4", "budget_id": "paid_tier" }' # Updating object permissions curl -L -X POST 'http://localhost:4000/customer/update' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "user_id": "user_1", "object_permission": { "mcp_servers": ["server_3"], "vector_stores": ["vector_store_2", "vector_store_3"] } }' See below for all params ``` r)rrlNNot connected to DB!r^rTrrrrrrr)rrrrlr end_usersrrnz$/customer/update: Received data = %srz9object_permission still in update_end_user_table_data: %sz,In update customer, user_id condition block.r)r,r9r-zEFailed updating customer data. User ID does not exist passed user_id=:received response from updating prisma client. response=%s&user_id is required, passed user_id = zDlitellm.proxy.proxy_server.update_end_user(): Exception occured - %s)'rXrrlr)rjsonrvrrFrGrrNr!r5r^rrrcrdrrrrr r;rr>rdebugrrrlen ValueErrorrYr`rerr)r9rrrlrrrrend_user_table_datarend_user_budget_tablebudget_table_datarbudget_table_data_recordresponserys r4update_end_userr&sHSn++;;DIIKH  23 3%)f$5$7OO% *DAq}+" )*"1%  *,88I-8X+Y+d+ddll+6Ld5S,e, &   & &t||n4IJ   ,@+N+NObOmOmOo+p!(A'U'U$(V #4#6,0f,=,?"&,,. 2DAqK01*1-)666'(!!$*77701*1- 281&?'A'     $,1=>N}>]1^1e1e+&7&?&?&[C[&7&?&?&[C[ )$/ 2f2,(;S:\:\*;72>>N}>]1^1e1e&(=(G(GH*2f2,( ""#I4P "< < ( (K*../BC  ' * *+> E << #DLL(9A(=48LL &y 1 & &'U V$01B=1Q$R$Y$Y $,,//15DQ%Z%H  #himiuiuhv!wxx & &'cem n,-A4< ,,( T +&&'mopq'**+s O AN,N4=N1N 2C N>NNAN-N.AN6N7CN N AN#N$N2O 3NNNNNN O $!OO  O z/customer/deletez/end_user/deletecKddlm} | tdtjd||j mt |j trRt|j dkDr9tt|jdd|j iid{}|Dchc]}|j}}|j Dcgc] }||vs| }}|r-td jd j|d d d tt|j!dd|j iid{}tjd|t#t%|j d{t'|dt)|j zSt+d|j 7cc}wcc}w77N#t$r&} tj,d| t/| d} ~ wwxYww)a Delete multiple end-users. Parameters: - user_ids (List[str], required): The unique `user_id`s for the users to delete Example curl: ``` curl --location 'http://0.0.0.0:4000/customer/delete' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "user_ids" :["ishaan-jaff-5"] }' See below for all params ``` rrkNrz$/customer/delete: Received data = %sr^inr,z$End User Id(s)={} do not exist in dbz, rrrZrrz)Successfully deleted customers with ids: )deleted_customersrrzDlitellm.proxy.proxy_server.delete_end_user(): Exception occured - %s)rXrlrvrrrZrrrrNr!r8r^rformatjoinrBrYr`r%rFrrpr) r9rrlexisting_usersuserexisting_user_idsr^missing_user_idsrrys r4delete_end_userrsD9'+  23 3""#I4P == $DMM4)HSQUQ^Q^M_bcMc*67H7W*X*b*b 4"78+c+%NBP'P 'P 'P>Bmm&p7w^oOow&p &p$BII$))TdJef$$ %11B=1Q$R$^$^ 4"78%_%H ! & &'cem n,-A$---PQ Q Q*"*Cc$--FXX  Edmm_UV V7%(Q&p R +""#iklm'**+s~HBG#F?$G,G?G GGA&GG ;G?G&G&H'G GG G?!G::G??Hz/customer/listz/end_user/list http_requestcK ddlm}|jtjk7r9|jtj k7rt ddd|ji|'t ddtjjitt|jd d d  d{}|Dcgc] }t|c}S7cc}w#t$r&}tj d |t#|d}~wwxYww) z [Admin-only] List all available customers Example curl: ``` curl --location --request GET 'http://0.0.0.0:4000/customer/list' --header 'Authorization: Bearer sk-1234' ``` rrkrp$Admin-only endpoint. Your user role=rqNr}Tr)r-z]litellm.proxy.management_endpoints.customer_endpoints.list_end_user(): Exception occured - %s)rXrl user_roleLitellmUserRoles PROXY_ADMINPROXY_ADMIN_VIEW_ONLYrrrrrNr!r8rervrrr)rrrlritemrys r4 list_end_userr+s4+<  ' '+;+G+G G!++/?/U/UU#GHYHcHcGd!ef   !2!I!I!O!OP  !-->}-M N X X-1M!Y!  9AA%d+AA  B +&& kmn (** +sMD B/C3C4C<CCD CC D!!DDD z/customer/daily/activityz/end_user/daily/activity end_user_ids start_dateend_datemodelapi_keypage page_sizeexclude_end_user_idsc K|jtjk7r9|jtjk7rt ddd|jiddlm} | 't ddtjji|r|jd nd} d} |r|r|jd nd} tttf} | rd t| i| d <tt!| j#| d{} t%| d d| | Dcic]}|j&d|j(ic}| |||||| d{S7Hcc}w7 w)zX Get daily activity for specific organizations or all accessible organizations. rrprrqrrkNro,rr^rlitellm_dailyenduserspendralias) rl table_nameentity_id_field entity_identity_metadata_fieldexclude_entity_idsrrrrrr)rrrrrrXrlrrrsplitrrFrGrrNr!r8rr^r)rrrrrrrrrrlend_user_ids_listexclude_end_user_ids_listwhere_conditionend_user_aliasesrys r4get_customer_daily_activityrdsv6 ##'7'C'CC  ' '+;+Q+Q QCDUD_D_C`ab  9.EEKKL  ;G|11#6D26G[$8$>$>s$Cae!"#v+.0O&*D1B,C%D "$01B=1Q$R$\$\cr$\$ss$#.%#FVWqyy7AGG*<<W4    tX s0DEEE E8E E EE)[__doc__collections.abcrrrrtypingrrr r r fastapir r rrpydanticrr prisma.modelsrPrismaBudgetRowrPrismaEndUserRowlitellm.proxy.utilsrrlitellm._loggingr*litellm.litellm_core_utils.duration_parserrlitellm.proxy._types$litellm.proxy.auth.user_api_key_authr-litellm.proxy.common_utils.user_api_key_cacherr8litellm.proxy.management_endpoints.common_daily_activityr/litellm.proxy.management_endpoints.common_utilsr8litellm.proxy.management_helpers.object_permission_utilsrrr&litellm.repositories.budget_repositoryr 'litellm.repositories.table_repositoriesr!>litellm.types.proxy.management_endpoints.common_daily_activityr";litellm.types.proxy.management_endpoints.customer_endpointsr#r$r%r&r'__annotations__rrFrGr)r+rNrRrYtupler`repost BlockUsersrzrNewCustomerRequestrrrUserAPIKeyAuthrrQueryrUpdateCustomerRequestrDeleteCustomerRequestrrrrIrr1rJr4r2s .(DD>>+DF01J"BXT:CE*5%5%d3;&78%8 MHX& MF O(O-JO O M'M,HM M(+;;  \# \4 \n8C=nU38_n @)@0@@  +,-     +,-%   )G:)G  )GX  +,-     +,-'   ,8Z,8  ,8^/4Dt4K4VS&[)V3d:V!%S&[ 1V" V  V<  +,-     +,-#  )00A(Bk+ k+%k+k+  k+\  +,-#     +,-  %w}}1XY++++++  ++\  +,-#     +,-  )00A(Bh+ h+%h+h+  h+V  +,-*     +,-  )00A(B?+ ?+%?+?+  ?+D  +,-()     +,-  )00A(B*+*+%*+ *+  *+Z  +,-2     +,-   $!'+(/0A(B9*9d 9Dj9 : 9 4Z 9  99*9&9  9rJ