tPj/T"UdZddlZddlZddlZddlZddlmZmZddlmZ ddl m Z m Z ddl m Z ddlmZmZmZmZmZmZmZmZddlZddlmZmZmZmZmZmZdd lmZm Z dd l!m"Z"m#Z#ddl$Z$dd l%m&Z&dd l'm(Z(dd l)m*Z*ddl+m,Z,ddl-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZKmLZLmMZMmNZNmOZOmPZPmQZQmRZRmSZSmTZTmUZUmVZVddlWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZambZbddlcmdZdmeZeddlfmgZgddlhmiZiddljmkZkddllmmZmddlnmoZoddlpmqZqmrZrmsZsmtZtmuZumvZvmwZwmxZxmyZyddlzm{Z{ddl|m}Z}ddl~mZmZmZmZmZddlmZmZmZddlmZddlmZmZddlmZmZmZddlmZmZmZdd lmZdd!lmZdd"lmZdd#lmZmZmZmZmZdd$lmZdd%lmZdd&lmZdd'lmZdd(lmZdd)lmZmZmZmZmZmZmZmZmZmZmZmZer dd*lmZdd+lmZeZeed,<ed-ZGd.d/e#ZGd0d1e#Zd2ed3efd4Zd5eed3eefd6ZGd7d8eZd9ed3d:fd;ZGd<d=eZGd>d?eZGd@dAeeeZGdBdCeZGdDdEeZGdFdGeeZGdHdIeZGdJdKeeeeeeZd9ed3dLfdMZGdNdOeZGdPdQeZѐdwdRZGdSdTe#dUVZGdWdXe#dUVZGdYdZe#dUVZGd[d\e#ZGd]d^e#ZGd_d`eeZGdadbeZGdcddeeZdeZeedf<e dgdhiZeedi<djedzd3dkfdlZݐdxdnZdjedzd3dofdpZdjedzd3dqfdrZdjedzd3dsfdtZdjedzd3dufdvZdjedzd3dwfdxZdjedzd3dyfdzZdjedzd3d{fd|Zdjedzd3d}fd~Zdjedzd3dfdZd2ed3efdZdedemded3dfdZde;deVd3dfdZGddZded3efdZdedeVd3efdZ dydjedeededzd3ee:fdZdee;deAeUzdedzdedzdeeefdeeefded3dfdZdee;deAeUzdedzdedzded3df dZdee;de8deAeUzd3dfdZdee;de8deAeUzd3dfdZde8deAeUzdjed3dfdZdeAeUzdeVdjedemd3df dZdeUdeVdedzd3dfdZdeVdeeefd3efdZejddgeegge;eeegeddfdeAdedeVdedzfdZdededededzdeVded3dfdZdeUdedzdjedeVded3edzf dZde;de9djed3dfdZ dydedededzdjedeVdzd3df dZ dzde;de9deded3ef dZejddgeeggeeegeddfdeUdedeVdedzfdZej ddgeegge; dydedeCdedeeVeegfdeedzedff dZdeUded3dfdZdeded3efd„Zde@ee@zdefdńZdjedzdeOdefdƄZ deOde;fdDŽZ deVde;deOd3dfdɄZ dydeOde;djedeVdedmedzd3e ee=ee:ffdʄZ de@dee=d3e@fd̄Zde@de;d3efd̈́ZdeOde;dee=d3dfd΄ZdeOde;djedeVded3e dee=ee:ff dЄZde;d3dfdфZdee@djed3eefdӄZdee@dԐeedՐeed3eefdքZdאZeed<dee@dՐeedeVd3dfdلZdee@d3efdڄZdedee=dՐeedee@dee@deVded3dfd݄Zde@djed3e@fdބZejddgeeggeKeeegfdeOdeVfdZde@dePd3efdZde;dePd3e e e@dfee@ffdZejddgeeggeeegfdePdeVfdZddddddZeed<deQd3eeeffdZ ejddgeeggeReeegfdeQdedeVfdZ!dedeVd3dfdZ"deded3efdZ#dede:d3efdZ$ejddgeegfedededeFdeeVeegffdZ%dee@deKd3eefdZ&ejddgeeggeeeegfdedeVfdZ'ejddgeeggeeegeddfde2dedeVdedzfdZ(deedjed3dfdZ)deedmed3dfdZ*dddemded3dfdZ+dee;demded3dfdZ, dydee;deVdedzd3eeeeffdZ-deeeefdjed3dfdZ. dydee;djedeVdedzd3df dZ/deVd e;fd Z0d edjed eMd3eMfd Z1djedee@d3e e@dffdZ2deMd3eMfdZ3ejiddgeeggeejjddejjdddeegfdedededzdeVfdZ6ejiddgeeggeeeegfdededeVfdZ7ejddgeeggeeegfde/dedeVfdZ8ejddgeeggeeegfde/dedeVfdZ9ejiddgeegfedZ:ejid eegee;fdedeVfd!Z;dedjedemded3eedzf d"Z< d{djededzd$edzdedzdedzd%ed&edzd'ed(eedzdemdzdedzd3eeefdzfd)Z=d*eed3d+fd,Z> dyded%ed-eeefdzd3eee;ze4zfd.Z?djedeed3eeeffd/Z@deVdedzdedzdjedemded3e edzeedzffd0ZAejid1dgeeegg2eejjdd3ejjdd4ejjdd5ejjdd6ejjdd7d#ejjd8d9d8:ejjdאd;d8d<=ejjdd>ejjd?d@ejjddAeegf dededzdedzdedzd$edzd&edzd'eeejjdBfdCedDedEedzdFedGedzdeVfdHZBdeVdedzdjedemded3ef dIZCejidJdgeeggeejjdd3deegfdededzdedzdeVfdKZD d|djedDedCed3e ee;effdLZEejidMdgeeggdUdNdOee;iiPejjddejjddQejjd8d9d8:ejjdRdSd8d<=eegfdedzd$edzdCedDedeVf dTZFde;dUeed3eefdVZGejdWdgeeggeeegfdeSdedeVfdXZHejdYdgeeggeeegfdeTdedeVfdZZIejid[dgeeggeejjddeegfdedeVd3efd\ZJejd]dgeeggeegfdededeVd3e;fd^ZKejd_dgeeggeeeegfdedeVfd`ZLddadbeMd3efdcZNdjedeedbeMd3efddZOdjedbeMd3efdeZPdeded3efdfZQGdgdheZRdedzdiedzdjedzdeVdjedemded3eRfdkZSejidledgm d}deeVeegfdedzdnedzdoedzdOedzdjedzdCedDediedzfdpZTdqZUeedr<dnedzdoedzd3edzfdsZVejidtedgm d~deeVeegfdedzdnedzdoedzdOedzdjedzdiedzduedzfdvZWy(za TEAM MANAGEMENT All /team management endpoints /team/new /team/info /team/update /team/delete N)MappingSequence)Set)datetimetimezone)MappingProxyType) TYPE_CHECKING AnnotatedFinal NamedTupleNoReturnProtocolTypeVarcast) APIRouterDependsHeader HTTPExceptionRequeststatus) BaseModel JsonValue)ReadOnly TypedDict)verbose_proxy_logger)uuid)PrometheusLogger) safe_dumps)) UI_TEAM_IDBlockTeamRequestBudgetNewRequestCommonProxyErrorsDeleteTeamRequestLiteLLM_AuditLogsLiteLLM_DeletedTeamTable)LiteLLM_ManagementEndpoint_MetadataFields1LiteLLM_ManagementEndpoint_MetadataFields_PremiumLiteLLM_ModelTableLiteLLM_OrganizationTable$LiteLLM_OrganizationTableWithMembersLiteLLM_TeamMembershipLiteLLM_TeamTableLiteLLM_TeamTableCachedObjLiteLLM_UserTableLitellmTableNamesLitellmUserRolesMemberNewTeamRequest OrgMemberPatchTeamRequestProxyErrorTypesProxyExceptionResetSpendRequestSpecialManagementEndpointEnumsSpecialModelNamesSpecialProxyStringsTeamAccessGroupModelGrantTeamAddMemberResponseTeamInfoResponseObjectTeamInfoResponseObjectTeamTableTeamListResponseObjectTeamMemberAddRequestTeamMemberDeleteRequestTeamMemberUpdateRequestTeamMemberUpdateResponseTeamModelAddRequestTeamModelDeleteRequestUpdateTeamRequestUserAPIKeyAuth) OrganizationNotFoundError_cache_team_object allowed_route_check_inside_routecan_org_access_modeldelete_cache_key_objectsdelete_cache_team_objectget_org_objectget_team_membershipget_team_objectget_user_object"invalidate_team_member_spend_state)0enforce_batch_enqueued_token_limit_is_admin_only-enforce_output_token_estimates_are_admin_only)user_api_key_auth)encrypt_callback_vars)apply_json_merge_patch)UserApiKeyCache)get_daily_activity_aggregated) +_check_passthrough_routes_caller_permission_is_user_org_admin_for_team_is_user_team_admin_set_object_metadata_field_team_member_has_permission_update_metadata_fields_upsert_budget_and_membership_user_has_admin_viewvalidate_budget_duration)add_member_to_organization)get_daily_activity)TEAM_ADVISORY_LOCK_SQLAccessGroupSyncTxinvalidate_access_group_caches&reconcile_team_access_group_membership!sync_team_access_group_membership)_set_object_permission1enforce_all_proxy_mcp_servers_grant_is_admin_only&handle_update_object_permission_common)TeamMemberPermissionChecks)TEAM_METADATA_SCHEMA_REGISTRY$validate_team_metadata_if_configured) MemberWriteTxadd_new_membermanagement_endpoint_wrapper) PrismaClient ProxyLogginghandle_exception_on_proxy)BudgetRepository)OrganizationRepository) TableActions)AccessGroupRepositoryDeletedTeamRepositoryModelTableRepository OrganizationMembershipRepositoryTeamMembershipRepository)TeamRepository)UserRepository)VerificationTokenRepository)Router)SpendAnalyticsPaginatedResponse) BulkTeamMemberAddRequestBulkTeamMemberAddResponse&BulkUpdateTeamMemberPermissionsRequest'BulkUpdateTeamMemberPermissionsResponse GetTeamMemberPermissionsResponseTeamIdSearchMatch TeamListItemTeamListResponseTeamMemberAddResultTeamMemberInfoResponseTeamMetadataSchemaResponse"UpdateTeamMemberPermissionsRequest)Prisma)modelsrouter _DbRecordTceZdZUeed<y)_TeamIdKeyCountteam_idN)__name__ __module__ __qualname__int__annotations__v/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/management_endpoints/team_endpoints.pyrrs Lrrc"eZdZUeed<eed<y)_TeamIdGroupRowr_countN)rrrstrrrrrrrrs L rrvaluereturnc|SNr)rs r _as_objectrs Lrrowsctd|S)Nzlist[_DbRecordT])r)rs r_as_listrs D rc(eZdZededzfdZy) _UserIdRowrNcyrrselfs ruser_idz_UserIdRow.user_ids%(r)rrrpropertyrrrrrrrs (t((rrrepozTableActions[_UserIdRow]c|jSr)tablers r_user_id_rows_dbrs ::rc"eZdZdeeeffdZy) _ModelDumpRowrcyrrrs r model_dumpz_ModelDumpRow.model_dumprN)rrrrrobjectrrrrrrs5GCK05rrc"eZdZedefdZy) _TeamIdRowrcyrrrs rrz_TeamIdRow.team_ids!rN)rrrrrrrrrrrs !!!rrc eZdZy)_CacheableTeamRowN)rrrrrrrrsrrc(eZdZededzfdZy)_ObjectPermissionRowrNcyrrrs robject_permission_idz)_ObjectPermissionRow.object_permission_ids25r)rrrrrrrrrrrs 5cDj55rrcDeZdZededzfdZededzfdZy)_TeamAliasBudgetRowrNcyrrrs r team_aliasz_TeamAliasBudgetRow.team_aliass(+rcyrrrs rbudget_durationz#_TeamAliasBudgetRow.budget_duration-0r)rrrrrrrrrrrrs0 +C$J++ 0t00rrc(eZdZUeeefdzed<y)_TeamBudgetRowNmetadata)rrrrrrrrrrrrsc9n%,,rrc"eZdZdddedefdZy)_AuditableTeamRowF exclude_nonerrcyrr)rrs rjsonz_AuditableTeamRow.jsonrrN)rrrboolrrrrrrrs+0=D=S=rrceZdZedeeeefdzfdZededzfdZ ede dzfdZ ede dzfdZ ede dzfdZy) _RawTeamRowrNcyrrrs rmembers_with_rolesz_RawTeamRow.members_with_roless.1rcyrrrs rorganization_idz_RawTeamRow.organization_idrrcyrrrs r max_budgetz_RawTeamRow.max_budgets*-rcyrrrs r soft_budgetz_RawTeamRow.soft_budgets+.rcyrrrs rmodel_idz_RawTeamRow.model_ids&)r)rrrrrdictrrrrfloatrrrrrrrrrs 1 $sF{# $t +110t00 -EDL-- .UT\.. )#*))rrTableActions[_RawTeamRow]c.td|jS)Nr)rrrs r _raw_team_dbrs #TZZ rc"eZdZedefdZy) _BudgetIdRowrcyrrrs r budget_idz_BudgetIdRow.budget_ids #rN)rrrrrrrrrrrs #3##rrc eZdZdededefdZy)_BudgetWriteCall budget_objuser_api_key_dictrc Kywrr)rrrs r__call__z_BudgetWriteCall.__call__N)rrrr!rGrrrrrrrsr)9rnramrrrc|Srr)fns r_as_budget_writers IrcJeZdZUeed<eed<eeefed<eeefed<y)_TeamFindManyArgstakeskipordercursorN)rrrrrrrrrrrrrs* I I 38  CK  rrF)totalc6eZdZUeeefed<eeefed<y)_TeamUiViewFiltersrrN)rrrrrrrrrrr"s S#X S!!rrc(eZdZUeeeefed<y)_TeamIdInFilterrN)rrrrrrrrrrrr's S(3-' ((rrc$eZdZUeeeed<y)_DeletedTeamsResult deleted_teamsN)rrrrrrrrrrrr+sHSM**rrceZdZUeeed<y) _ErrorDetailerrorN)rrrrrrrrrrr/s C=rrceZdZeddZy) _TeamCreateTxcyrrrs rlitellm_teamtablez_TeamCreateTx.litellm_teamtable4TWrNr-TableActions[prisma_models.LiteLLM_TeamTable])rrrrr rrrrr3s WWrrc4eZdZdZeddZeddZy)_MemberDeleteTxaThe tables `/team/member_delete` reads while it holds the team's advisory lock. Reading them off the transaction keeps the whole endpoint on the one pooled connection it already checked out: a request that has the lock but still needs another connection can be starved by the lock waiters, which is a deadlock rather than a wait when enough of them hold the rest of the pool.cyrrrs rlitellm_usertablez!_MemberDeleteTx.litellm_usertable@r rcyrrrs rlitellm_verificationtokenz)_MemberDeleteTx.litellm_verificationtokenCsdgrN)r-TableActions[prisma_models.LiteLLM_UserTable])r5TableActions[prisma_models.LiteLLM_VerificationToken])rrr__doc__rrrrrrrr8s%*WW ggrrcDeZdZdededefdZeddZed dZ y) _TeamDeleteTxqueryargsrc Kywrr)rrrs r execute_rawz_TeamDeleteTx.execute_rawHrrcyrrrs rr z_TeamDeleteTx.litellm_teamtableJr rcyrrrs rlitellm_teammembershipz$_TeamDeleteTx.litellm_teammembershipMs^arNr )r2TableActions[prisma_models.LiteLLM_TeamMembership]) rrrrrrrrr rrrrrrGs0FsF6FcF WW aarrzV UPDATE "LiteLLM_UserTable" SET teams = array_remove(teams, $1) WHERE $1 = ANY(teams) "_STRIP_DELETED_TEAM_FROM_USERS_SQLlitellm_model_tableT_INCLUDE_MODEL_TABLE prisma_clientr c,t|jSr)r~rr$s r_team_dbr'X - ( . ..rtxc.td|jS)Nr )rr )r)s r _team_tx_dbr+\s 79M9M rr c,t|jSr)r}rr&s r_team_membership_dbr-bs #M 2 8 88rrc,t|jSr)rrr&s r_user_dbr/fr(rz.TableActions[prisma_models.LiteLLM_ModelTable]c,t|jSr)r{rr&s r _model_dbr1js  . 4 44rz5TableActions[prisma_models.LiteLLM_OrganizationTable]c,t|jSr)rwrr&s r_org_dbr3ns !- 0 6 66rz:TableActions[prisma_models.LiteLLM_OrganizationMembership]c,t|jSr)r|rr&s r_org_membership_dbr5rs ,M : @ @@rz/TableActions[prisma_models.LiteLLM_BudgetTable]c,t|jSr)rvrr&s r _budget_dbr7xs M * 0 00rz4TableActions[prisma_models.LiteLLM_DeletedTeamTable]c,t|jSr)rzrr&s r_deleted_team_dbr9|  / 5 55rz4TableActions[prisma_models.LiteLLM_AccessGroupTable]c,t|jSr)ryrr&s r_access_group_dbr<r:rrc,t|jSr)rrr&s r _tokens_dbr>s &} 5 ; ;;rc t|}|jddjddS#t$rt|}Y8wxYw)zAStrip CR/LF from user-controlled values to prevent log injection.  )r Exceptionreprreplace)rtexts r_sanitize_for_logrGsJ5z <<b ! ) )$ 33 E{s /AAteam_rowuser_api_key_cacheproxy_logging_objcKt|jtj|j ||d{y7w)a Refresh the in-memory cached team object after a DB write. Every endpoint that mutates `litellm_teamtable` must call this so the cached `LiteLLM_TeamTableCachedObj` used by `common_checks` stays in sync. Without this, subsequent auth checks read a stale team and can 403 on permissions the DB has already granted (or, symmetrically, keep granting permissions the DB has already revoked). `team_row` is the Prisma row returned by `update`/`find_unique` on `litellm_teamtable`. It is converted to `LiteLLM_TeamTableCachedObj` via `model_dump()` to match the cache shape `_cache_team_object` expects. )r team_tablerIrJN)rIrr-model_validaterrHrIrJs r_refresh_cached_teamrOs@&   -<AAAteam_objrcK|jtjk(ryt||ryt ||d{ryt t jd7 w)a Verify the caller is authorized to manage the given team. Access is granted if: - Caller is a proxy admin, OR - Caller is an org admin for the team's organization, OR - Caller is a team admin of this team Raises HTTPException(403) otherwise. NrrPz#You do not have access to this team status_codedetail) user_roler0 PROXY_ADMINr\r[rrHTTP_403_FORBIDDENrPrs r_verify_team_accessrZsb""&6&B&BB->R (;LW_ ``` --4 as=A"A !A"ceZdZdZdZededzddfdZe ddedzde dzd e dzd e dzde f d Z edddde fd eezd edededzde dzd e dzd e dzdee defdZedddde fdededededzde dzd e dzd e dzdee defdZededdfdZededddededef dZede deeee efzde deddf dZy)TeamMemberBudgetHandlerzHHelper class to handle team member budget, RPM, and TPM limit operations)team_member_budget_idrNrctt|tsytjD]}|j |dy)z>Remove server-owned metadata keys from a caller-supplied dict.N) isinstancerr\SYSTEM_MANAGED_METADATA_KEYSpop)rkeys r"strip_system_managed_metadata_keysz:TeamMemberBudgetHandler.strip_system_managed_metadata_keyss4(D) *GG $C LLd # $rteam_member_budgetteam_member_rpm_limitteam_member_tpm_limitteam_member_budget_durationc0t|du|du|du|dugS)z,Check if any team member limits are providedN)anyrdrerfrgs rshould_create_budgetz,TeamMemberBudgetHandler.should_create_budgets6"$.%T1%T1+47    rdatanew_team_data_jsonrexplicitly_set_fieldsc6Kddlm}ddlm} |j?d|jj dddt jj} n!d t jj} || d |vr|n|jxs| } ||| _ ||| _ ||| _ ||| _ t| | | d{} |jd i|d <| j|d d<t j#||S7Cw)zCreate team member budget table with provided limits. The team's own reset period is only inherited when the caller left the member duration out, so an explicit null means "never resets". rr!) new_budgetNzteam- -z-budget-z team-budget-rg)rrrrrr])litellm.proxy._typesr!>litellm.proxy.management_endpoints.budget_management_endpointsrqrrEruuid4hexrr rpm_limit tpm_limitrgetrr\_clean_team_member_fields) rlrmrrdrerfrgrnr!rqrbudget_requestteam_member_budget_tables rcreate_team_member_budget_tablez7TeamMemberBudgetHandler.create_team_member_budget_tables= :  ?? & 7 7S AB(4::? 99:LM!!+ sCDDADrL updated_kvc |Kddlm}ddlm} |ji|_|jj d} | t | tr|| } |d|vr|| _|d|vr|| _ |d |vr|| _ |d |vr|| _ |d| _ t| | | d{} tjd | j ||||j d i|d <| j |d d<n%t"j%||||||||d{}t"j'||S77w)zUpsert team member budget table with provided limits. A field the caller explicitly sent as null is written as null, so a team can keep a member budget while dropping its reset period. rrp update_budgetNr]rrdrerfrgrtztUpdated team member budget table: %s, with team_member_budget=%s, team_member_rpm_limit=%s, team_member_tpm_limit=%srrlrmrrdrerfrgrn)rur!rvrrr{r_rrryrzrbudget_reset_atrrinforr\rr|) rLrrrdrerfrgrnr!rr]r} budget_rows rupsert_team_member_budget_tablez7TeamMemberBudgetHandler.upsert_team_member_budget_table%s :     &"$J '1':':'>'>?V'W ,)$04KOd4d+@($04KOd4d+@(*6:W[p:p1L..659N2&E&6}&E)"3'!J ! % %G$$"%%  ~~j)1)+ :&>H>R>RJz "#: ; 7VV#-"3#5&;&;,G&; W  J 99*E;! s%B)D<+D8,A0D<D:D<:D< data_dictc|jdd|jdd|jdd|jddy)z.Remove team member fields from data dictionaryrdNrgrerf)ra)rs rr|z1TeamMemberBudgetHandler._clean_team_member_fieldsls@  *D1 3T: -t4 -t4rrGcpKddlm}ddlm}|ji|_|jj d}|^t |trN||}d|vrd|_d|vrd|_ d|_ d |vrd|_ d |vrd|_ ||| d{tj||S7w) z=Clear explicitly-nulled fields on the team member budget row.rrprNr]rrdrgrerfrt)rur!rvrrr{r_rrrrryrzr\r|)rLrrrnr!rr]r}s rclear_team_member_budget_fieldsz7TeamMemberBudgetHandler.clear_team_member_budget_fieldsts :     &"$J '1':':'>'>?V'W , $TD[$T$$+/,0,026  !DL "Tz  #Tz &)4Z      ,0,0,0262;+9"229" 9"*9""DL 9" #Tz 9" #Tz 9"&)4Z9" +3/9" 9"9"v ,0,0,0262;+D"D)DD"DL D #Tz D #Tz D&)4ZD +3/D DDL5T5d55!"!+!! # !  !!F@@$Vd3;.?%?@@ #@$ @  @@rr\fieldc tj}|yt|tr|j |}n t ||d}|yt|t r(|Dcgc]}t|dr |jn|c}S|Scc}w)z Returns a default value for the given field from litellm.default_team_params config. Returns None if no default is configured. For list fields containing enums (e.g. team_member_permissions), converts enum values to strings. Nr) litellmdefault_team_paramsr_rr{getattrlisthasattrr)rdefault_paramsrvs r_get_default_team_paramrs$77N.$'""5)t4 }%?DE!71g.A5EE LFs!Brcttjydtjvr|tjdvSy)NFavailable_teams)rdefault_internal_user_paramsrrs r_is_available_teamrs9++3G@@@'>>?PQQQ rteam_idsrcKdd|ii}|d|gi|d<t|j|ddid{}g}|D]4}|jtj|j 6|S7Aw)z)Get all team memberships for a given userrinNrlitellm_budget_tableTrinclude)r-rrr+rMr)r$rr where_objteam_memberships returned_tmtms rget_all_team_membershipsrs :CT8DT8UI $wi0 ) %8 $F$P$P'.%Q% 8:KS1@@QRS s2A8A6AA8teamsrlentity_rpm_limitentity_tpm_limitentity_model_rpm_limit_dictentity_model_tpm_limit_dict entity_typec t|ddxs*|jr|jjddnd}t|ddxs*|jr|jjddnd}||yi} i} |D]} | jrf| jjddJ| jjdijD]\} } | j| d| z| | <| js| jjdd| jjdijD]\} }| j| d|z| | <||jD]\} } |A| j| d| z|kDr)t dd| j| dd| d|d | |sL|j| }|s`| j| d| z|kDsyt dd| j| dd| d|d | ||jD]\} }|A| j| d|z|kDr)t dd | j| dd |d|d | |sL|j| }|s`| j| d|z|kDsyt dd | j| dd |d|d | yy)z Generic function to check if a team is allocating model specific limits. Raises an error if we're overallocating. model_rpm_limitNmodel_tpm_limitrAllocated RPM limit= + Team RPM limit= is greater than RPM limit=rSAllocated TPM limit= + Team TPM limit= TPM limit=)rrr{itemsr)rrlrrrrrrrmodel_specific_rpm_limitmodel_specific_tpm_limitteammodelryrzentity_model_specific_rpm_limitentity_model_specific_tpm_limits r!_check_team_model_specific_limitsrs%T+JMll'$'!56N6R6RSXZ[6\5]]opyoz{LMXLYYdeDdE F "" / 5 5 7  E9+0H0L0LUTU0VYb0beu0u# #12J2N2NuVW2X1YYklukvwHITHUU`aq`rs-2M2Q2QRW2X/3044UA>JMll'$'!56N6R6RSXZ[6\5]]opyoz{LMXLYYdeDdE F #rc |3t|dkDr%td|D}td|D}nd}d}|j7|5|j|z|kDr#tdd|d|jd|d | |j9|6|j|z|kDr#tdd |d |jd|d | yyy)zx Generic function to check if a team is allocating rpm/tpm limits. Raises an error if we're overallocating. Nrc3NK|]}|j|jywr)rz.0rs r z-_check_team_rpm_tpm_limits..f@ZDNN[%%c3NK|]}|j|jywr)ryrs rrz-_check_team_rpm_tpm_limits..grrrrrrrrSrrr)rsumrzrry)rrlrrr allocated_tpm allocated_rpms r_check_team_rpm_tpm_limitsrZs# SZ!^[[ [[    "  ( NN] *-= =)-8J4>>JZZklwkxyDEUDVW  "  ( NN] *-= =)-8J4>>JZZklwkxyDEUDVW   > ) #r org_tablec 0d}d}i}i}|j,|jj}|jj}|jr8|jj di}|jj di}t ||||||dy)z| Check if the organization team is allocating model specific limits. If so, raise an error if we're overallocating. Nrr organization)rrlrrrrr)rryrzrr{r)rrrlrrrrs r$check_org_team_model_specific_limitsrs"$"$%%1$99CC$99CC&/&8&8&<&<=NPR&S#&/&8&8&<&<=NPR&S#% ))$?$?"rcd}d}|j,|jj}|jj}t||||dy)zu Check if the organization team is allocating rpm/tpm limits. If so, raise an error if we're overallocating. Nr)rrlrrr)rryrzr)rrrlrrs rcheck_org_team_rpm_tpm_limitsrsW%%1$99CC$99CC ))" rc K|j|jy|jjc|j|jjkDr@tddd|jd|jjd|ji|jt |jdkDrrt jj|jvrnK|jD]<}||jvstddd |d |jd |ji|j|jy|jjc|j|jjkDr@tddd |jd |jjd|ji|j|jy|jjc|j|jjkDr@tddd|jd|jjd|jit|ddxs*|jr|jjddnd}t|ddxs*|jr|jjddnd}|dk7r|dk7ryt|jd|jid{}g}|D]4}|j!t#j$|j'6t)|||t+|||y7\w)z Check organization team limits including: - Team budget vs organization's max_budget - Team models vs organization's allowed models - Guaranteed throughput limits (tpm/rpm) if applicable NrrzTeam max_budget (z%) exceeds organization's max_budget (z). Organization: rSrzModel 'zD' not in organization's allowed models. Organization allowed models=z. Organization: zTeam tpm_limit (z$) exceeds organization's tpm_limit (zTeam rpm_limit (z$) exceeds organization's rpm_limit (rpm_limit_typetpm_limit_typeguaranteed_throughputrr)rrrl)rrrrrrr9all_proxy_modelsrrzryrrr{r'rrr,rMrrr) rrlr$rrrr team_objsrs r_check_org_team_limitsrs #  * * 6  * * 5 5 A OOi<<GG G,T__,==bcldBdBdMdMcNN_`i`y`y_z{   {{3y'7'7#81#<  - - 3 3y7G7G G [[ I,,,'$'#wqc1uvwGwGvHHXYbYrYrXs&t   "  * * 6  * * 4 4 @ NNY;;EE E+DNN+;;_`i`~`~aIaI`JJ[\e\u\u[vw   "  * * 6  * * 4 4 @ NNY;;EE E+DNN+;;_`i`~`~aIaI`JJ[\e\u\u[vw  $D*:DA59]] *D1$D*:DA59]] *D100^G^5^ "-0:: )";";<;E 13IN*99$//:KLMN)  " sC:M=G6M3M4AMc hK|j}|jqt|j||dd{}|N|jB|j|jkDr)tddd|jd|ji|j `t |j d kDrH|j D]9}||j vstddd |j d |ji|jN|jB|j|jkDr)tddd |jd|ji|jP|jC|j|jkDr)tddd |jd|jiyyy7xw)u3 Enforce the caller's personal limits when CREATING a standalone team. This validates the requested team budget / models / tpm / rpm against the caller's own limits, so a non-admin user cannot mint a brand-new team that is richer than themselves. Only used by /team/new for standalone teams (organization_id is None). /team/update does NOT call this — an existing team's admin is already authorized via _verify_team_access() and is not gated by their personal wallet. Org-scoped teams use _check_org_team_limits() instead. NFrr$rIuser_id_upsertrrz1max budget higher than user max. User max budget=z . User role=rSrz6Model not in allowed user models. User allowed models=z . User id=z/tpm limit higher than user max. User tpm limit=z/rpm limit higher than user max. User rpm limit=) rrrQrrVrrrzry)rlrr$rIuser_objrs r_check_user_team_limitsr"s@& "'8'@'@'L /%--'1 !    H$7$7$CZbZmZmHmPQYQdQdPeeqsDsNsNrOP  {{3'8'?'?#@1#D A)000# ##YZkZrZrYss}PXX~Y"Z  "  ' ' 3 NN.88 8JK\KfKfJggsuFuPuPtQR   "  ' ' 3 NN.88 8JK\KfKfJggsuFuPuPtQR   9 4 #Q s5F2F/BF2C"F2existing_team_max_budgetc 6|jtjk(ry|ydt|ddxs t v}|r|j t ddd|di|j 0|j |kDr t ddd |d |j diyy) a Restrict who can grow a standalone team's spend ceiling on /team/update. A team admin (already authorized via _verify_team_access) may keep or lower the team budget, but only a proxy admin may grow it - by raising max_budget above the team's current value or by removing the cap (setting it to None). Setting a finite budget on a team that has no cap is a restriction and is allowed. Org-scoped teams are governed by _check_org_team_limits(). Nrmodel_fields_setrzMOnly a proxy admin can remove a team's max_budget. Team's current max_budget=.rSzLOnly a proxy admin can raise a team's max_budget. Team's current max_budget=z , requested=)rVr0rWrrrr)rlrrbudget_explicitly_sets r#_check_team_budget_update_authorityrjs""&6&B&BB'#/GDBTVZ4[4d_b_d#e!8hjBiCCDE   "t9Q'QgiAhBBNOSO^O^N__`a  (R"rgeneral_settingsc~|jy|jtjk7ry|j dduS)NFT%disable_auto_add_proxy_admin_to_teams)rrVr0rWr{)rrs r_should_auto_add_team_creatorrsC  (""&6&B&BB    G HPT TTrz /team/newzteam management)tags dependenciesresponse_modelzThe litellm-changed-by header enables tracking of actions performed by authorized users on behalf of other users, providing an audit trail for accountability) description http_requestlitellm_changed_bycK ddlm}m}ddlm}m}m}m} m} m } | tdddi|jJtj|jr|jdkrtd dd |ji|jJtj|jr|jdkrtd dd |ji|jJtj|jr|jdkrtd dd |jit!|j"t!|j$|jO|jC|j|jk\r*td dd |jd|jdit'|ddt)|ddt+| j-d{} | r|j/| r tdd|j0#t3t5j6|_no|j0t8k(rtd ddt8di| j;|j0ddd{} | td dd|j0di|j<"t?d}tA|t2r||_dD]?}tC||d|dk7s||jDvs%t?|}|3tG|||A|jtAtHjJtLrhtOtHjJdkDrLtAtHjJdtPr+tHjJdjSd}|||_ |j<V| T tU|j<| | d d{}|td d!|j<tY||| "d{jZjZt\j^k7r#|j<ta|| | #d{tc|rPtefd$|jfD}|s0|jfjitkd%jl&to|d'tA|jptPrtrju|jptwd(|jpd|j0|jx)d{d}|jztA|jztPrt}tj|jzjlxs| jlxs| *}t| ji|jd+d{}|j}|j}t|j|jjnddjZt\j^k(| ,d{t|| -d{}trj|j|j|j|j$.rWtrj|||j|j|j|j$|jD/d{}td@i|d0|i}tD](}tC||dt||tC||1*tD](}tC||dt||tC||1*|j"dd2lPmQ}||j"3|_R|jrpdd2lPmQ}g}|jD]R}tA|tPr|n|j}||d3j|d4<|ji|T||_Sg}|jf|jf}g|_3|jd+}tC|d5d}| t|n ti} | |d5<|jSd6t|d6|d6<| j|7}|}!| jj4d{}"|"jj|!t8d{}#t|"|#j0d{}$dddd{t$d{t|j0|9}%t|%#| | :d{|r|jd+}&tj|&t2;}&tj|tt3t5j6tjtj||| <jtj|j0d=|&d> ? |#jS7P77c#tV$rd}YowxYw7F77&7777r777g7Z#1d{7swYkxYw7`74#t$r|#jQcYSwxYw#t$r}'t|'d}'~'wwxYww)AuC Allow users to create a new team. Apply user permissions to their team. 👉 [Detailed Doc on setting team budgets](https://docs.litellm.ai/docs/proxy/team_budgets) Parameters: - team_alias: Optional[str] - User defined team alias - team_id: Optional[str] - The team id of the user. If none passed, we'll generate it. - members_with_roles: List[{"role": "admin" or "user", "user_id": ""}] - A list of users and their roles in the team. Get user_id when making a new user via `/user/new`. - team_member_permissions: Optional[List[str]] - A list of routes that non-admin team members can access. example: ["/key/generate", "/key/update", "/key/delete"] - metadata: Optional[dict] - Metadata for team, store information for team. Example metadata = {"extra_info": "some info"} - model_rpm_limit: Optional[Dict[str, int]] - The RPM (Requests Per Minute) limit for this team - applied across all keys for this team. - model_tpm_limit: Optional[Dict[str, int]] - The TPM (Tokens Per Minute) limit for this team - applied across all keys for this team. - default_estimated_output_tokens: Optional[int] - Expected output tokens reserved for TPM limiting when a request omits max_tokens, for keys on this team that do not set their own. Positive integer. - default_estimated_output_tokens_per_model: Optional[Dict[str, int]] - Per-model override of the above. Example: {"gpt-4": 4096, "gpt-3.5-turbo": 1024} - mcp_rpm_limit: Optional[Dict[str, int]] - Per-MCP-server RPM limit for this team, keyed by MCP server name (alias if set, else the configured name). Example: {"github": 100, "slack": 200}. Applied across all keys for this team. - tpm_limit: Optional[int] - The TPM (Tokens Per Minute) limit for this team - all keys with this team_id will have at max this TPM limit - rpm_limit: Optional[int] - The RPM (Requests Per Minute) limit for this team - all keys associated with this team_id will have at max this RPM limit - rpm_limit_type: Optional[Literal["guaranteed_throughput", "best_effort_throughput"]] - The type of RPM limit enforcement. Use "guaranteed_throughput" to raise an error if overallocating RPM, or "best_effort_throughput" for best effort enforcement. - tpm_limit_type: Optional[Literal["guaranteed_throughput", "best_effort_throughput"]] - The type of TPM limit enforcement. Use "guaranteed_throughput" to raise an error if overallocating TPM, or "best_effort_throughput" for best effort enforcement. - max_budget: Optional[float] - The maximum budget allocated to the team - all keys for this team_id will have at max this max_budget - soft_budget: Optional[float] - The soft budget threshold for the team. If max_budget is set, soft_budget must be strictly lower than max_budget. Can be set independently if max_budget is not set. - budget_duration: Optional[str] - The duration of the budget for the team. Doc [here](https://docs.litellm.ai/docs/proxy/team_budgets) - models: Optional[list] - A list of models associated with the team - all keys for this team_id will have at most, these models. If empty, assumes all models are allowed. - blocked: bool - Flag indicating if the team is blocked or not - will stop all calls from keys with this team_id. - members: Optional[List] - Control team members via `/team/member/add` and `/team/member/delete`. - tags: Optional[List[str]] - Tags for [tracking spend](https://litellm.vercel.app/docs/proxy/enterprise#tracking-spend-for-custom-tags) and/or doing [tag-based routing](https://litellm.vercel.app/docs/proxy/tag_routing). - prompts: Optional[List[str]] - List of prompts that the team is allowed to use. - organization_id: Optional[str] - The organization id of the team. Default is None. Create via `/organization/new`. - model_aliases: Optional[dict] - Model aliases for the team. [Docs](https://docs.litellm.ai/docs/proxy/team_based_routing#create-team-with-model-alias) - guardrails: Optional[List[str]] - Guardrails for the team. [Docs](https://docs.litellm.ai/docs/proxy/guardrails) - policies: Optional[List[str]] - Policies for the team. [Docs](https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies) - disable_global_guardrails: Optional[bool] - Whether to disable global guardrails for the key. - object_permission: Optional[LiteLLM_ObjectPermissionBase] - team-specific object permission. Example - {"vector_stores": ["vector_store_1", "vector_store_2"], "agents": ["agent_1", "agent_2"], "agent_access_groups": ["dev_group"]}. IF null or {} then no object permission. - team_member_budget: Optional[float] - The maximum budget allocated to an individual team member. - team_member_budget_duration: Optional[str] - The duration of the budget for the team member. Doc [here](https://docs.litellm.ai/docs/proxy/team_budgets) - team_member_rpm_limit: Optional[int] - The RPM (Requests Per Minute) limit for individual team members. - team_member_tpm_limit: Optional[int] - The TPM (Tokens Per Minute) limit for individual team members. - team_member_key_duration: Optional[str] - The duration for a team member's key. e.g. "1d", "1w", "1mo" - allowed_passthrough_routes: Optional[List[str]] - List of allowed pass through routes for the team. - allowed_vector_store_indexes: Optional[List[dict]] - List of allowed vector store indexes for the key. Example - [{"index_name": "my-index", "index_permissions": ["write", "read"]}]. If specified, the key will only be able to use these specific vector store indexes. Create index, using `/v1/indexes` endpoint. - secret_manager_settings: Optional[dict] - Secret manager settings for the team. [Docs](https://docs.litellm.ai/docs/secret_managers/overview) - router_settings: Optional[UpdateRouterConfig] - team-specific router settings. Example - {"model_group_retry_policy": {"gpt-4": {"RateLimitErrorRetries": 5}}}. IF null or {} then no router settings. - access_group_ids: Optional[List[str]] - List of access group IDs to associate with the team. Access groups define which models the team can access. Example - ["access_group_1", "access_group_2"]. - enforced_file_expires_after: Optional[dict] - Enforced file expiration policy for the team. Keys created under this team will inherit this policy for file uploads. Example - {"anchor": "created_at", "days": 30}. - enforced_batch_output_expires_after: Optional[dict] - Enforced batch output file expiration policy for the team. Keys created under this team will inherit this policy for batch output files. Example - {"anchor": "created_at", "days": 30}. - budget_limits: Optional[list] - List of concurrent budget windows for the team. Each window specifies a budget_limit, time_period, and optional budget_duration. Example - [{"budget_limit": 10.0, "time_period": "1d"}, {"budget_limit": 50.0, "time_period": "7d"}]. - default_team_member_models: Optional[List[str]] - Default models assigned to new team members when they join this team. Must be a subset of the team's models. Returns: - team_id: (str) Unique team id - used for tracking spend across multiple keys for same team id. _deprecated_params: - admins: list - A list of user_id's for the admin role - users: list - A list of user_id's for the user role Example Request: ``` curl --location 'http://0.0.0.0:4000/team/new' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "team_alias": "my-new-team_2", "members_with_roles": [{"role": "admin", "user_id": "user-1234"}, {"role": "user", "user_id": "user-2434"}] }' ``` ``` curl --location 'http://0.0.0.0:4000/team/new' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "team_alias": "QA Prod Bot", "max_budget": 0.000000001, "budget_duration": "1d" }' ``` rget_audit_log_changed_byis_audit_logging_enabled)_license_checkcreate_audit_log_for_updaterlitellm_proxy_admin_namer$rINrNo db connectedrSr;max_budget must be a non-negative finite number. Received: Cteam_member_budget must be a non-negative finite number. Received: .s&/@F"3";";;/s#&admin)rolerrcreate operationrrrrr model_aliases created_by updated_byrrequested_mcp_serversexisting_object_permission_idis_proxy_adminr$) data_jsonr$rjrr) object_data field_namerget_budget_reset_timerreset_atrouter_settingsrdb_data)rlr)rr!rlcomplete_team_datar$rr defaultrrr created id updated_at changed_bychanged_by_api_keyr object_idactionupdated_values before_value request_datar)m+litellm.proxy.management_helpers.audit_logsrrlitellm.proxy.proxy_serverrr rr r$rIrrmathisfiniterdrrbrrgrTrSr'countis_team_count_over_limitrrrrwrget_datarrr_rrsetattrrdefault_team_settingsrrrr{rNrHrrVr0rWrrrirrr1rrZrr\rcrorr)r(rdumpsr1r%rArkobject_permission mcp_serversrjrkrerfrr,r'r]r&)litellm.proxy.common_utils.timezone_utilsr4r budget_limitsr isoformatrrVjsonify_team_objectdbr)r r#rhrgr@_add_team_members_to_teamasyncio create_taskr$rnowrutcapi_keyr/TEAM_TABLE_NAMErCru)(rlrrrrrrr rr r$rI total_teams_existing_team_iddefault_organization_idr default_valuedefault_budgetrcreating_user_in_list _model_idlitellm_modeltable model_dictr0r;r4initialized_windowswindowwrcomplete_team_data_dictrouter_settings_valuerouter_settings_jsonteam_creation_datar)rHaffected_access_groupsteam_member_add_request_updated_valueses( ` rnew_teamrws BW+     CBS8TU U ?? & doo0NRVRaRadeRe#^_c_n_n^o!pq   " " . d556$:Q:QTU:Ubcgczczb{|     't?O?O1PTXTdTdghTh#_`d`p`p_q!rs  !!5!56 !A!AB    '*##t6'$'#}T5E5E4FFpqurArAqBBC&D  6"/  9"/  $,M#:#@#@#BB >BBkBZh  << tzz|,DL||z)# #9ZL9l"m.;-C-C M.D.( !,# ##z$,,?o%pq    '-DEV-W #137'>$  8EtUD)1**e4;P;P.P 7 >  ,D%7 8 ?? "788$?556:w<&E&EFtI[I`I`nrI`IsFt&u uJ" IIIK @IMI_I_Ik4#9#9#E#Equ*.,66:J:V:VV'    1'  # 7 7#66"&"<"<"&"<"<(,(H(H 8 6UU#,"3#'#:#:&*&@&@&*&@&@,0,L,L&*&;&;V  I%6% % %  G EtUD)5* 2$!$. ? EtUD)5* 2$!$.   - - 9 W1F 2 B B2  .  + + W)+ ,:: .(6FF2GH_`jHk2l #J /"/"C"CLc"C"d:Q!##&&( o oBEGEYEYE`E`',FaF@H3YY[]e]m]m2n,n "  o o--CDDD*>LL%* ((''/%=     $ %05545HO"jj#FO   +!2tzz|,#+<< #=#;/A.?5M$ ,=+D+D#4#D#D"&,,('6%)" ( #&&( (cC$(\ - !  ! & "!v   V o@-o  o o o o E F #==? " # +'**+skG*j6/h?0Bj6iA#j64j6 j6B/j6i"i#i'-j6iA j6 i!Cj6:i ;B"j6i#A/j6 i&j6"i)#Bj6:i,;)j6%0j6E1j6i/j6 %i;0i21i;i5i; j6i8j61j2.j6 j!C j6/j>k?j6j6i ij6ij6j6 j6#j6&j6)j6,j6/j62i;5i;8j6;jj j j6j6j30j61k2j33j66 k? k  kkexisting_team_rowrr cKddlm}m}|jd}tj|t }tj|t } t j|tt tjtjtj|||||jt j"|d| | y w) a Create an audit log entry for team update operations. Args: existing_team_row: The team row before the update updated_kv: Dictionary of updated key-value pairs team_id: The ID of the team being updated litellm_changed_by: Optional header indicating who made the change user_api_key_dict: User API key authentication details litellm_proxy_admin_name: Name of the proxy admin r)r rTrr<r>rr@rIN)rKr rrrTrr]r^r$rrwrr_rr`rar/rb) rxrrrrr r r _before_value _after_values r_create_team_update_audit_logr|Vs& &***=MJJ}c:M#zz*cBL #*tzz|$#<< 53'9&7-E $5#<#<,<<! +* sCCrcK|}|jt|jtrtt j |j|j xs||j xs|}|6t|ji|j dd{}nMt|jd|ii|j di|j ddd{}|j}|S7`7w) z4 Upsert model table and return the model id Nr(TrrlrA)updater%r) r)r_rr(rrTrr1r%upsertrA)rlrr$rr rirjrks r_update_model_tablersI %*T5G5G*N$6**T%7%78(00L4L(00L4L%   (7>>DrGYG^G^lpG^GqDr>ssJ(7>>X&L!3!8!8d!8!KLL!3!8!8d!8!KL ? JMM ts%B"D $D%A D 2D3D D rrcHK|jr$|jDchc]}|jc}n t}|jD]}|j|jtj j k(r8|j|vrG|jT tt|jtj|j|d{ycc}w7 #t$r+}tjd|j|Yd}~d}~wwxYww)a( When moving a team to an org, ensure all team members are also org members. For SSO/Entra setups without SCIM, users join teams automatically on login but are never explicitly added to organizations. This silently upserts missing members rather than blocking the team move. N)rr#)r!rr$z@_auto_add_team_members_to_organization: skipping user_id=%s - %s)membersrrrr:default_user_idrrrcr3r0 INTERNAL_USERrCrdebug)rrr$rorg_member_idsr!rvs r&_auto_add_team_members_to_organizationrsJVI]I] 0D0DE1QYYEcfchN)) >> !  >>0@@FF F  >>^ +   ' ' /  , "NN)77!- < <+   F   & &R   sLD"C$A-D">C+C)C+!D")C++ D4!DD"DD"r llm_routerz'prisma_models.LiteLLM_OrganizationTablecBK|'tddtjjit |j d|iddddd{}|td dd |i|duxr|j tjk(}tj|j}ttj|j||| |r7ttj|j|| d{|S77w) a Fetch and validate an organization for team update operations. Args: organization_id: The organization ID to fetch existing_team_row: The existing team row being updated llm_router: The LLM router instance prisma_client: The Prisma database client Returns: The organization row from the database Raises: HTTPException: If llm_router is None, organization not found, or validation fails Nr rrSrT)rrrrz/Organization not found, passed organization_id=)rrrr/)rrr$)rr" no_llm_routerrr3rrVr0rWr*rMrvalidate_team_org_changer,r)rrxrr$rorganization_rowr/rs rfetch_and_validate_organizationrs8,W>O>]>]>c>c4dee$+M$:$F$F /2)-$N%G% NN_`a  'd2r7H7R7RVfVrVr7rN>MMN^NiNiNklL  - -.?.J.J.L M!% 4"112C2N2N2PQ%'   7* s%ADDCDDDDr/c |j|jk(ryt|jdkDrytjj |jvrnR|jt|jdk(rt dddi|jD]}t||||jry|jrm|jjrW|j|jjkDr4t ddd|jd |jjd i|s|jDcgc]}|j}}|jr$|jDcgc]}|jc}ng}|Dcgc]'}||vs|tjj k7s&|)}}t|dkDrt ddd |d i|jry|jrm|jjrW|j|jjkDr4t ddd |jd|jjd i|j ry|jrm|jj rW|j |jj kDr4t ddd|j d|jj d iycc}wcc}wcc}w)aa Validate that a team can be moved to an organization. - The org must have access to the team's models - The team budget cannot be greater than the org max_budget - For non-proxy-admins: all team members must already be org members - The team's tpm/rpm limit must be less than the org's tpm/rpm limit Proxy admins bypass the membership check and instead trigger auto-add of missing members (handled by the caller). This supports SSO/Entra setups where org membership tables are empty but proxy admins still need to group teams under orgs for budget/model governance. TrrrzeCannot move team to organization. Team has access to all proxy models, but the organization does not.rS)r org_objectrz6Cannot move team to organization. Team has max_budget z4 that is greater than the organization's max_budget rz3Cannot move team to organization. Team has user_id z* that is not a member of the organization.z5Cannot move team to organization. Team has tpm_limit z3 that is greater than the organization's tpm_limit z5Cannot move team to organization. Team has rpm_limit z3 that is greater than the organization's rpm_limit )rrrr9rrrrKrrrrrr:rrzry) rrrr/rr team_members org_members not_in_orgs rrrsQ, |;;; <  !#  - - 3 3|7J7J J  [[ C $4$9E  $+)    - -  - - 8 8 OOl??JJ JQRVRaRaQbcWXdXyXyXDXDWEEFG   262I2IJQqyyJ JJVJ^J^1E1EFAaiiFdf # q ';EXEhEhEnEn@nA   z?Q RS]R^_IJ    - -  - - 7 7 NN\>>HH HPQUQ_Q_P`aTUaUvUvU@U@TAABC     - -  - - 7 7 NN\>>HH HPQUQ_Q_P`aTUaUvUvU@U@TAABC  MKF sK&0K+ K0K04K0z /team/update)rrc ZK ddlm}ddlm}m}m}m}m} |'tddtjji|jtddd itjd ||jJt!j"|jr|jdkrtddd |ji|j$Jt!j"|j$r|j$dkrtddd |j$i|j&Jt!j"|j&r|j&dkrtddd |j&it)|j*t)|j,t/t1|j3d|jid{} | tddd|jit5t7j8| j;|d{t=| dd} t?|tA| tBr| nd|dtE|tA| tBr| nd|dtG||d|j&U|j |jn | j} | /|j&| k\r tddd|j&d| di|jwtIt=| dd} |j& |j&n| }|EtA|tJtLfr/|j|kr tddd|jd|di|jNtQ|jNdkDrt=| dd}|jN|k7r|jRtTjVjk7rr|jXrSt[|j]|jX|jNtTj^jdd{ng}|stddd ita|jN| |||!d{n+|jNtQ|jNdk(rd|_'tI|jN |jNn | jN}|@tA|tbr0|.te|| |"d{}|tg|||#d{|ti||| j$|jkd%&}tA|jmdtBrtnjq|dd|vrtA| jrtBr@| jrjuDcic]\}}|tnjvvr||c}}nd}tyd'|jmd||j|jz |jzn | jz|(d{t}||d)Dchc]}||vr| }}|rtnj|j$|j|j|j,)rtnj| |||j$|j|j|j,|*d{}|jmdxsijmd+}|r{| jrotnj|j| j||,d{n9|r"tnj| |||-d{}ntnj||jet|jj| j|jRtTjVk(|.d{t|| /d{}t|0|jmdt|d|d<d1|vr:|jd1t|| j|||2d{}|||d3<d4|vr|d4t|d4|d4<|j|5}|}t|jd|ji|d%d%d67d{}| |jtddd8|itjd9|jt||j:d{t|| |;d{|r#t| ||j|||<d{|j|d=S7737/77}7hcc}}w7Zcc}w77O7.777K777s7K#t$r}t|d}~wwxYww)>a+ Use `/team/member_add` AND `/team/member/delete` to add/remove new team members You can now update team budget / rate limits via /team/update Parameters: - team_id: str - The team id of the user. Required param. - team_alias: Optional[str] - User defined team alias - team_member_permissions: Optional[List[str]] - A list of routes that non-admin team members can access. example: ["/key/generate", "/key/update", "/key/delete"] - metadata: Optional[dict] - Metadata for team, store information for team. Example metadata = {"team": "core-infra", "app": "app2", "email": "ishaan@berri.ai" } - tpm_limit: Optional[int] - The TPM (Tokens Per Minute) limit for this team - all keys with this team_id will have at max this TPM limit - rpm_limit: Optional[int] - The RPM (Requests Per Minute) limit for this team - all keys associated with this team_id will have at max this RPM limit - max_budget: Optional[float] - The maximum budget allocated to the team - all keys for this team_id will have at max this max_budget - soft_budget: Optional[float] - The soft budget threshold for the team. If max_budget is set (either in the request or existing), soft_budget must be strictly lower than max_budget. Can be set independently if max_budget is not set. - budget_duration: Optional[str] - The duration of the budget for the team. Doc [here](https://docs.litellm.ai/docs/proxy/team_budgets) - models: Optional[list] - A list of models associated with the team - all keys for this team_id will have at most, these models. If empty, assumes all models are allowed. - prompts: Optional[List[str]] - List of prompts that the team is allowed to use. - blocked: bool - Flag indicating if the team is blocked or not - will stop all calls from keys with this team_id. - tags: Optional[List[str]] - Tags for [tracking spend](https://litellm.vercel.app/docs/proxy/enterprise#tracking-spend-for-custom-tags) and/or doing [tag-based routing](https://litellm.vercel.app/docs/proxy/tag_routing). - organization_id: Optional[str] - The organization id of the team. Default is None. Create via `/organization/new`. - model_aliases: Optional[dict] - Model aliases for the team. [Docs](https://docs.litellm.ai/docs/proxy/team_based_routing#create-team-with-model-alias) - guardrails: Optional[List[str]] - Guardrails for the team. [Docs](https://docs.litellm.ai/docs/proxy/guardrails) - policies: Optional[List[str]] - Policies for the team. [Docs](https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies) - disable_global_guardrails: Optional[bool] - Whether to disable global guardrails for the key. - object_permission: Optional[LiteLLM_ObjectPermissionBase] - team-specific object permission. Example - {"vector_stores": ["vector_store_1", "vector_store_2"], "agents": ["agent_1", "agent_2"], "agent_access_groups": ["dev_group"]}. IF null or {} then no object permission. - team_member_budget: Optional[float] - The maximum budget allocated to an individual team member. - team_member_budget_duration: Optional[str] - The duration of the budget for the team member. Doc [here](https://docs.litellm.ai/docs/proxy/team_budgets) - team_member_rpm_limit: Optional[int] - The RPM (Requests Per Minute) limit for individual team members. - team_member_tpm_limit: Optional[int] - The TPM (Tokens Per Minute) limit for individual team members. - team_member_key_duration: Optional[str] - The duration for a team member's key. e.g. "1d", "1w", "1mo" - allowed_passthrough_routes: Optional[List[str]] - List of allowed pass through routes for the team. - model_rpm_limit: Optional[Dict[str, int]] - The RPM (Requests Per Minute) limit per model for this team. Example: {"gpt-4": 100, "gpt-3.5-turbo": 200} - model_tpm_limit: Optional[Dict[str, int]] - The TPM (Tokens Per Minute) limit per model for this team. Example: {"gpt-4": 10000, "gpt-3.5-turbo": 20000} - default_estimated_output_tokens: Optional[int] - Expected output tokens reserved for TPM limiting when a request omits max_tokens, for keys on this team that do not set their own. Positive integer. - default_estimated_output_tokens_per_model: Optional[Dict[str, int]] - Per-model override of the above. Example: {"gpt-4": 4096, "gpt-3.5-turbo": 1024} - mcp_rpm_limit: Optional[Dict[str, int]] - Per-MCP-server RPM limit for this team, keyed by MCP server name (alias if set, else the configured name). Example: {"github": 100, "slack": 200}. Applied across all keys for this team. Example - update team TPM Limit - allowed_vector_store_indexes: Optional[List[dict]] - List of allowed vector store indexes for the key. Example - [{"index_name": "my-index", "index_permissions": ["write", "read"]}]. If specified, the key will only be able to use these specific vector store indexes. Create index, using `/v1/indexes` endpoint. - secret_manager_settings: Optional[dict] - Secret manager settings for the team. [Docs](https://docs.litellm.ai/docs/secret_managers/overview) - router_settings: Optional[UpdateRouterConfig] - team-specific router settings. Example - {"model_group_retry_policy": {"gpt-4": {"RateLimitErrorRetries": 5}}}. IF null or {} then no router settings. - access_group_ids: Optional[List[str]] - List of access group IDs to associate with the team. Access groups define which models the team can access. Example - ["access_group_1", "access_group_2"]. - enforced_file_expires_after: Optional[dict] - Enforced file expiration policy for the team. Keys created under this team will inherit this policy for file uploads. Example - {"anchor": "created_at", "days": 30}. - enforced_batch_output_expires_after: Optional[dict] - Enforced batch output file expiration policy for the team. Keys created under this team will inherit this policy for batch output files. Example - {"anchor": "created_at", "days": 30}. - budget_limits: Optional[list] - List of concurrent budget windows for the team. Each window specifies a budget_limit, time_period, and optional budget_duration. Example - [{"budget_limit": 10.0, "time_period": "1d"}, {"budget_limit": 50.0, "time_period": "7d"}]. - default_team_member_models: Optional[List[str]] - Default models assigned to new team members when they join this team. Must be a subset of the team's models. ``` curl --location 'http://0.0.0.0:4000/team/update' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data-raw '{ "team_id": "8d916b1c-510d-4894-a334-1c16a93344f5", "tpm_limit": 100 }' ``` Example - Update Team `max_budget` budget ``` curl --location 'http://0.0.0.0:4000/team/update' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data-raw '{ "team_id": "8d916b1c-510d-4894-a334-1c16a93344f5", "max_budget": 10 }' ``` r)r)r rr$rJrINr rrSrNo team id passed inz/team/update - %sr rrrrrTeam not found, passed team_id=rYrrrr$rrrrz max_budget (z-) must be strictly greater than soft_budget (r)rrrVrzgRelocating a team to a different organization requires PROXY_ADMIN or org-admin of the destination org.)rrxrr$r)rrIr$r)rlrrT exclude_unsetrr&rj)rLrrrdrerfrgrnr])rrr]r$)rLrrrnr,)r0rx)rr))rlrr$rr rr7r8r"rUrrlrzTeam doesn't exist. Got=z$Successfully updated team - %s, infor$rrN)rxrrrrr )rrl)[rKrrLr rr$rJrIrr"db_not_connected_errorrrrrrrMrNrdrrbrrgrr~rrZr,rMrrrTr_rrSrZrrrrrrVr0rWrr5r ORG_ADMINrrrNrrrr{r\rcrrr`ror_set_budget_reset_atrkrerfrrrrr|rUrkrVrhandle_update_object_permissionr_rVrarrrrZr'rrrirOr|rCru)rlrrrrr rr$rJrIrx_existing_team_metadatamax_budget_to_checkexisting_soft_budgetsoft_budget_to_checkcurrent_org_idcaller_membershipsorg_id_to_checkrrrbrstored_metadatar_team_member_fields_in_request_backfill_budget_idriteam_update_datarHrvs r update_teamrnsg \C+X    !2!I!I!O!OP  << CBX8YZ Z""#6= ?? & doo0NRVRaRadeRe#^_c_n_n^o!pq   " " . d556$:Q:QTU:Ubcgczczb{|     't?O?O1PTXTdTdghTh#_`d`p`p_q!rs  !!5!56 !A!AB".~m/L"M"Y"Ydll+#Z#    $#B4<<.!QR  "&556G6R6R6TU/   299JJX\1]59CD[]a9b5hl/  99CD[]a9b5hl/   4D:KTZ[    '59__5P$//VgVrVr ".##'::'$'#}T5E5E4FFprEqFFG&H  ?? &2B>N>N>Z$*:*:`t #/J?SVY[`Ua4b??&::'$'#|DOO3DDqsGrHHI&J     +D4H4H0IA0M%,,=?PRV$WN$$6%//3C3O3O3U3UU)00-];EE'8'@'@/3/C/C)9)C)C)I)IF#*'$'#!3   2 $ 4 4"3%+"3    ! ! -#d6J6J2Kq2P#'D *4$($8$8$DD J[JkJk*   &:os+KP]Pi%3+& I $,'"/  " /"3):)E)E  YYTY2  jnnZ0$ 7 # F FzR\G] ^  #/88$?'8&@&@&F&F&H"U"9"V"VVJ  7"# 3"1 .2oo.I4??O`OkOk"3    T:. 1   "  1 & 1  *.E.Z.Z#66"&"<"<"&"<"<(,(H(H /[/ 7VV,"3%#'#:#:&*&@&@&*&@&@,0,L,L&D W  J+5..*D*J)O)OPg)h "'8'K'K-QQ LL'8'K'K*="/ R ,6VV,"3%&D W J $ = =j I  ! ! -C&*&<&<&H&H.?.T.T0::>N>Z>ZZ+    ?$"3 J :6 >>* % 1%::j;Q%RJz " j ( NN? +%8*33+"3)A & I$)2 :&  *z:K/L/X,6zBS7T,UJ( )"66z6J 8B ( 7 > >dll+! (,%) !? !    x//7#;H:!FG  !!"H(JZJZ[/mU]UeUefff"1/   $ %/"3% #5"3)A   $++X>>k  t,    0  1 "      & g   +'**+s~f+G feAf%e&Hf,e-4f!e"Bf$e!%f<e$=B"fe'>Afe-f( e05B fe5A&f)e8*#f e;A1f?e>ffA$f9f:A(f"f#Aff ff )ff ff+ffff!f$f'f0f8f;f>ffff f f f f( f##f((f+z/team/{team_id}c Kddlm} |'tddtjj i|j /|j |k7r tddd|j d |d i|jd d h }d|vrst|jd |id{}|tddd|it|jtr |jni}t||d|d<tjd |i|} t!| |||d{} | dS77 #t"$r} t%| d} ~ wwxYww)a5 Partially update a team using RFC 7386 JSON Merge Patch semantics. `team_id` is taken from the path; a `team_id` in the body is accepted only when it matches. `metadata` is merged with the team's stored metadata rather than replacing it: an omitted key is preserved, `key: null` deletes it, and any other value overwrites (recursing into nested objects). Every other field behaves exactly like `POST /team/update` (omitted preserves, a value overwrites). Returns the full updated team. ``` curl --location --request PATCH 'http://0.0.0.0:4000/team/8d916b1c-510d-4894-a334-1c16a93344f5' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data-raw '{ "metadata": {"cost_center": "1234", "deprecated_key": null} }' ``` rr&Nr rrSrzteam_id in body (z") does not match team_id in path (rTr)rexcluderrrr)rlrrrrl)rLr$rr"rrrrr'rr_rrrWrFrMrrCru) rrlrrrr$ patch_fieldsrxrupdate_requestresultrvs r patch_teamr sJ9#+  !2!I!I!O!OP  << # (?#4T\\NBdeldmmn!op  #ooD9+oV  %-5m-D-P-PXacjWk-P-l'l  (# ##'Fwi%PQ?IIZIcIcei>j 1 : :pr '=>OQ]^hQi'jL $ 1 @ @)WAeXdAe f)%/1    f~#(m  +'**+sNEBD2&D.'A=D2$D0%D2-E.D20D22 E ; EE  Ec|jddlm}||j}||d<nd|vr |dd|d<|jt |jdkDrddlm}g}|jD]R}t |t r|n|j}||dj|d<|j|Ttj||d<yyy) zASet budget_reset_at in updated_kv if budget_duration is provided.Nrr3r5rrr6rX) rrWr4rXrr_rrrYrrrT)rlrr4r6rlrmrns rrrO s 'S/@T@TU(0 $% j (Z8I-J-R(, $% %#d.@.@*AA*ES%'(( *F$VT28I8I8KA1!DUBVWaacAjM  & &q ) *'+jj1D&E ?#+F%rr0cKddlm}t||j|d{}|||d<t j d||S7#w)a Handle the update of object permission for a team. - IF there's no object_permission_id, then create a new entry in LiteLLM_ObjectPermissionTable - IF there's an object_permission_id, then update the entry in LiteLLM_ObjectPermissionTable rr&)r0r.r$Nrz updated object_permission_id: %s)rLr$rlrrr)r0rxr$rs rrrd s]9)O&7&L&L#)#',@ ()""#EG[\ #s"A A$A r! premium_usercDt|tr:|jdk(r+|dur&tdtj j yt|trF|D]@}|jdk(s|dustd|dtj j dyy)Nr"Tz,Assigning team admins is a premium feature. z0Assigning team admins is a premium feature. Got=z. )r_r1r# ValueErrorr"not_premium_userrr)r!rrs r_check_team_member_admin_addr| s&&!fkkW&< t #KL]LnLnLtLtKuvw w $ FD ! Avv t+$J1#RPaPrPrPxPxOyy{|  "rc|tdddi|jtdddi|jtdddi t|j|y#t$r}tddt |id}~wwxYw) Nr rr rSrrzNo member/members passed in)r!r)rrr!rrCr)r$rlrrvs rteam_call_validation_checksr s W>O4PQQ ||W>T4UVV {{W>[4\]]G$;;%  GWc!f4EFFGs A!! B*BBcgdtffd }t|jtr||jn3t|jtr|jD] }|| t|jtrKt t |jk(r*t dj tjddt|jtrft dk(rXt d|jjd|jjd j tjddt d kDr"tjd j y y ) z Check if a member already exists in the team. This check is done BEFORE we create/fetch the user, so it only prevents obvious duplicates where both user_id and user_email match exactly. r!c(|j<jD]-}|j|jk(sj|/|j=jD]-}|j|jk(sj|/yyr)rrr user_email)r!existing_memberrxinvalid_team_memberss r_check_member_duplicationzDteam_member_add_duplication_check.._check_member_duplication s >> %#4#G#G 8"**fnn<(//7 8    (#4#G#G 8"--1B1BB(//7 8 )rz0All users are already in team. Existing members=400messagetypeparamcodez&User already in team. Member: user_id=z , user_email=z. Existing members=rzISome users are already in team. Existing members=%s. Duplicate members=%sN) r1r_r!rrr6rr5team_member_already_in_teamrrrr)rlrxrrrs ` @r!team_member_add_duplication_checkr sk#% 8& 8$++v&!$++. DKK & )A %a ( )$++t$-A)Bc$++FV)VFGXGkGkFlm <<   DKK (S1E-F!-KI[\ (;LWi jjj "**+ ell&&..   *d.B.B.NRVReReRq=  %/t{{D$AT[[ }G#$5y$GN 666 *f 4O !D9^~7WQ MksAE E C2E>Ec Kg}g}|j|jjdnd}|j} t|dd} | | r| } t |j t rq t|j |j||||j|| |j| d{\} } |j| | |j| ||fSt |j tru|j D]f} t||j||||j|| |j| d{\} } |j| | V|j| h||fS7#t$r1} tddd|j d|jd | i d} ~ wwxYw7q#t$r'} tddd|d|jd | i d} ~ wwxYww) zProcess and add new team members. ``tx`` is the caller's open transaction, when it has one, so the member writes run on the connection it already holds instead of checking out a second one. Nr]default_team_member_models) new_memberrr$rr rdefault_team_budget_idrrr)r rzUnable to add user - z , to team - z, for reason - rS)rr{rrr_r!r1rqrrrrCrrr)rlr;r$rr r) updated_usersupdated_team_membershipsrmember_allowed_modelsteam_default_member_models updated_user updated_tmrvrs r_process_team_membersr) s257MDFEWD_D_Dk##''(?@qu !//(/0BD`bf(g$)C :$++v& -;;;#'#:#:+"3)A '=4 $ 4 4 . ( $L*" \*  ! $ + +J 72 2 221 DKK & '>"/&7-E LL+A#8$($8$8 2 ,( j"   .%(// ;+ <. 2 22Y ( #8 \RVR^R^Q__nopnq!rs   , # ##'Yhijhk%lm szA'G!*AE/*E-+E/2AG!6F.:F,;F.G!G!-E// F)8,F$$F))G!,F.. G7"GGG!rcjxstfd|Ddjxstfd|Dd}j|dS)aReturn ``member`` with whichever of ``user_id`` / ``user_email`` the caller left out filled in. The roster entry is a snapshot, so whatever is missing here is missing for good. Resolution runs both ways off the user rows the add just touched: added by email -> stamp the user_id, added by user_id -> stamp the email. A value the caller supplied is never overwritten. c3K|]5}j'|jjk(r|j7ywrrr)rrr!s rrz+_resolve_member_identity..} s:   ,FDUDU1U LL s;>Nc3pK|]-})|jk(r|j|j/ywrrr)rrresolved_user_ids rrz+_resolve_member_identity.. s; + @P0PUYUdUdUp OO s36rr)rnextr model_copy)r!rresolved_user_emailrs` @r_resolve_member_identityrt s~%nn % 1"(!2!2"d % 7   '-   rc@tfd|jDS)Nc3K|]X}jduxr|jjk(xs)jduxr|jjk(Zywrr)rrr!s rrz*_member_already_in_team.. sh  t # Q(?(?6>>(Q _   T ) ]o.H.HFL]L].] _sAA!)rir)r!r;s` r_member_already_in_teamr s%  2DD rcKt|jtr |jfnt|j}tfd|D}jj fd|Dyw)z*Update the team's members_with_roles list.c36K|]}t|ywr)r)rrrs rrz,_update_team_members_list.. s#jST$. s!1+B1FX+Y1N)r_r!r1tuplerextend)rlr;rrequested_membersresolved_memberss `` r_update_team_members_listr sf%T[[&9uT[[?Q$#jXi#jj ))001#1sA6A:zprisma_models.LiteLLM_TeamTablec Kdd|jdi}|j4d{}|jt|jd{t |j ||jd{}| t d|||_t||||||d{\}} t|||d{|jD cgc]} | j} } t|jd |jid tj| i d{} | t d|dddd{  fS727 777cc} w797#1d{7swY,xYww) aAdd team members to the team, under the team's advisory lock. The lock (``TEAM_ADVISORY_LOCK_SQL``, keyed on the team id) is taken first, and the team is re-read under it before any write, so a delete that already committed is visible here before this call writes anything: the user and membership writes only happen once the re-read proves the team is still live. /team/delete takes the same lock around its own sweep-and-delete, so the two can never interleave; whichever acquires the lock first runs to completion before the other's re-read can proceed. The user and membership writes run on this transaction too, not on a second connection from the pool: a lock waiter that needs a connection it hasn't got yet is a waiter that can deadlock the pool, since enough concurrent adds for one team would hold every connection waiting on the lock while the holder waits for a free one. rzTeam=z. was deleted while this member add was runningNrrS)rlr;r$rr r))rlr;rrrr)rr) query_rawrer~get_members_with_roles_lockedrrrrrr+rrrT) rlr;r$rr  gone_detailr)locked_membersrrr_db_team_members updated_teams rr\r\ s*)05Ft1u'vK!EERll14<<@@@&4]&C&a&abdfjfrfr&s s  !C D D0>-8M1'/%= 9 3 / /(1'   "a"a$/O$:$:dll+& 3C(DE%;%    C D D;EE> (@ @@?E@ s 3  #b 1EEEEs'FEF$E0E,E0>E!?.E0-E#.E0E%E0E'0AE02E,3E0 FE. FE0!E0#E0%E0'E0.F0F6E9 7F>Fctj}|y |j|y#t$r)}t j dt |Yd}~yd}~wwxYw)zUpdate the Prometheus team members gauge after a membership change. No-ops when the Prometheus callback is not registered, and never lets a metric failure break the team add/delete request. Nz2Prometheus: failed to emit team members metric: %s)r get_instanceset_team_members_metricrCrrr)rprometheus_loggerrvs r_emit_team_members_metricr s] 0<<> a11$7 a""#WY\]^Y_``as+ AAArcKtd|D}|s tStt|jddt |iid{}td|xsdDS7w)zReturn the caller-supplied user_ids that already have a user row. Resolved with a single query so the number of members in the request does not translate into that many concurrent connections. c3NK|]}|j|jywrr rr!s rrz4_resolve_existing_member_user_ids.. s )mVRXR`R`Rl&..)mrrrrNc3NK|]}|j|jywrr rrs rrz4_resolve_existing_member_user_ids.. sVdT\\=UT\\Vrr)rrrrsorted)rr$requested_user_idsfounds r!_resolve_existing_member_user_idsr  s}!*)mw)m m {).*GHRR f/0 SE VekrV VVsAA2A0A2caller_supplied_user_idsrc6tfd|D}||zS)a|Return the user_ids that already had a user row before this request. Combines the caller-supplied ids that resolved to a user with the ids ``_validate_and_populate_member_user_info`` filled in, which it only does from a matched user row. Deriving it that way keeps this in step with the email matching that resolution performs, rather than repeating it here. c3jK|]*}|j|jvr|j,ywrr )rr!r s rrz)_pre_existing_user_ids.. s3*  >> %&..@X*X *s03)r)rr rpopulated_user_idss ` r_pre_existing_user_idsr s+!***! 1 11r _MAX_REPORTED_UNKNOWN_USER_IDSc H|jtjtjjfvryt fd|D}|sydj |dt }t|t z }tdddj||dkDrd|d nd i ) zRestrict adding a caller-chosen user_id that has no user row yet to proxy admins. Team and org admins keep the ability to add users that already exist and to invite new ones by user_email, where the user_id is allocated server-side. Nc3nK|],}|j|jvs|j.ywrr )rr!rs rrz8_validate_member_user_id_provisioning..4 s/$!0Jv~~evOv$s 555z, rrzOnly proxy admins can add a user_id that does not exist yet: {}{}. Add the member by user_email to invite a new user, or ask a proxy admin to create the user first.rz and z morerArS) rVr0rWrrjoinrrrr)rrrunknown_user_idslisted remainings ` r%_validate_member_user_id_provisioningr$ s""$$$$**' #$%,$ II./N0NOPF+,/MMI  ,,2F6W`cdWdU9+U;Sjl,m    rc<tdtd|DiS)zSerialize a team's member list for an audit-log value. The audit-log columns hold a JSON object, so the member list is nested under a key rather than serialized as a top-level array. rc3<K|]}|jywr)rrs rrz'_members_audit_value..P s'R(9(9(;'Rs)rr)rs r_members_audit_valuerH s&  %'R''R"R  rbefore_members after_membersc  Kddlm t fd|D} |ddtjt |t |}t jg||d{y7w)zRecord the membership change, and any user row it created, in the audit log. The entries are written concurrently so a request adding many members does not pay for them one after another. r)create_object_audit_logc3K|]_}|jQ|jvrC|jddtjdt|j dayw)Nr?TrrErFrrr rrH after_value)rr/USER_TABLE_NAMErr)rrr rr rs rrz5_create_team_member_add_audit_logs..e sm (  << # ofnnM]]~  $)?&}5@@F,=,=}!UVA    M -55!6#4#45! 6   j>3~CVYZCZ@ARAR@SSst '.. ~~!f&7&7&?"*="9"E"EYX^XfXfLg"E"hh  M'11 MW F  (isJA#I%H7&C0IH:+IH<BIH>I:I<I>Irc Kddlm}m}m}m}m} t |||t|jtt|}t|j||d|ddd{}|tdd d t|d di tj |j#} t%|| t'|| |d{t)|j*t,rt/|j*n |j*f} t1d| D} t3| |d{} t5| | |t/| j6} t)|j*t8r t;|j*|d{n@t)|j*t,r&|j*D]}t;||d{t=| | | }t?|| |||d{\}}}tA| tC|j||| t/| j6||d{tEj i|j#||dS#t$r}|d}~wwxYw777Q7777Pw)a Add new members (either via user_email or user_id) to a team If user doesn't exist, new user row will also be added to User Table Only proxy_admin or admin of team, allowed to access this endpoint. ``` curl -X POST 'http://0.0.0.0:4000/team/member_add' -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' -d '{"team_id": "45e3e396-ee08-4a61-a88e-16b3ce7e0849", "member": {"role": "user", "user_id": "krrish247652@berri.ai"}}' ``` r)r rr$rJrI)r$rlrNFTrr$rIparent_otel_spanrJcheck_cache_only check_db_onlyrrzTeam not found for team_id=rrS)rlrx)rr;rlc3NK|]}|j|jywrr rs rrz"team_member_add..7 s (vF[a[i[i[u(vr)rr$)rrr)r!r$)rr rr:)rrrrrrr )rr)#rLr rr$rJrIrrrbrrrsrPrrr,rMrrrr_r!rrrr rrr1r3rr\rr(r<)rlrr rr$rJrIrvrxr;rr rmembers_before_addrpre_existing_user_idsrrrs rteam_member_addr< s4#'% T112}5M%4 #-+&  :74TX;Y:Z[\  !2 @ @ARA]A]A_ `% , 0+-   6@ T5RuT[[1Y]YdYdXf((vFW(vv%F!#& *!++ !&&8&K&K L$++v&5;;'    DKK & A9+    $:!!9+$( -#+!9    01 , #/).AAB+!9  ! / / %%' *(@  y  .    sJI$AJ$I7%A$J I: A"J,I=-AJJ >JJ'J/J0AJ5J6.J$ I4-I//I44J:J=JJJJJc|jduxr)|jduxr|j|jk(xs9|jduxr)|jduxr|j|jk(Srr)r!rls r_is_member_addressed_byr>w sl LL $ ft)C f X^XfXfHf  t#n(9(9(En$//]c]n]nJnr.ctfd|jD}|jDcgc]}t|r|}}||fScc}w)a_Split a team's members_with_roles into the entries the request addresses and the ones that stay. The addressed entries are returned rather than a bare found/not-found flag because they carry the user_id the request may not have supplied, and every cleanup that keys off the user rather than off the roster has to run against that id. c3<K|]}t|s|ywr)r>)rrrls rrz._cleanup_members_with_roles.. s"(;RSTVZ;[(r)rrr>)rxrlremoved_team_membersrnew_team_memberss ` r_cleanup_members_with_rolesrC} s]#(($77(#+<*N*NwQVmnoquVvqww !1 11xs A A /team/member_deletec R Kddlm}|tdddi|jtddd i|j|j tddd it |jd |ji d{}|tddd |jditj|j}|jtjjk7rKt||s>t!||d{s)tdddj#d|ji|j%4d{}|j't(|jd{t+|j-||jd{}|tddd |jdit/t|j||\}}|stdddi||_|D cgc]} | j} } t3d|D} | rddt5| iin d|j i} |} | j6j9| d{}| j;|j |jfndd|D}| j<j9dt5|i|jd d{}t?|jAd |jidtCjD| id{|D]x}|j|jFvs|j6jAd|jidd |jFDcgc]}||jk7s|c}iid{zt5|D]3}|jHjK|j|d! d{5|rY|rdd"l&m'}||||d|#d{|j<jKdt5|i|jd d{dddd{tQ||S77X777cc} w777Ucc}w7777I7;#1d{7swYKxYww)$a [BETA] delete members (either via user_email or user_id) from a team If user doesn't exist, an exception will be raised ``` curl -X POST 'http://0.0.0.0:8000/team/member_delete' -H 'Authorization: Bearer sk-1234' -H 'Content-Type: application/json' -d '{ "team_id": "45e3e396-ee08-4a61-a88e-16b3ce7e0849", "user_id": "krrish247652@berri.ai" }' ``` rr&Nr rr rSrr2Either user_id or user_email needs to be passed inrrTeam id= does not exist in dbrRrrrD)rr)rxrlzUser not found in teamc3NK|]}|j|jywrr rrs rrz%team_member_delete.. s +m!WXW`W`WlAII+mrrrrrc3NK|]}|js|jywrr rs rrz%team_member_delete.. s IdDLLT\\ Irrrrrrr)rr$_persist_deleted_verification_tokens)keysr$rrr)))rLr$rrrrr'rr,rMrrVr0rWrr\r[rr)rrer~rrCrrrrrunionrr+rrrTrr delete_many;litellm.proxy.management_endpoints.key_management_endpointsrNr)rlrr$_existing_team_rowrxr) fresh_membersrArBr_db_new_team_membersremoved_user_idsr+ member_txexisting_user_rowsuser_ids_to_deletekeys_to_delete existing_userr_uidrNs rteam_member_deleter] s:9W>O4PQQ ||W>T4UVV || 7QR  '/}&=&I&IQZ\`\h\hPi&I&j j!x ~5JKL   1??@R@]@]@_` ##'7'C'C'I'II#6GRcd1DU`qrrrell)+<+D+D  $!QQRll14<<@@@%3M%B%`%`aceieqeq%rr  8DLL>9N!OP  2M/ Yfg2 .. $CBZ8[\ \/?,K[2\a1<<>2\2\#,+m?S+m"m=MYv&678 9T`bfbqbqSr -/ *3*E*E*O*OV]*O*^$^%5$:$:#||7T\\OR I&8 I% '0&I&I&S&S &);"<=<<'T' ! "o$$dll+& 3G(HI%   0 M||}222**11$m&;&;<!E]=P=P+iTTX\`\h\hThD+i#jk2 -. jD++77$,,cg>h7i i i j ;'"/&7'+ ..:: $f-?&@A#||;  YQQf/0 o!ks(Q@r"3]%_!  ,j j YQQQQs9BR'Q&B R'Q)AR'Q,R'$R;Q/<,R(Q2)A$R Q5$AR8Q:9A-R&Q='AR+R,!R2RRR R&R'AR'R ( RR  ;RRR R'RR')R',R'/R2R5R=RRR R RRR'R$R R$ R'rrzryrr)rrzryrr_MEMBER_BUDGET_PATCH_FIELDSc|jd}tjDcic]\}}||vr|||c}}Scc}}w)zMap the budget fields the request actually set (merge-patch: a sent value updates, an explicit null clears, an absent field is left untouched) to their budget-table columns.Tr)rr^r)rlprovided request_fieldcolumns r_build_member_budget_patchrc< sVooDo9H&A%F%F%H  !M6 H $ ''  sAz/team/member_updatec Kddlm}m}m}|t dddi|j t ddd i|j d k(r|s t dd |j|jt ddd it|jt|jd |j id{}|t ddd|j ditj|j}|j t"j$j&k7rKt)||s>t+||d{s)t dddj-d|j it/||j d|d{}|d} d} |j |j} nT|jH|dj0D]6} | j| j|jk(s*| j} n| t ddd|id} |dD]} | j| k(s| j2} nd}| j4-| j4j7d}t9|t:r|}t=|}|j?4d{}tA||j | | |||d{dddd{|r tC| |j |d{|j g}| j0D]l} | j| k(rJ|jEtG| j|j |jxs | j\|jE| n|| _|Dcgc]}|j}}t|jId |j idtKjL|id{tO|j | |j|jP|jR|jT|j|jVS777777#1d{7swYxYw7xcc}w7w) zE [BETA] Update team member budgets and team member role r)rr$rINr rr rSrrr"a Assigning team admins is a premium feature. You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/#trial. Pricing: https://www.litellm.ai/#pricingrFrrrGrHrRrrrD)rr key_limitr team_infoz*User id doesn't exist in team table. Data=rr])r)rrexisting_budget_idr budget_patchteam_default_budget_id)rrrI)rr#rrr)rrrrrzryrr),rLrr$rIrrr#rrrbrr'rr,rMrrVr0rWrr\r[rrfrrrr{r_rrcr)r`rRrr1rrrTrCrrzryr)rlrrrr$rIrSrxreturned_team_inforLreceived_user_idr!identified_budget_idrriraw_default_budget_idrhr)rrrs rteam_member_updaternH s"[ZW>O4PQQ ||W>T4UVV yyGL`   || 7QR  T112&.}&=&I&IQZ\`\h\hPi&I&j j!x ~5JKL   1??@R@]@]@_` ##'7'C'C'I'II#6GRcd1DU`qrrrell)+<+D+D  ?H! + ?9+;7J$( ||<<  $(5HH F  ,1B1Bdoo1U#)>>   I$PQ  (, !34 ::) )#%<< *.&'1':':'>'>?V'W +S 1%: "5T:L!   R+LL$3/%#9      0$LL1    yy,.  33 ,F~~!11## &!YY#'??#Gf6G6G##F+ ,)5 %GS.T!q||~.T.T}%,,dll+& 3C(DE-   $  ??22....,,**  W!ks9T         ./U sB;Q:=Q>B Q:Q  A Q:QAQ:"Q:<= 0z reset_to (z) must be <= current spend (rz) must be <= budget () r_rrrprHTTP_400_BAD_REQUESTrMrNspendrr)rurvreset_to_float current_spendrs r'_validate_team_member_reset_spend_valuer} s he - !XY!(ON == (NQ,> !ef%++2sM %  ' '((D]OST U GQFeFe 77BBkoJ.:"=  ' '((=j\ K rz,/team/{team_id}/member/{user_id}/reset_spendcKddlm}m}m}|t t j dt|||d|dd{}t||d{t||d ||d i}t|j|d di d{} | !t t jd |d|dtj| j} | j xsd} t#|j$| } t|j'|d| id{t)|||| d{||| | | j*r| j*j,dSddS7)777O7:w)a Reset a team member's tracked spend against their per-member budget. A member's spend is tracked separately from both their own personal budget and the team's own budget (LiteLLM_TeamMembership.spend), so neither /user/update nor /team/update can clear it: this is the only endpoint that does. The cross-pod spend counter and cached membership reads are invalidated so the reset takes effect on the member's next request rather than waiting on the membership cache's TTL. rr$rJrINz'DB not connected. prisma_client is NoneT)rr$rIr6rJr8rYrquser_id_team_idrLrrzUser z is not a member of team rrxrzr)rrrI new_spend)rrrzprevious_spendr)rLr$rJrIrprHTTP_500_INTERNAL_SERVER_ERRORrPrZrrr-rHTTP_404_NOT_FOUNDr+rMrrzr}rurrRrr) rrrlrr$rJrIrPmembership_where_membership_rowrvr|rus rreset_team_member_spend_fnrs,`_ !F!FHqr+#-+ H xCT UUU"7FWX w7C$7}#E#Q#Q'.$R$O !:!:eG9LefmennoX>X>Z[J%++2sM=dmmZXH m , 3 3x  4  --  'DNDcDcj55@@   jn  KV  sX;E2E&E2E)9E2 E, BE2E.E25E061E2)E2,E2.E20E2responsec g}|D]}d}|jD]_}|jr|j|jk(s'|js5|j|jk(sO|j}nd}|jD]:}|js|j|jk(s*|j}n|j t |j|jd|||S)zS Convert TeamAddMemberResponse into individual TeamMemberAddResult objects NT)rrsuccessrupdated_team_membership)rrrrrrr)rrresultsr!rrrrs r_create_results_from_responser]s13G  ** D4<<6>>#A!!doo9J9J&J#0   #'33 B~~"**">*,--/'   !,,)(?   # 6 Nrz/team/bulk_member_addc Kddlm}ddlm}|#t dd|j j i|jr|jtjj k7rt ddd it|jd d i d{}|Dcgc]$}t|j|jd &c}|_|j st dddid}t#|j |kDrt ddd|di t%t'|j(|j |j*|d{}t-|j |}t/|j(|t#|j t#|d|j1S7cc}w7g#t2$r} t5j6| t9| } |j D cgc]%} t;| j| jd| 'ncc} w}} t/|j(|t#|j dt#|j dcYd} ~ Sd} ~ wwxYww)a" Bulk add multiple members to a team at once. This endpoint reuses the same logic as /team/member_add but provides a bulk-friendly response format. Parameters: - team_id: str - The ID of the team to add members to - members: List[Member] - List of members to add to the team - all_users: Optional[bool] - Flag to add all users on Proxy to the team - max_budget_in_team: Optional[float] - Maximum budget allocated to each user within the team Returns: - results: List of individual member addition results - total_requested: Total number of members requested for addition - successful_additions: Number of successful additions - failed_additions: Number of failed additions - updated_team: The updated team object Example request: ```bash curl --location 'http://0.0.0.0:4000/team/bulk_member_add' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "team_id": "team-1234", "members": [ { "user_id": "user1", "role": "user" }, { "user_email": "user2@example.com", "role": "admin" } ], "max_budget_in_team": 100.0 }' ``` r)r"r&Nr rrSrzb`all_users=true` is restricted to PROXY_ADMIN. Org/team admins must specify explicit member lists. created_atdesc)rr)rrr#rzAt least one member is requiredzMaximum z members can be added at once)rr!rrlr)rrtotal_requestedsuccessful_additionsfailed_additionsrF)rrrr)rur"rLr$rrr all_usersrVr0rWr/rr1rrrrr<r@rrrrrrCr exceptionrr) rlrr"r$all_users_in_dbrMAX_BATCH_SIZErrrv error_messager!s rbulk_team_member_addrskd78.EEKKL   ~~  & &*:*F*F*L*L LN (0 '>'H'HP\^dOe'H'f!f(    ??    <<>?   N 4<<>)x'77TUV  , /% ||#'#:#: 0 !  0 hG(LL -!$W!,,.   M"g 2 *  &&q)"1v ,,  !,,#     )LL -!" .    suBI4F3I4)F6AI4:F=F;AF=2I46I4;F== I1.I,4*HAI,&I1'I4,I11I4z /team/deletecKddlm}m}ddlm}m}m}m} m} |tdddi|jtd dd ig} |jD]z} t|jd | i d{} | t tj| j!}t#||d{| j%||t'| |||d{|r|jD]} |j)| ddd{}|"|j+d}t-j.|t1t3t5j6t9j:t<j>|||||j@tBjD| dd| ddl#m$}tK|jMd d|jii d{}|r|||||d{|jO|jdd{tQ|| | d{dd!l)m*}dd"lm+}||j||#d{| D]w}|jX}g}|D]H}|j%t[t]|j^|j`|jb$|%Jt-jd|d{ytg|j|&d{d d|jii}|ji4d{}tk|jD] } |jmtn| d{"|jpjs| d{tu|j|'d{dddd{d(|ji}tw| | | )d{| D]!}ty||j^*d{#|S7#t$rtd dd| iwxYw7q7J77E727777`7B77777#1d{7swYxYw77jw)+a delete team and associated team keys Parameters: - team_ids: List[str] - Required. List of team IDs to delete. Example: ["team-1234", "team-5678"] ``` curl --location 'http://0.0.0.0:4000/team/delete' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data-raw '{ "team_ids": ["8d916b1c-510d-4894-a334-1c16a93344f5"] }' ``` rr)r r r$rJrINr rr rSrrrrrrrY)rr$rrrrrTrr>deletedz{}r@rIrMr)rOr$rrrb) team_id_listrrOrIrJ)delete_team_models)r)rr$r)rrrr)rr$)rr)r)rrIrJr)=rKrrrLr r r$rJrIrrr'rrCr,rMrrZr_persist_deleted_team_recordsrQrr]r^r$rrrwrr_rr`rar/rbrRrNr>r delete_data_invalidate_deleted_key_cache=litellm.proxy.management_endpoints.model_management_endpointsrrrr]rArrrr%_sweep_deleted_team_referencesr)rrrer rQ!_sweep_deleted_team_references_tx_invalidate_deleted_team_cacheri)rlrrrrrr r r$rJrI team_rowsr team_row_baseteam_row_pydanticrH _team_rowrNrZrrrtasks team_member delete_filterr)r deleted_teams r delete_teamrs4W>O4PQQ }}W>T4UVV13I==, 4<]4K4W4W_hjq^r4W4s.sM$%.<<]=U=U=WX"&/   *+%,( (#+-   !}} G7D7M7MF}8N82H 4 8I   +!2tzz|,#+<< #=#;/A.?5M$ ,=+D+D#4#D#D")('+%."  D#-]";"E"EYY]_c_l_lXmLn"E"ooN2'/1      # #5 # QQQ ' -+ 6 # %22 ' K LL"0 ( 0 0 + 3 3#.#9#9 '8   nne$$$!%$ )$--} ]]].7t}}8M,NM!OORdmm, @G,,5w? ? ? @""..].CCC/2NNN OO 2A$--0PM )-+  "k /mUaUiUijjjk m/t #B7)!LM   2Jp R. %]O ?CN OOOO ks|AQ+ P 7P8 P 4Q+8P)9)Q+"P,#1Q+P/CQ+-P2.Q+P5$Q+(P8)Q+>P;?(Q+'P>(A9Q+!Q" Q+Q(Q++Q,Q+/2Q!Q "%QQ Q&Q'Q+ Q+6Q7#Q+Q'#Q+>Q)?Q+P  P&&Q+,Q+/Q+2Q+5Q+8Q+;Q+>Q+Q+Q+Q+ Q QQQ+Q$Q Q$ Q+)Q+cK|D]*}|jjt|d{},t|j t dt |id{}y7?7w)ai Strip the deleted team ids from every user row and team-membership row that still references them. The per-member `team_member_delete` pass above only reaches users listed in the team's `members_with_roles`, so a user row that outlived its roster entry is invisible to it and keeps surfacing the team on `/user/info` after the team is gone. #36839 closed the route that created that drift, by resolving member removal off the roster entry's `user_id` rather than the identifier the caller happened to pass. It does not backfill rows that already drifted, which is the state this was reported against, so the sweep still has to run on delete. `array_remove` rather than read-filter-write: rewriting the whole array from a snapshot read outside a transaction drops any team a concurrent `/team/member_add` appended in between. Nr)rr)r[rr!r-rQrr)rr$r_s rrrso \""../QSZ[ [\"-0<. s6#CII6s) hashed_tokensrIrJN)rLrrs rrrs. #666-+  ",*,c\Ktjfd|Dd{}y7w)Nc3dK|]'}t|j|j)yw))rrrIrJN)rMrr)rrrJrIs rrz1_invalidate_deleted_team_cache..s9  % ??#5"3    s-0)r]r%)rrIrJrs `` rrrs0 nn    A s ,*,c |sgStjtj}g}|D]}|j }t j i|||j|j|d}|j }dD](} | |vs|| tj|| || <*dD]} |j| d|j||S)z@Transform teams into deleted team records ready for persistence.) deleted_at deleted_bydeleted_by_api_keyr)rr model_spendmodel_max_budgetr7N)r"rUrArXr) rr_rr`rr%rMrrarrTrar) rrrrrecordsr team_payloaddeleted_recordrecord json_fieldrel_keys r#_transform_teams_to_deleted_recordsr$s   X\\2JG ( 1@@  (/77&7&?&?&8    **,  DJV#z(:(F%)ZZz0B%Cz" D  &G JJw % & vA D Nrrc\K|syt|j|d{y7w)z*Save deleted team records to the database.Nr~)r9rrr$s r_save_deleted_team_recordsrTs*  = ) 5 57 5 CCCrcVKt|||}t||d{y7w)z=Persist deleted team records by transforming and saving them.)rrrrN)rr)rr$rrrs rrr^s59+-G %# s )')rLcK|jtjjk(s'|jtjjk(ry|j |j k(ry|j R|j )tddd|j d|j itddd|j di|j |jDcgc]}|j c}vryt||d{rytddd |j d|j icc}w73w) NrrzTeam key for team=z$ not authorized to access this team=rSz+API key not authorized to access this team=z1. No user_id or team_id associated with this key.rRzUser=) rVr0rWrPROXY_ADMIN_VIEW_ONLYrrrrr[)rrLrs rvalidate_membershiprpsn##'7'C'C'I'II  & &*:*P*P*V*V V  J$6$66  (  $ $ 012C2K2K1LLpq{rDrDqEF  J:K]K]J^_PQ   8U8U$V1QYY$VV);LWa bbb 5!2!:!: ;;_`j`r`r_stu %WcsC!E#D:6E D? 4Er]team_info_response_objectcK t|jd|id{}|jd|iS7#t$rt j d|Y|SwxYww)Nrrr~rzCTeam member budget table not found, passed team_member_budget_id=%s)r7rrrCrr)r]r$r team_budgets r_add_team_member_budget_tablersx  #-m#<#H#HP[]rOs#H#tt (33.s&'qa!,,[\[d[d[p 'qs 2 22rrrNc3K|]M}|js;|j/|jvr!|jd|jin|Oyw)Nrr)rrr)rremail_by_user_ids rrz)_hydrate_member_emails..s[ || 5!))GW:W \+;AII+FG H  sAA)rrr/rrrrr)r$rmissing_user_ids user_rowsurs @r_hydrate_member_emailsrs('q7'qq W~HPQ^H_HiHi f-. IjICI/QZ/kA^_^j^j 1<<0G/kl   C0ls*A B)B" B)B$.B$B)$B) _team_infoc NK|js|St|jd{tfdtj |jD}|j t |Dchc]}|jxsgD]}|c}}t |Dchc]}|jxsgD]}|c}}t |Dchc]}|jxsgD]}|c}}td|DdS7cc}}wcc}}wcc}}ww)zReturn a copy of the team info with access_group_models / mcp_server_ids / agent_ids / details resolved from its access groups.Nc32K|]}|vs|ywrrrag_id ag_lookups rrz7_resolve_team_access_group_resources..s$#"TY]fTf %#  c 3K|]=}t|j|jt|jxsd?yw)r)access_group_idaccess_group_namerN)r;rrraccess_model_names)rgroups rrz7_resolve_team_access_group_resources..sI*  *$)$9$9&+&=&= !9!9!?R@*sAA)access_group_modelsaccess_group_mcp_server_idsaccess_group_agent_idsaccess_group_detailsr) access_group_ids%_batch_resolve_access_group_resourcesrrfromkeysrrraccess_mcp_server_idsaccess_agent_ids)rresolved_groupsrrsars @r$_resolve_team_access_group_resourcesrs!  & &B:C^C^__I"#&*mmJ4O4O&P#O  #'(ruRWRjRjRpnp(rA(r(r#s+/ /]u%:U:U:[Y[]A]],'+?+s%UZUkUkUqoq+sqA+sA+s&t$)* - *%   !  ` )s]+ss:'D%DA D%5DD%$DD%D1!D%D%z /team/infoz!Team ID in the request parameters)r=rz!Limit the number of keys returned)r=rgtrec .Kddlm}ddlm} |t t j ddi|t t jdd i t|jd |id d d  d{}|t t|tj|jd{|j!|ddt#j$|d{}|g}|d}|D]} |t'| ddz }d|i}|D]%} | j} | j+dd't-||gdd{} t/|t(r|j|} n8t/|t0r!|j|j} n|} | j2| j2j5dnd} | t7| || d{} t9| d{}t;||j<d{}|j?dtA|i}tC|||| }|S7#t$r"t t jdd|diwxYw77#t$r| j)} YzwxYw7X777#t$r}tEjFd|tIjJt/|trPtMt'|dd|d tNjPt'|d!d"t'|d#t jR$t/|tLr|tMd%tU|ztNjPt'|d!d"t jR$d}~wwxYww)&a# get info on team + related keys Parameters: - team_id: str - Required. The unique identifier of the team to get info on. ``` curl --location 'http://localhost:4000/team/info?team_id=your_team_id_here' --header 'Authorization: Bearer your_api_key_here' ``` r)r>r&NrDatabase not connected. Connect a database to your proxy - https://docs.litellm.ai/docs/simple_proxy#managing-auth---virtual-keysrSrz(Malformed request. No team id passed in.rTrrz Team not found, passed team id: r)rrLrbr*)rrrexpireslimitrzrr r])r]r$r)r$rrr)rrfrOrz\litellm.proxy.management_endpoints.team_endpoints.py::team_info - Exception occurred - %s %srUzAuthentication Error(rrNonerTrzAuthentication Error, )+rur>rLr$rrrHTTP_422_UNPROCESSABLE_ENTITYr'rrCrrr,rMrrQrr_rrrarr_rrr{rrrrrrr=rr traceback format_excr6r5 auth_errorryr)rrrerr>r$rfrOrzkrbrrr]resolved_team_infohydrated_membershydrated_team_inforesponse_objectrvs rrfrfs&E8|  "AAa  ?"@@!#MN  080G0S0S '*044P1T1+I !"/(77 8L8L8NO   #++!LLN ,   <D  E 0GQ// 0 %(I #C !nn& GGGT "  #$ *G,s1v5 ++!Wf-,,    s N>J'$I 3I4 I 2J'2I83/J'"I;#,J'I> &J'JBJ'"J!#J'5J#6J'J%1J'NI +I55J';J'>JJ'JJ'!J'#J'%J'' N0CN  NNz/team/{team_id}/members/mec LKddlm}m}|ttj ddi|j }|ttjddit|||d{}|j}d}|jD]J} | j | j |k(s | j+|.| j|k(s>| j}n|$ttjdd |d |d it|||| d{} t|||d d{} | t| ddnd} | t!|||j"|| dddd St!|||j"|| | j$| j&| j(| j* S7777w)u Get the caller's own team-membership row for the given team. Used by internal users to view their own spend, budget, budget reset date, rate limits, and role within a team — without exposing other members' data. The caller is resolved from their API key; the path `/members/me` always refers to that caller. Returns 404 if the caller is not a member of the team. ``` curl --location 'http://localhost:4000/team/your_team_id/members/me' --header 'Authorization: Bearer your_api_key_here' ``` r)r$rINrrrSzKAPI key has no associated user_id; cannot resolve 'me' for team membership.)rr$rIz User user_id=z is not a member of team_id=r)rrr$rIFrrrx) rrrr#rrz total_spendrr)rLr$rIrrrrryrPrrr#rrOrQrrrrzrrr) rrrr$rIrrLcaller_user_email member_rolerrvuser_rowrs rteam_member_mer}s 6M==]  .55N33jk  .#-J 1;;"K  * * II !aii>&A LL $):)F1<<[lKl&&K 11}^,<t||nMN  "11-2J2J2LM+  #=188$,,' 9F M%f 6>CC ACC1CCCCCz /team/unblockcKddlm}| tdt|j d|j id{}|t ddd |j i ttj|j| d{t|jd|j id d id{}|S77:7 w)a Unblocks a previously blocked team, re-enabling calls from keys with this team id. Parameters: - team_id: str - Required. The unique identifier of the team to unblock. Example: ``` curl --location 'http://0.0.0.0:4000/team/unblock' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "team_id": "team-1234" }' ``` rr&Nr rrrrrrSrYr Frr r s r unblock_teamr&s.9*++!)-!8!D!DIW[WcWcKd!D!eeM>t||nMN  "11-2J2J2LM+  #=188$,,' 9F M%f rz/team/metadata_schemacFKttjSw)a[ Get the team metadata fields declared in ``general_settings.team_metadata_schema``. The UI uses this to prepopulate the team metadata form with the declared keys. Returns an empty ``fields`` list when no schema is configured. This schema is advisory; server-side enforcement stays with ``custom_team_metadata_validate``. )fields)rrnr{rrrget_team_metadata_schemarWs &-J-N-N-P QQs!z/team/availablecKddlm}|'tddtjj it ttdztjtjjdnd}|gSt|jd|jid{}|td dd itj |j#}|Dcgc]}||j$vs|}}t'|j)d d |iid{}|Dcgc]%}t+j |j#'} }| S7cc}w7=cc}ww) Nrr&rrrSrrrrzUser not foundrr)rLr$rr"rrrrrrrr{r/rrr.rMrrr'rr,) rrrr$r user_infouser_info_correct_typeravailable_teams_dbavailable_teams_correct_types rlist_available_teamsrisp 9.EEKKL   S D33?  0 0 4 45F G O &m4@@ SdSlSlGm@nnI-.  %6$D$DYEYEYE[$\(7d4G]GcGc;ctdOd&.}&=&G&Gy[_apZqNr&G&s sdv#w\`$5$D$DT__EV$W#w #w ''oe s#wsHB'E')E*$E'"E #E'+*E"E'E'"E'c.K t|||d|d{}|y|jxsgDcgc]A}|jtj j k(r|j |jC}}|r|SdS7g#t$rYywxYwcc}ww)z Return the list of organization IDs where the user is an org admin. Returns None if the user is not an org admin of any organization or if the user cannot be found. Frr$rIrrJN)rQrorganization_membershipsrVr0rrr)rr$rIrJ caller_userrorg_idss r_get_org_admin_org_idsr!s #2'1 / $  66<" ;;*44:: :q?P?P?\ G 7'4''  sCBBA?BBAB7B?B B  B B  Bexactruse_deleted_tablesearchsearch_team_id_matchorg_admin_org_idsc Ki} |r|| d<|r|dd| d<|r|dk(rdd|iind|id|ddig| d<|r|| d<n |d |i| d<|rl t||| d | d {} | td dd|i| jxsg} |r d|i| d<| S| sy ||| vrtd dd|i| Sd | i| d<| S7Y#t$rtd dd|iwxYww)z Build where conditions for team list query. Returns None when the query is guaranteed to yield no results (e.g. user has no team memberships), allowing the caller to skip the DB round-trip. rr,containsr.rprefix startsWithORrNrFrrrzUser not found, passed user_id=rShasrz User is not a member of team_id=)rQrrr)r$rrrrr#r$r%r&rIrJwhere_conditionsuser_object_correct_type user_team_idss r!_build_team_list_where_conditionsr1s&24&-#"!* & 4HH4Ti,/ 0[dflZm  F G"  .=*+  &/35F.G*+ 4C+#5$"3 5/ $ $ +#B7)!LM  8==C +0'*: Y '$ !$-/'$' '+KG9)UV 04].C + M/ #B7)!LM  s1ACB4B2B4AC2B44CCall_access_group_idsz1dict[str, prisma_models.LiteLLM_AccessGroupTable]cKddlm}|r|iStt|}t |j dd|iid{}|Dcic]}|j |c}S7cc}ww)z Batch-fetch access groups in a single DB query and return them keyed by access_group_id. Missing/invalid groups are silently omitted. rr&Nrrr)rLr$rrr<rr)r2_prisma_client unique_idsrrows rrr s~K >#9 i(<=>J(8BB 4"45CD15 5C   $ 55 6s$AA,A%A,A'"A,'A,keys_count_by_teamc g}|xsi}|D]} |j}|r%|jt j |;|j d}t|tsg}||d<t|}|j |j dxsdd} |jtdi||| d|S#t$r|j}YwxYw)z0Convert raw Prisma team rows to response models.rrrAr) members_count keys_countr) rrCrrr%rMr{r_rrr) rr#r7 team_listcountsr team_dictrr9r:s r!_convert_teams_to_response_modelsr>s []I&,"F $)I    5DDYO P!*/C!D 0$7%'"2D ./ 23MIMM)$<$BAFJ   "/) , ' $ I $sCCCc rK|Dcgc]}t|ddst|dd}}|siStdt|jdgdd|iiddid{}|Dcic]:}|j ds|d|j dij dd<c}Scc}w7Scc}ww) a6Aggregate virtual-key counts per team for the given page of teams. Runs a single GROUP BY against LiteLLM_VerificationToken. The IN clause is bounded by page_size and uses the existing @@index([team_id]), so this is one DB round-trip per page. Returns an empty map when the page has no teams. rNzSequence[_TeamIdGroupRow]rT)byrrOrr)rrr>group_byr{)r$rt page_team_idsgroupedr6s r_get_keys_count_by_teamrE?sBGfA'RSU^`dJeGAy$7fMf  #'00{t]34d#1  GPW mZ]ZaZabkZlC NCGGHb155iC C mmg  ns8B7B+B+3B7B0  B7)B2(B2( B72B7cKt|}d}|r||fS|jr!t|j|||d{}|N|r||vrtdddi|||jk(rd}t j d|j||||fSt ||std dd |ji| |j}||fS7w) aEnforce access control for list_team_v2. - Proxy admins and admin viewers can query any teams. - Org admins can query teams within their organizations. - Regular users can only query their own teams. Returns the (possibly overridden) user_id and org_admin_org_ids. N)rr$rIrJrrz2You can only view teams within your organizations.rSzIlist_team_v2: org admin access for user=%s, org_ids=%s, user_id_filter=%s)rrequested_user_idAOnly admin users can query all teams/other teams. Your user role=)rarr!rrrrJrV)rrrr$rIrJr/r&s r_enforce_list_team_v2_accessrJXs% 11BCN*.)))  "8%--'1/ #  $ 6GG!UV  ?g):)B)BBG"" W  % %    & % %%0BSgno`ara|a|`}~  ?'//G % %%S sColumn to sort by (e.g. 'team_id', 'team_alias', 'created_at')asczSort order ('asc' or 'desc')z!Filter by status (e.g. 'deleted')z`How 'search' matches 'team_id': 'exact' (default) or 'prefix' for a case-sensitive prefix match.page page_sizesort_by sort_orderrc %Kddlm} m}m}| t ddd| it | ||| ||d{\}}| | d k7rt d dd i| d k(}|d z |z}t | |||||||||| d{}|gd||ddSgd}d}| r*| |vr&| jdvrd} | | ji}|rPt| j||||r|nddid{}t| j|d{}nOt| j||||r|nddid{}t| j|d{}| |z }i}|st| |d{}t|||}|s1|Dcgc]"}t|ts|j s!|$}}|r|Dcgc]}|j xsgD]}|}}}t#|d{%|D]}t%%fd|j xsgD} t'| D!"chc]}!|!j(xsgD]}"|"c}"}!|_t'| D!#chc]}!|!j,xsgD]}#|#c}#}!|_t'| D!$chc]}!|!j0xsgD]}$|$c}$}!|_|||||dS77N7777}7acc}wcc}}w7cc}"}!wcc}#}!wcc}$}!ww)aU Get a paginated list of teams with filtering and sorting options. Parameters: user_id: Optional[str] Only return teams which this user belongs to organization_id: Optional[str] Only return teams which belong to this organization team_id: Optional[str] Filter teams by exact team_id match team_alias: Optional[str] Filter teams by partial team_alias match page: int The page number to return page_size: int The number of items per page sort_by: Optional[str] Column to sort by (e.g. 'team_id', 'team_alias', 'created_at') sort_order: str Sort order ('asc' or 'desc') status: Optional[str] Filter by status. Currently supports "deleted" to query deleted teams. rrNr rzNo db connected. prisma client=rS)rrrr$rIrJrrz.Ds$$).X]ajXjIe$$r)rLr$rJrIrrJr1lowerr9rrOr'rEr>r_rrrrrrrrrrr)&rrrrrr$r%rOrPrQrRrrr$rJrIr&r#rr.valid_sort_columnsorder_byr total_countrTr7r;rBteam_items_with_agr all_ag_ids team_item team_groupsrrrrrs& @r list_team_v2r_s| >}oNO  (D+'#-+ ("G f 1[\  &2!8y(D%F#'+1+-+ % "   !HH700    _ 4JZ--/0&}5??"&(\6,B @  -];AAHXAYY }-77"&(\6,B 8  %]399@P9QQ (<945K*, #:=%#PP2%9J_qrI 09$p1Z<=X]^]o]oQ$p$p 0B k1QRQcQcQigi ku k kJ k%J:%VVI/  #$3<3M3M3SQS$ 15$/Z5%:R:R:XVXZAQZQZ1 -9=$/]5%:U:U:[Y[]AQ]Q]9 548$/X5%:P:P:VTVXAQXQX4 0 "  S", B Z RQ%q kV [^Ys3K9KAK9:K;A)K9$K %"K9K,K94K5"K9KK96K7K9K& K3K7 K9KK90K%15K9&K' K9K- 9K9K3 .K9K9 K9K9K9K9K9 K9'K9c:Kt|}d}|sӉduxr|jduxr|jk(}|jt|j||d|d{}|^|jxsgD cgc]A} | jt j jk(r| j | jC}} |sd}||stddd|ji|ztt|jdd |iid d i d{} s t| S| D cgc].} | jr tfd | jDr| 0c} Srhtt|jd d id{} | D cgc].} | jr tfd| jDr| 0c} Sttt|jd d id{S7cc} w7cc} w7cc} w7w)a/ Authorize the /team/list request and return filtered teams. - Proxy admins: all teams (or filtered by user_id if provided). - Org admins: teams from their orgs (scoped to user_id if provided). - Own query (user_id matches caller): teams the user is a member of. - Others: 401. NFrrHrrIrSrrr"Trc3FK|]}|jdk(ywrNr{rrrs rrz._authorize_and_filter_teams...lqquuY/?7/J.l!)rc3FK|]}|jdk(ywrbrcrds rrz._authorize_and_filter_teams..rerf)rarrQrrVr0rrrrrr~rrrri) rrr$rIrJr/allowed_org_ids is_own_queryrr org_teamsrrs ` r_authorize_and_filter_teamsrkZsa11BCN(,O  4  r$5$=$=T$I rN_NgNgkrNr   $ $ 0'6)11+#5$"3 ("K&*BBHb#{{&6&@&@&F&FF1K\K\Kh%%## '&*O  "<`ara|a|`}~ "!-n].K!L!V!V$t_&=>*D1"W"   ? "" &&3.lTXTkTk.l+l    ,^M-J K U U*D1!V!   ! &&3.lTXTkTk.l+l   ,~m'DEOOYnptXuOvvwwe"#$    wsnAH!H"H:AHAHH H,3H .H HH3H 1H:H; HH HHz /team/listc Kddlm}m}m}|'t ddt j jit|||||d{}|Dcgc]}|j} }t|| |d{} g} |D]}g} | D]-} | j|jk(s| j| /tt|jd |ji d{} | jtdi|j!| |d | j)d|Z|t*j,jk(r| Dcgc]}|j.|} }| S| Dcgc]}|j.|k(s|} }| S7Hcc}w7!7#t"$rD}d |jd |j!d|d}t%j&|Yd}~ed}~wwxYwcc}wcc}ww)a ``` curl --location --request GET 'http://0.0.0.0:4000/team/list' --header 'Authorization: Bearer sk-1234' ``` Parameters: - user_id: str - Optional. If passed will only return teams that the user_id is a member of. - organization_id: str - Optional. If passed will only return teams that belong to the organization_id. Pass 'default_organization' to get all teams without organization_id. rrNrrrS)rrr$rIrJr rr)rrOz!Invalid team object for team_id: z. team_object=z. Error: z c$t|ddxsdS)NrrA)r)xs rzlist_team..s'!\2*F*L"r)rbr)rLr$rJrIrr"rrrkrrrrr>rr?rrCrrsortr8DEFAULT_ORGANIZATIONr)rrrrr$rJrIfiltered_responser _team_idsrreturned_responses_team_membershipsrrOrvteam_exceptions r list_teamrws.$ .EEKKL  &A+#-+ & 2CC CIC7 yZabbK79!:< -BzzT\\)!((, - j7AATXT`T`HaAbbc   % %&oo'%6 0 LM" <QQWW W3E!f4I]I]Ie$!f !f 4F!q4I]I]apIp$!q !q Y Dbc !B4<<.P^_c_n_n_p^qr3 N ! * *> :   "g!qsAG8 F G8F%G88F9+G8%AG8'F (G81-F8G8G.(G.,G84G3 G3 G8G8G8 G+'9G& G8&G++ G8cK |dz |z}t|jd{}t|j||ddid{}||fS7/7 #t$r$}t j d|gdfcYd}~Sd}~wwxYww)a5 Get paginated list of teams from team table Parameters: prisma_client: PrismaClient - The database client page_size: int - Number of teams per page page: int - Page number (1-based) Returns: Tuple[List[LiteLLM_TeamTable], int] - (list of teams, total count) rNrrN)rrrz0[Non-Blocking] Error getting paginated teams: %sr)r'rOrrCrr)r$rPrOrrZrrvs rget_paginated_teamsrys ax9,#+M#:#@#@#BB &m4>>'?   k!!C &&'Y[\]1u sVB $AA&AAAB AA B %B>B ?B B  B z/team/filter/uir)rrinclude_in_schema responsesz$Team alias in the request parameters2zNumber of items per pagecKddlm}|tdddi |dz |z}i}|r|d d |d <|r|d d |d <t|j |||d did{}|sgS|S7 #t $r} tdd| d} ~ wwxYww)a [PROXY-ADMIN ONLY] Filter teams based on partial match of team_id or team_alias with pagination. Args: user_id (Optional[str]): Partial user ID to search for user_email (Optional[str]): Partial email to search for page (int): Page number for pagination (starts at 1) page_size (int): Number of items per page (max 100) user_api_key_dict (UserAPIKeyAuth): User authentication information Returns: List[LiteLLM_SpendLogs]: Paginated list of matching user records rr&Nr rr rSrr,r(rrrrrUzError searching teams: )rLr$rr'rrC) rrrOrPrr$rr.rrvs r ui_view_teamsrs:9W>O4PQQ!Sax9,79 #%+ Y ' &%. \ * &m4>>"( ?  I   S6MaS4QRRSsGB AA)A'A)$B %A)&B 'A)) B2BBB  new_modelsc|j}|*t|dk(rtjjg}n |j}t t ||z}|S)z8 Add new models to a team's allowed model list. r)rrr9rrrr)rPrcurrent_modelsupdated_modelss radd_new_models_to_teamr]sV__N!c.&9Q&>+<<BBC! ^j%@!ABN rz/team/model/addcKddlm}m}m}|t dddit |j d|ji d{}|t d dd |jitj|j}|jtjjk7r1t|| s$t!|| d{st d ddit#|j$}|j&j)d||jd{t |j+d|jidt-j.t0j2iddid{} | t d dd |jit5| ||d{| S7n777A7w)a  Add models to a team's allowed model list. Only proxy admin or team admin can add models. Parameters: - team_id: str - Required. The team to add models to - models: List[str] - Required. List of models to add to the team Example Request: ``` curl --location 'http://0.0.0.0:4000/team/model/add' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "team_id": "team-1234", "models": ["gpt-4", "claude-2"] }' ``` rrNr rr rSrrrrrRr5Only proxy admin or team admin can modify team modelsaUPDATE "LiteLLM_TeamTable" SET models = ( SELECT ARRAY(SELECT DISTINCT unnest( CASE WHEN cardinality(COALESCE(models, ARRAY[]::text[])) = 0 THEN ARRAY['all-proxy-models']::text[] ELSE models END || $1::text[] ))) WHERE team_id = $2rBrUTrrN)rLr$rJrIrr'rrr,rMrrVr0rWrr\r[rrr[rrrr_rr`rO) rlrrr$rJrIrHrP models_to_addrs rteam_model_addrjs: W>O4PQQ%]3??yRVR^R^F_?``H>t||nMN  (66x7J7J7LMH ##'7'C'C'I'II#6GRZ[1DU`hiiiTU    ,M    & &      (!) 7 > >$,,'HLL6 7$d+!?!L >t||nMN  -+  aj (s]AGF6 B GF9AG%F;&AG;F=<3G/F?0G9G;G=G?Gz/team/model/deletecKddlm}m}m}|t dddit |j d|ji d{}|t d dd |jitj|j}|jtjjk7r1t|| s$t!|| d{st d ddi|j"xsg}|D cgc]} | |j"vs| } } t |j%d|jid| iddid{} | t d dd |jit'| ||d{| S777cc} w7D7w)a Remove models from a team's allowed model list. Only proxy admin or team admin can remove models. Parameters: - team_id: str - Required. The team to remove models from - models: List[str] - Required. List of models to remove from the team Example Request: ``` curl --location 'http://0.0.0.0:4000/team/model/delete' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "team_id": "team-1234", "models": ["gpt-4"] }' ``` rrNr rr rSrrrrrRrrrrUTrrN)rLr$rJrIrr'rrr,rMrrVr0rWrr\r[rrrO) rlrrr$rJrIrHrPrrrrs rteam_model_deleters: W>O4PQQ%]3??yRVR^R^F_?``H>t||nMN  (66x7J7J7LMH ##'7'C'C'I'II#6GRZ[1DU`hiiiTU  ,4??+@bN)7O1!4;;:NQONO!) 7 > >$,,' '$d+!?!L >t||nMN  -+  [ajPs[AF E? B F F'F :FF2F F 3F 8F 9F F F  F z/team/permissions_listc RKddlm}m}m}|t dddit |||d|dd d{}t j|j}t|d rmt|sbt|| sUt|| d{s@t|j| s)t dddjd|ji|j t#j$|_t'||j t#j(S77w)z4 Get the team member permissions for a team rrNr rr rSFTr5rVrRrrrr)rrall_available_permissions)rLr$rJrIrrPr,rMrrrar\r[rrrrrmdefault_team_member_permissionsr)get_all_available_team_member_permissions)rrr$rJrIrxr;s rrr*s= W>O4PQQ&5#-+& !2 @ @ARA]A]A_ ` !;/$%67#6GRde1DU`rsss"&../ ell&&..  0084N4n4n4p1 + 1 I I"<"f"f"h K $ts#1D'D#AD'D%BD'%D'/team/permissions_updatec Kddlm}m}m}|t dddit |j ||d|dd d{}tj|j}t|d rr|jtjjk7rKt|| s>t!|| d{s)t d ddj#d|j it%|j'd|j id|j(id{}|t ddd|j i|S777)w)z7 Update the team member permissions for a team rrNr rr rSFTr5rVrRrrrrrrrr)rLr$rJrIrrPrr,rMrrrVr0rWrr\r[rr'rr) rlrrr$rJrIrxr;rs rupdate_team_member_permissionsrmsm W>O4PQQ&5 #-+& !2 @ @ARA]A]A_ ` !;/  ' '+;+G+G+M+M M#6GRde1DU`rsssell.&..  !) 7 > >$,,'')E)E F!?!L>t||nMN  Q $ts5;ED?A7E5E6A$EE%EEEz/team/permissions_bulk_updatec4Kddlm}|tdddi|jtj j k7rtddd i|jsd dd S|js|jstd dd i|jr|jrtd ddit|j}|jr t||j|d{}nt||d{}d||jdS7)7w)a Append permissions to existing teams. Either pass team_ids to target specific teams, or set apply_to_all_teams=True to update every team. For each team, the provided permissions are merged with the team's existing permissions (duplicates are skipped). rr&Nr rr rSrz2Only proxy admins can bulk-update team permissionszNo permissions provided)r teams_updatedrz4Must provide team_ids or set apply_to_all_teams=truez4Cannot set both apply_to_all_teams=true and team_idsz%Team permissions updated successfully)rrpermissions_appended) rLr$rrVr0rWr permissionsapply_to_all_teamsrr%_append_permissions_to_specific_teams _append_permissions_to_all_teams)rlrr$permissions_to_addrs r#bulk_update_team_member_permissionsrs/&9W>O4PQQ""&6&B&B&H&HHQR    0   " "4==ST   4==ST  !$D$4$4 5 }}CMSWS`S`btuu >}N`aa ;& $ 0 0  vas$C(D*D+D?DDDz)Sequence[prisma_models.LiteLLM_TeamTable]rcKg}|D]L}t|jxsg}||kr"t||z}|j|j|fN|r]|j j }|D]&\}} |jjd|id| i(|jd{t|S7w)zSCompute merged permissions and batch-write updates. Returns count of teams updated.rrrN) rrrrrr[batch_r rcommitr) r$rrupdatesrexistingmergedbatcherr merged_permss r_compute_and_batch_updatesrsG/t339r:  ) #556 f-. /&))002%,  !G\  % % , , '*/> -   nn w< sB.C0C1CcKt|jdd|iid{}|Dchc]}|j}}t||z }|rt dddt |it |||d{S7]cc}w7 w) z2Fetch specific teams by ID and append permissions.rrrNrrzTeam(s) not found: rS)r'rrrrrr)r$rrrr found_ids missing_idss rrrs"-0::4*+;E277 7I7X2K26+3F2GHI  ,M5BTU UU8 Vs,#B BB B=B >B ?B B c Kd}d}d} |ddid}| d|i|d<d|d <t|jd i|d{}|s |S|t|||d{z }|d j}t ||kr |Sv7B7)w) z0Paginated read + batched write across all teams.rNr rrN)rrrrrr)r'rrrr)r$rrr BATCH_SIZE find_argsrs rrrsM FJ '(   #,f"5Ih  !If 7h}-77D)DD   9-Pbccc r"" u: "  + E ds!;BBBB(BBc t|d|iS)z{Single construction site for the `{"error": ...}` detail shape the /team/daily/activity endpoints have always returned.rrSrtrTrs r_daily_activity_errorr6s ['79K LLrcteZdZUeedzed<eedzed<eeeeeffed<eeezdzed<y)_TeamDailyActivityScopeNrexclude_team_idsteam_alias_metadataapi_key_filter)rrrrrrrrrrrrr<sL3i$3i$&&c4V #4455$s)Od**rrrrac K|r|jdnd}d}|r|r|jdnd}t|st|j|d||j|dd{} | t dd|jd | | j }n&|D]!} | | j vst dd | d  i} |rd t|i| d <t|j| d{} | D cic]$} | jdt| ji&}} d}t|s|r| rd}| D]I}tj|j}t!||}t#||d}|rD|rGd}n|sZt%|jd|jid{}|Dcgc]}|j&s|j&}}|sdg}|}|||}t)||||S77 cc} w7Qcc}ww)zResolve which teams the caller may see and whether results must be narrowed to their own API keys. Shared by the paginated and aggregated /team/daily/activity endpoints so both enforce identical permissions.,NFT)rr$rrIr6rJr8rzUser= z not foundrzUser does not belong to Team= z'. Call `/user/info` to see user's teamsrrrrrR/team/daily/activity)rrP permissionrrA)rrrr)splitrarQrr6rrrr'rrrrr,rMrr\r^r>rr)rrrarr$rIrJ team_ids_listexclude_team_ids_listrrwhere_condition team_aliasesrBr user_api_keyshas_full_team_viewrrPis_adminhas_perm user_keysrbfinal_api_key_filters r"_resolve_team_daily_activity_scoperCsZ,4HNN3'M.2?O 0 6 6s ;UY  1 2!0%--' 1.??/"    'C6J[JcJcIddnAop p  %OOM) )//1/$'"@ Ip q /1O&*D,?%@ " ( 7 A A A XXL_k!lZ[!))lJq||%H%HPY[l[t[tOu%H%vvI2;I3syySYYIMI !# 4;# (A, "./+  K 6Y!l< wIsoA#H%G6&AH*AH.G9/H7)G< AH;H>1H/H0H8H HH9H<HHr)rr start_dateend_datec 6Kddlm} m} m} | %t dt j jt||||| | | d{} t| dd| j| j| j|||| j|| d{S7K7w) a Get daily activity for specific teams or all teams. Args: team_ids (Optional[str]): Comma-separated list of team IDs to filter by. If not provided, returns data for all teams. start_date (Optional[str]): Start date for the activity period (YYYY-MM-DD). end_date (Optional[str]): End date for the activity period (YYYY-MM-DD). model (Optional[str]): Filter by model name. api_key (Optional[str]): Filter by API key. page (int): Page number for pagination. page_size (int): Number of items per page. exclude_team_ids (Optional[str]): Comma-separated list of team IDs to exclude. Returns: SpendAnalyticsPaginatedResponse: Paginated response containing daily activity data. rrNr rrrrarr$rIrJlitellm_dailyteamspendr) r$rentity_id_field entity_identity_metadata_fieldexclude_entity_idsrrrrarOrP)rLr$rJrIrr"rrrrdrrrr) rrrrrrarOrPrr$rJrIscopes rget_team_daily_activityrs> #=N=e=e=k=kll;)+#-+E$#+!..#77 11$$     s%AB B ABBBBr_MAX_AGGREGATED_RANGE_DAYScJ||y tj|djtj}tj|djtj}||kry||z j tkDr dtdSy#t $rYywxYw) zThe aggregated endpoint has no pagination to bound its work, so malformed dates and ranges wider than the UI ever requests are rejected before querying.Nz&Please provide start_date and end_datez%Y-%m-%d)tzinfoz6start_date and end_date must be valid YYYY-MM-DD datesz'end_date must be on or after start_datezDate range must be at most z days)rstrptimerErr`rdaysr)rr parsed_start parsed_ends r_aggregated_date_range_errorrsX-7H&// JGOOW_WcWcOd $--h CKKS[S_S_K` L 8\!''*DD,-G,HNN  HGHsA(B B"!B"z/team/daily/activity/aggregatedrclKddlm}m} m} |%t dt j jt||} | t d| t|||||| | d{} t|dd | j| j|||| j| j|d d{S7K7w) a Aggregated daily activity for teams without pagination, including per-team breakdown. One SQL GROUPING SETS pass returns every day in the range regardless of row volume, so callers never reassemble pages. Same response shape as the paginated endpoint with page metadata pinned to a single page. Args: team_ids (Optional[str]): Comma-separated list of team IDs to filter by. If not provided, returns data for all teams. start_date (Optional[str]): Start date for the activity period (YYYY-MM-DD). end_date (Optional[str]): End date for the activity period (YYYY-MM-DD). model (Optional[str]): Filter by model name. api_key (Optional[str]): Filter by API key. exclude_team_ids (Optional[str]): Comma-separated list of team IDs to exclude. timezone (Optional[int]): Timezone offset in minutes from UTC, matching JavaScript's Date.getTimezoneOffset() convention. Returns: SpendAnalyticsPaginatedResponse: Response containing all daily activity data for the range. rrNr rrrrrT) r$rrrrrrrrartimezone_offset_minutesinclude_entity_breakdown)rLr$rJrIrr"rrrrrYrrrr) rrrrrrarrr$rJrI range_errorrs r"get_team_daily_activity_aggregatedrsB #=N=e=e=k=kll5j(KK#[II;)+#-+E/#+!..#77$$ 11 (!%    s%A"B4$B0%AB4+B2,B42B4)rrrr)r)rrr r)F)Nr"NNN)rr)NNNNNrrN)NNNNNNN(Xrr]rrMrcollections.abcrrrrrrtypesrtypingr r r r r rrrfastapirrrrrrpydanticrrtyping_extensionsrrrlitellm._loggingr litellm._uuidrlitellm.integrations.prometheusr*litellm.litellm_core_utils.safe_json_dumpsrrurr r!r"r#r$r%r&r'r(r)r*r+r,r-r.r/r0r1r2r3r4r5r6r7r8r9r:r;r<r=r>r?r@rArBrCrDrErFrGlitellm.proxy.auth.auth_checksrHrIrJrKrLrMrNrOrPrQrRlitellm.proxy.auth.auth_utilsrSrT$litellm.proxy.auth.user_api_key_authrU)litellm.proxy.common_utils.callback_utilsrV+litellm.proxy.common_utils.json_merge_patchrW-litellm.proxy.common_utils.user_api_key_cacherX8litellm.proxy.management_endpoints.common_daily_activityrY/litellm.proxy.management_endpoints.common_utilsrZr[r\r]r^r_r`rarb9litellm.proxy.management_endpoints.organization_endpointsrc;litellm.proxy.management_endpoints.tag_management_endpointsrd7litellm.proxy.management_helpers.access_group_team_syncrerfrgrhri8litellm.proxy.management_helpers.object_permission_utilsrjrkrl>litellm.proxy.management_helpers.team_member_permission_checksrm9litellm.proxy.management_helpers.team_metadata_validationrnro&litellm.proxy.management_helpers.utilsrprqrrlitellm.proxy.utilsrsrtru&litellm.repositories.budget_repositoryrv,litellm.repositories.organization_repositoryrw%litellm.repositories.prisma_protocolsrx'litellm.repositories.table_repositoriesryrzr{r|r}$litellm.repositories.team_repositoryr~$litellm.repositories.user_repositoryr2litellm.repositories.verification_token_repositoryrlitellm.routerr>litellm.types.proxy.management_endpoints.common_daily_activityr7litellm.types.proxy.management_endpoints.team_endpointsrrrrrrrrrrrrprismarr prisma_modelsrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr!r#r'r+r-r/r1r3r5r7r9r<r>rrGrOrZr\rrrrrrrrrrrrrrrpostrwr|rrrrrpatchrrrrrrrrrrrrr\rrr rrrrr(r3r<r>rCr]r^rcrnrrrpr}rrrrrrrrrrrrrrrr{Queryrfrrrrrr!r1rr>rErJr_rkrwryrrrrrrrrrrrrrrrrrrrrrrs  -.'"aaaNN)11<A***********V    CKNI     VUCO>@?"    .  \ " ii f8J'D,< )) >.H6H6"" B M8A686 1(1-((->>**m-A>Sdfn*&~*E $8$ sxs! !"%" )iu)+)+9X%xX hh hb%xb-"E/0Et/LMeM/L4//4c/ 9|d':9?s9/L4//4c/5\D055e57<$.73j7A$&AAA 1lT116g16L4$76