tPj UdZddlZddlZddlZddlmZmZmZddlmZm Z ddl m Z m Z m Z mZddlZddlmZmZmZmZmZmZddlZddlmZddlmZdd ldd lmZmZdd lm Z dd l!m"Z"m#Z#dd l$m%Z%ddl&m'Z'ddl(m)Z)m*Z*m+Z+ddl,m-Z-m.Z.m/Z/m0Z0m1Z1ddl2m3Z3m4Z4m5Z5ddl6m7Z7m8Z8ddl9m:Z:ddl;mm?Z?ddl@mAZAddlBmCZCmDZDmEZEddlFmGZGddlHmIZIddlJmKZKddlLmMZMddlNmOZOmPZPmQZQmRZRddlSmTZTmUZUmVZVeWrddlXmYZZddlXm[Z\dd l!m]Z]dd!l^m_Z_dd"l;m`Z`eZae ebd#< dd'Zc dd(Zd dd)Ze dd*Zf dd+Zg dd,Zh dd-Zid.ejd&dfd/Zkdd0Zld1ejd.emd&ejfd2Znd3dd4d5eod6eodzd$d%d7epd8eodzd&df d9Zqd:eodzd$d%d&dfd;Zrdeteod$d?d@eufdAZv dd"4::<0 )&]]+>DDF 'JC''9$S>)(?y~t4 #'1,!& # ' ~~!dnn8H8V8V8\8\&\  + + 7IMM,Ktd||dd{y7w)zO Helper function to check if a user id already exists in the database. roid)rrrBrNr)rorBs rI_check_duplicate_user_idrs& &#  s  organizationsr?user_api_key_dictc Kddlm}g}|D]N}|j|t|t |t j gtddd| Ptj|d d id {y 7w) z% Add a user to organizations r)organization_member_add)rorole)organization_idmemberhttp /user/newtypepathscope)r_ http_requestrreturn_exceptionsTN) 9litellm.proxy.management_endpoints.organization_endpointsrappendOrganizationMemberAddRequest OrgMemberr|rrasynciogather)rorrBrrtasksrs rI_add_user_to_organizationsrs-/E(  #1$3!$+!1!?!?%#);?#4   $ ..% 84 888sA4A>6A<7A>team_idmax_budget_in_teamr{)rqadminc Kddlm} |t|t|||||d{y7#t$rp}|j dk(r1dt |vs dt |vrtjd |n&tjd ||t |Yd}~yYd}~yd}~wt$r}dt |vs9dt |vs,t|tr3tj|jvrtjd |n#tjd ||t ||Yd}~yd}~wwxYww) Nr)team_member_add)rorr)rrrr_rzalready existsz doesn't existzglitellm.proxy.management_endpoints.internal_user_endpoints.new_user(): User already exists in team - %szulitellm.proxy.management_endpoints.internal_user_endpoints._add_user_to_team(): failed to add user %s to team %s - %s)1litellm.proxy.management_endpoints.team_endpointsrTeamMemberAddRequestMemberrrrwrdebugrrrfProxyExceptionProxyErrorTypesteam_member_already_in_teamr)rorrrrr{res rI_add_user_to_teamr7sAR.%#") $60     ==C %5Q%??VYZ[V\C\ & &y  ! & &8A       A &#a&(!^,;;qvvE & &y  ! & &8A  G sKE%757E7 EA!B+! E+ E7BD<7E<EEc ~tjytjjd}|td|Dr|Std|DrJ|Dcgc]>}t |jd|jd|jdd@c}St j d |ycc}w) Nrvc3<K|]}t|tywrFrfrw.0teams rI z,check_if_default_team_set..ws7z$$7c3<K|]}t|tywrF)rfrgrs rIrz,check_if_default_team_set..ys:DD$':rrrr{rq)rrr{z5Invalid team type in default internal user params: %s)ryrzriallNewUserRequestTeamrr)rvrs rIcheck_if_default_team_setrrs++377;;GDE  77 7L :E: :"   # HHY/'+xx0D'E"hh{F;  ! & &G  sAB:rvc bKg}|D]}d}d}t|tr|} nLt|tr%|j} |j}|j }nt dt||jt|| ||||tj|ddid{y7w)NrqzInvalid team type: )rorrrrr{rT) rfrwrrr{r ValueErrorrrrrr) rorrrvrBrrr{rrs rIadd_new_user_to_default_teamrs-/E .4 +/ dC G 0 1llGI!%!8!8 24:,?@ @ %"3#5#    , ..% 84 888sB%B/'B-(B/rzInternal User management)tags dependenciesresponse_modelczK ddlm}m}|%tdtj j |%tdtj j t|jt|j|d{t|j|d{t|jd{}|r|j|r tdd |j t"j$t"j&fvrTt)|t*rD|j t"j$k7r'tdd |j d |j t-|| |j/}t1||}t3|| d{}t5||j6}| t9}t;t<t>dz|jAdd}tCdddi|d{}|jEdd} | AtGt;t>|jEd| ||jddd{nA|?tIt;t>|jEd|j|||d{t;t>dz|jEdd} || tK| |||d{ddg} i} |jMD]"\} }| tNjPvs| | vs|| | <$|jEdd| d<tNjS| }tUjVtYjZ||||S77777w7&77#t\$r&}t_j`d|tc|d}~wwxYww)a+ Use this to create a new INTERNAL user with a budget. Internal Users can access LiteLLM Admin UI to make keys, request access to models. This creates a new user and generates a new api key for the new user. The new api key is returned. Returns user id, budget + new key. Parameters: - user_id: Optional[str] - Specify a user id. If not set, a unique id will be generated. - user_alias: Optional[str] - A descriptive name for you to know who this user id refers to. - teams: Optional[list] - specify a list of team id's a user belongs to. - user_email: Optional[str] - Specify a user email. - send_invite_email: Optional[bool] - Specify if an invite email should be sent. - user_role: Optional[str] - Specify a user role - "proxy_admin", "proxy_admin_viewer", "internal_user", "internal_user_viewer", "team", "customer". Info about each role here: `https://github.com/BerriAI/litellm/litellm/proxy/_types.py#L20` - max_budget: Optional[float] - Specify max budget for a given user. - budget_duration: Optional[str] - Budget is reset at the end of specified duration. If not set, budget is never reset. You can set duration as seconds ("30s"), minutes ("30m"), hours ("30h"), days ("30d"), months ("1mo"). - models: Optional[list] - Model_name's a user is allowed to call. (if empty, key is allowed to call all models). Set to ['no-default-models'] to block all model access. Restricting user to only team-based model access. - tpm_limit: Optional[int] - Specify tpm limit for a given user (Tokens per minute) - rpm_limit: Optional[int] - Specify rpm limit for a given user (Requests per minute) - auto_create_key: bool - Default=True. Flag used for returning a key as part of the /user/new response - aliases: Optional[dict] - Model aliases for the user - [Docs](https://litellm.vercel.app/docs/proxy/virtual_keys#model-aliases) - config: Optional[dict] - [DEPRECATED PARAM] User-specific config. - allowed_cache_controls: Optional[list] - List of allowed cache control values. Example - ["no-cache", "no-store"]. See all values - https://docs.litellm.ai/docs/proxy/caching#turn-on--off-caching-per-request- - blocked: Optional[bool] - [Not Implemented Yet] Whether the user is blocked. - guardrails: Optional[List[str]] - [Not Implemented Yet] List of active guardrails for the user - policies: Optional[List[str]] - List of policy names to apply to the user. Policies define guardrails, conditions, and inheritance rules. - permissions: Optional[dict] - [Not Implemented Yet] User-specific permissions, eg. turning off pii masking. - metadata: Optional[dict] - Metadata for user, store information for user. Example metadata = {"team": "core-infra", "app": "app2", "email": "ishaan@berri.ai" } - max_parallel_requests: Optional[int] - Rate limit a user based on the number of parallel requests. Raises 429 error, if user's parallel requests > x. - soft_budget: Optional[float] - Get alerts when user crosses given budget, doesn't block requests. - model_max_budget: Optional[dict] - Model-specific max budget for user. [Docs](https://docs.litellm.ai/docs/proxy/users#add-model-specific-budgets-to-keys) - budget_fallbacks: Optional[Dict[str, List[str]]] - Per-model fallback chain tried in order when that model's own `model_max_budget` is exceeded, e.g. {"gpt-4o": ["gpt-4o-mini"]}. - model_rpm_limit: Optional[float] - Model-specific rpm limit for user. [Docs](https://docs.litellm.ai/docs/proxy/users#add-model-specific-limits-to-keys) - mcp_rpm_limit: Optional[dict] - Per-MCP-server rpm limit, keyed by MCP server name {"github": 100, "slack": 200}. Enforced for keys and teams only; values set on a user are stored but not enforced per user. - tag_rpm_limit: Optional[dict] - Per-request-tag rpm limit, keyed by request tag {"cell-1": 1000, "cell-2": 500}. Enforced for keys only; values set on a user are stored but not enforced per user. - model_tpm_limit: Optional[float] - Model-specific tpm limit for user. [Docs](https://docs.litellm.ai/docs/proxy/users#add-model-specific-limits-to-keys) - spend: Optional[float] - Amount spent by user. Default is 0. Will be updated by proxy whenever user is used. You can set duration as seconds ("30s"), minutes ("30m"), hours ("30h"), days ("30d"), months ("1mo"). - agent_id: Optional[str] - The agent id associated with the user. - team_id: Optional[str] - [DEPRECATED PARAM] The team id of the user. Default is None. - duration: Optional[str] - Duration for the key auto-created on `/user/new`. Default is None. - key_alias: Optional[str] - Alias for the key auto-created on `/user/new`. Default is None. - sso_user_id: Optional[str] - The id of the user in the SSO provider. - object_permission: Optional[LiteLLM_ObjectPermissionBase] - internal user-specific object permission. Example - {"vector_stores": ["vector_store_1"], "mcp_servers": ["github"], "mcp_tool_permissions": {"github": ["list_issues"]}}. The MCP grants act as a ceiling on every key this user holds. IF null or {} then no object permission. - prompts: Optional[List[str]] - List of allowed prompts for the user. If specified, the user will only be able to use these specific prompts. - organizations: List[str] - List of organization id's the user is a member of - budget_limits: Optional[list] - List of concurrent budget windows for the user. Each window specifies a budget_limit, time_period, and optional budget_duration. Example - [{"budget_limit": 10.0, "time_period": "1d"}, {"budget_limit": 50.0, "time_period": "7d"}]. Returns: - key: (str) The generated api key for the user - expires: (datetime) Datetime object for when key expires. - user_id: (str) Unique user id - used for tracking spend across multiple keys for same user id. - max_budget: (float|None) Max budget for given user. Usage Example ```shell curl -X POST "http://localhost:4000/user/new" -H "Content-Type: application/json" -H "Authorization: Bearer sk-1234" -d '{ "username": "new_user", "email": "new_user@example.com" }' ``` r)_license_checkrBNrr) total_userszOLicense is over limit. Please contact support@berri.ai to upgrade your license.zyOnly proxy admins can create administrative users (proxy_admin, proxy_admin_viewer). Attempted to create user with role: z . Your role: r)rmrBr request_typerqrro)rorrrrr{)rorrrvrB)rorrBrtokentoken_idr)r_rkrz!/user/new: Exception occured - %s)2litellm.proxy.proxy_serverrrBrCommonProxyErrorsdb_not_connected_errorr~r"rurrorrr2count_billable_users is_over_limitr{r|r}PROXY_ADMIN_VIEW_ONLYrfUserAPIKeyAuthr$jsonrr'rcrvrr rrwrhr%rirrrrNewUserResponse model_fieldsmodel_validater create_taskrasync_user_created_hookrr exceptionr*)r_rrrBbillable_usersrmrvorganization_idsrk_team_idro special_keys response_dictrr~new_user_responsers rInew_userrsVs+L  C8I8`8`8f8fg g  (??EE  !!5!56't||]CCC)$//=III'5]&C&X&X&Z Z n::~:Vh  NN/;;=M=c=cd d,n=!++/?/K/KKSTXTbTbSccpqBqLqLpMN  -/ IIK 4YE 19Tabb y)  =-/E"&tCy4'7X\9]"^ 6 XF Xi XX$-- 48  #S(,,y"9: "3??#'    .S(,,y"9:??"3+   cDj(,,y$*GH  'G,?,.+"3    ' 3 ! "..* +JCo222s,7N%* c" + (||GR8 e#2#A#A-#P  $ < <*"3  ! E DI![<cY    @ +&&'JAN'**+sN;BN M3 N &M6' N M9CN &M<'A!N M? AN NAN N=N N2N N AN 2N;3N 6N 9N <N ?N N N N N8!N33N88N;z/user/available_roles)rinclude_in_schemarcKi}tD]i}|tjtjtjtjfvsD|j |j d||j<k|Sw)z Endpoint used by Admin UI to show all available roles to assign a user return { "proxy_admin": { "description": "Proxy Admin role", "ui_label": "Admin" } } ) descriptionui_label)r|r}rrINTERNAL_USER_VIEW_ONLYrrr~)r_data_to_returnrs rIui_get_available_rolerlsw& O    ( (  2 2  * *  4 4    $// MM+ODJJ '  s A A9*A9 team_listc>|y|D]}|j|k(s|cSyrF)r)rrrs rIget_team_from_listr s2 <<7 "K rLcTd}t||kDry|D]}t|dksyy)z:Validate that a decoded user_id is safe to use downstream.iF T)rord)roMAX_USER_ID_LENGTHchs rI_is_valid_user_idrs: # 7|(( r7T> rLrequestcd}t|jj}d|vrBddl}ddlm}|j d|}|r$||jd}t|r|}|S)z* Get the user id from the request Nzuser_id=r)unquotezuser_id=([^&]*)) rwurlqueryre urllib.parsersearchgroupr)rro query_stringrrmatch raw_user_ids rIget_user_id_from_requestrsc Ggkk//0L\!(yy!3\B !(Q!8K -% NrLc*|d|vr t|S|S)z>Normalize URL-decoded user_id while preserving '+' characters.rr)rrros rI_normalize_user_info_user_idr"ssg~'88 NrLc|yt|ry||jk(ryttjd|d|j)aRe-validate that the caller may read the resolved ``user_id`` after URL-decoding has been finalized. The route-level check in ``RouteChecks.non_proxy_admin_allowed_routes_check`` runs against ``request.query_params``, which decodes a literal ``+`` to a space. ``_normalize_user_info_user_id`` then re-parses the raw query with ``unquote`` so the endpoint can return rows for user_ids that contain ``+`` (e.g. plus-addressed emails). That asymmetry let an attacker who registered a username with a literal space pass the route check and then read another user's row by sending the encoded ``+`` form. Re-checking ownership here closes the gap without changing the supported user_id grammar. Nz4key not allowed to access this user's info. user_id=z, key's user_id=r)r rorrHTTP_403_FORBIDDENrors rI_enforce_user_info_accessr&s[-.#+++ --B7)K[\m\u\u[v w rL user_infocKddlm}g}g}|tddd||d{}|+t|tr|}|Dcgc]}|j }}d} t |d d} | r-t| tr|j| d d d{} n]|jQ|O|j|j d{} t | d d} | r|j| d d d{} | Rt| trB| D]=}|j |vs|j||j|j ?||fS7%cc}w777hw)z9Fetch and merge teams from membership + user.teams field.r) list_teamr /user/inforr)rrorNrvrfind_all) team_id_listrr query_typero) rr)rrfrrrget_dataror) rBror'rr)rr,teams_1rteams_2target_team_idscaller_user_infocaller_team_idss rI_get_user_info_teamsr5sL.0I L$!<8 + Gz'48 189 9 937G$Y>O:ot<%..(!/    " " .7?0=0F0FO`OhOh0F0i*i!()97D!I )22,!%3G z'48 2D||</  &##DLL1 2 g K:  +jsW&EE EE:EE2EE*E0E1)E3EEEE_SCIM_DIRECTORY_METADATA_KEYSmetadatact|trtj|s|S|j Dcic]\}}|tvs||c}}Scc}}w)aSCIM enterprise attributes, entitlements, and roles are persisted in user metadata so reporting can group on them, but they are directory-only fields that generic user-info endpoints must not surface; SCIM clients read them through the SCIM endpoints.)rfrgr6 intersectionr)r7kvs rI _redact_scim_enterprise_metadatar<sM h %-J-W-WX`-a%^^- XTQ:W1WAqD XX Xs A Akeysr0model_max_budget_usagecd||td|D}d|i}t||}|jdt|tr|j n|}t|t r6|jddt|jd|d<|||d <t|||| S) z9Create UserInfoResponse while filtering sensitive fields.Nc36K|]}t|ddyw)spendrNr)rr:s rIrz,_build_user_info_response..1s@a71gq1@srAr= all_teamsc$t|ddxsdSN team_aliasrrBxs rIz+_build_user_info_response..5sL"!=!CrLrrar7r>ror'r=rv) sum_process_keys_for_user_infosortrf BaseModel model_dumprgrhr<riUserInfoResponse) ror'r=rr0r>rA returned_keys _user_infos rI_build_user_info_responserU'sT-@4@@e$ 6DGTM NNCND2z>litellm.proxy.proxy_server.user_info(): Exception occured - %s)rrYrBr"r&rr _get_user_info_for_proxy_adminror/rr5rUrLitellm_EntityTypeUSERr dual_cacherrr*) rrorrYrBr'rr0r= response_datars rIr'r'Fs2S7+.wP!'EVW  T  ?34EF7J[\\ \ _'//G  +44W4EEI  wiz2  $8'/ $   7*22!3   9)E.33!!(4F!M.99 *$ W]F  $ +&&'gijk'**+s EADDDE'D;D<)D%D&DDADD DEDDDDD E '!EE  Etarget_user_idz&prisma_models.LiteLLM_UserTable | Nonec|Kddlmyfd}t|r|d{S|jk(r|d{S|jt j d|jid{}||j r|d{}|ytjdd|j iid{}|D]S}tj|j}t|| s4|j|j xsgvsQ|cSy77777fw) a Check if the caller is allowed to access the target user's info. Returns the target user's DB row if access is allowed, None otherwise. Returning the row avoids a redundant DB fetch in the caller. Access rules: 1. Proxy admins / proxy admin viewers can access any user 2. User can access their own info 3. Team admins can access info of users in their teams Raises on unexpected DB errors so they surface as 500s, not silent 404s. rrBNc`Ktjdiddid{S7w)Nroobject_permissionT)rinclude)rJ find_unique)rBrgsrI_fetch_target_userz6_check_user_info_v2_access.._fetch_target_users> /;;n-8KT7R<    s $.,.rorrin)rteam_obj)rrBr rorJrmrvrO find_manyLiteLLM_TeamTablerrQrr) rrgrn caller_user target_userrvrrprBs ` @rI_check_user_info_v2_accessrusG"9 -.')))  N2')))  ,#.}#=#I#IQZ\m\u\uPv#I#ww  "{'8'8'9';!;K""-]!;!E!EYY]_j_p_pXqLr!E!ssE +,;;DOOr^zAlitellm.proxy.proxy_server.user_info_v2(): Exception occured - %sr)rrYrBrrrr~rrorurQUserInfoV2Responserir<rrcrdrerrrr*)rrorrYrBuser_row user_datars rI user_info_v2rs<S?+  (??EE   3'>.w?G ?'//G ?x !;/"!    )'3  $..0 ! MM)W5  }}\2 !}}\2  mmK0  ---  !}}\2  ==*0b &MM*;< &MM*;< 6immJ6OP !}}\2 !}}\2 " m4 --(.B (mm,?@ ']]+=>! "*F.33#-- 7;!*/A!B.99 *$$#   <$ +&&'jlmn'**+sN IA&H)2H$3F*H)H'H)#I$H)'H)) I2!IIIcKddlm}d}| td|jj |d{}t j d||ddxsg}g}|D]<}|jdg|d<|jtj|>|dd xsg}|Dcgc]}tj|}}|jd t|| } |j} d} | `|j| d{} | Dt!| t"r| j%n| } t!| t&r| j)ddt+| | | |S77cc}w7aw)a1 Admin UI Endpoint - Returns All Teams and Keys when Proxy Admin is querying - get all teams in LiteLLM_TeamTable - get all keys in LiteLLM_VerificationToken table Why separate helper for proxy admin ? - To get Faster UI load times, get all teams and virtual keys in 1 query rriz SELECT (SELECT json_agg(t.*) FROM "LiteLLM_TeamTable" t) as teams, (SELECT json_agg(k.*) FROM "LiteLLM_VerificationToken" k WHERE k.team_id != 'litellm-dashboard' OR k.team_id IS NULL) as keys NrZzresults_keys: %sr=r<rvc$t|ddxsdSrFrBrHs rIrJz0_get_user_info_for_proxy_admin..^sGA|R$@$FBrLrKrCr.rarL)rrBrdb query_rawrrrirLiteLLM_VerificationTokenrrrrOrNror/rfrPrQrgrhrR) rrB sql_queryresults _keys_in_db keys_in_dbr _teams_in_dbrrS admin_user_idadmin_user_infos rIrbrb8s9I  P  )++55i@@G17;6=aj6H6NBKJI 778  $CM3BB3GHI -4AJw,?,E2LGSTt%44T:TLTFG6JR^_M-44MO - 6 6} 6 MM  &0:?I0V**,\k /40##J5 !   ?AUNs04E7E-A9E70E0 AE7E5AE70E7rDcddlm}ddlm}m}g}| |S|D]}|j |k(r|j dddur' |j}|j d|k(rMd|vr8|d3|ddk7r+t||d }|t|d d} | |d <n d|d <nd |d <|j||S#t$r|j}YwxYw) NrUI_SESSION_TOKEN_TEAM_ID)general_settingslitellm_master_key_hashdisable_master_key_returnFTrzlitellm-dashboard)rrrGNone) litellm.constantsrrrrrrirQrrgr rr) r=rDrrrrSr_key team_inforGs rIrNrNvs;TM | < 9 'C 44$(()DeL " ^^- xx "&>>D T)_%@T)_XkEk.DQZO\ (!(L$!GJ)3D&)-D&%+\"   &7 '8 % "xxz "sB;;CCc4i}t|dr|jn t}|jD]-\}}|dk(r d|vs|||<||gifvs |tvs)|||</d}|j t jk(rd}d|vr#ddlm }t|d||d|d <d|vr%|r#tjtj|d<d|vr:|r8tj(tj|d<ddlm }||d|d <|S) N fields_setrtFTrur)get_budget_reset_time)rurx)rjrsetr)LiteLLM_ManagementEndpoint_MetadataFieldsr{r|r)litellm.proxy.common_utils.timezone_utilsrr"ryrr)rmr_non_default_valuesrr:r;is_internal_userrs rI_update_internal_user_paramsrsR "-4T<-H)ceJ! &1 z)()"1% M BB$% q ! & ~~)777..S !34E!FG0E./@A1 ,--- !A!A!M/6/O/O | , 22  E E Q4;4Y4Y 0 1 W4I 23D E5 0 1 rLrkexisting_user_rowlitellm_changed_bylitellm_proxy_admin_namec Kddlm}|y t|jd|did{}|rtj |j d}tjtj|jd|xs |j|||r|jdnd|jdyy7#t$r0}tjd |j!d|Yd}~yd}~wwxYww) NrrirorT exclude_noneupdatedroactionrrr before_value after_valuez*Failed to create audit log for user %s: %s)rrBrJrLiteLLM_UserTablerrQrrrcreate_internal_user_audit_logromodel_dump_jsonrrwarningri) rkrrrrrBupdated_user_rowuser_row_typed audit_errors rI_schedule_user_update_audit_logrs9y(3M(B(M(MU^`hir`sTt(M(u"u $5$D$DEUE`E`nrE`Es$tN   (GG*22$'9'V=N=V=V&7-EZk"3"C"CQU"C"Vqu . > >D > Q  #v y$$%QS[S_S_`iSjlwxxys? D#C C BC D C D&C?:D?DD user_requestcx|j4|jtjjk7r t dd|Bt j |jd}t||st ddd iy|jtjjk7rt d dd iy) uJAuthorization checks for /user/update — raises HTTPException on failure.Nr(Only proxy admins can modify user roles.rTrrr'rz[User does not have permission to update this user. Only PROXY_ADMIN can update other users.r[zZUser not found. Only PROXY_ADMIN can create users via /user/update; use /user/new instead.) r{r|r}r~rrrrQcan_user_call_user_update)rrr typed_rows rI_check_user_update_authzrs ).?.I.IM]MiMiMoMo.o4^__$,;; object_permission_id`` link is cached separately (so a user who previously had NO entitlement keeps its "none" sentinel), and the user row itself is cached whole. Leaving any behind means an admin revoking a tool keeps serving it until the management-object TTL expires. Both the outgoing and incoming permission ids are passed, because a clear leaves no incoming id at all and an upsert may mint a new row; invalidating only one of the two leaves the other's grants live. Each deletion is isolated: one that fails must not skip the others, or a single unreachable key would silently leave the rest of a revocation in place. Best-effort overall, exactly as the caches are everywhere else, since one we cannot clear still expires on its own. r)user_api_key_cachec32K|]}t|ywrF)rr permission_ids rIrz6_invalidate_cached_user_entitlement..<s o %m 4 osNrrKz2Failed to invalidate cached entitlement key %r: %s) rrrgfromkeysrasync_delete_cacherrr)rorrr=rrs rI#_invalidate_cached_user_entitlementr(s"> o$--XmJn oELEX .w 7 A^`Dg g$77C7@ @ @g @ g ( ()]_bde f f gs@B BB c Kddlm}m}| td|js|j s t dt|||jd}t|| }t|d}|jr0t|jd |ji d{}n;|j r/t|jd |j i d{}t||||%tj|jd }|jxs| t!|d dnd}|duxr|j|k(} | rq|j"t$j&j(k7rJt+|dr|j-n t/} d} | D]} | |vs| | vs t1ddd| di|t3t4t!|dixsini} t7||| xsi}t9|j;dd|vr)t=|t!|dd|d{}|||d<nt?|rd|d<d}|jrNtA|jdkDr6|j|d <|jC|j|dd{}n|j r|jEd |j iddd{}|r\tG|tHrLtA|dkDr>|D]8}|j|d <|jC|j|dd{}nNnLtKtMjN|d <|j |d <|jQ|dd{}|}|tS||||| d{tU|d{d|vrPtW|j;d tYd!t!|dd|j;dfD"d{|t1d#dd$it[||S77H777Z77777:w)%z Helper function to update a single user. Used by both user_update and bulk_user_update endpoints. Returns the updated user data or raises an exception on failure. rrrBNzNot connected to DB!z-Either user_id or user_email must be providedrTrrmr_rorrrr)rt soft_budgetrArkrrzNon-admin users cannot modify 'z0' on their own record. Contact your proxy admin.rr7)r_rexisting_metadatarArkobject_permission_id)rmexisting_object_permission_idrBrq)ror_rrr+)key_valrrr-)r_rr)rkrrrrc3@K|]}t|tr|ywrFrrs rIrz-_update_single_user_helper..s$,%"-5 ",s)rorrzFailed to update user).rrrBrrorrr$rQrrcrJrrrrrr{r|r}r~rjrrrr rgr&r#rir(rr update_datar/rfrrwrrx insert_datarrrtuplerl)rrrrrBrmrr_target_user_id_is_self_update _sent_fields_protected_fields_fieldrrrkexisting_user_rowsrinserted_user_rows rI_update_single_user_helperrFsS.//    (?(?HII( + *4444HI5 P\]-.*."-m"<"G"GyZfZnZnNo"G"pp  "-m"<"G"G|]i]t]tNu"G"vv\+<>OP$-<<=N=Y=Ygk=Y=lm *117H7T!9d3Z^-D8i=N=V=VZi=iO,66:J:V:V:\:\\ x. - soft_budget: Optional[float] - Get alerts when user crosses given budget, doesn't block requests. - model_max_budget: Optional[dict] - Model-specific max budget for user. [Docs](https://docs.litellm.ai/docs/proxy/users#add-model-specific-budgets-to-keys) - budget_fallbacks: Optional[Dict[str, List[str]]] - Per-model fallback chain tried in order when that model's own `model_max_budget` is exceeded, e.g. {"gpt-4o": ["gpt-4o-mini"]}. - model_rpm_limit: Optional[float] - Model-specific rpm limit for user. [Docs](https://docs.litellm.ai/docs/proxy/users#add-model-specific-limits-to-keys) - mcp_rpm_limit: Optional[dict] - Per-MCP-server rpm limit, keyed by MCP server name {"github": 100, "slack": 200}. Enforced for keys and teams only; values set on a user are stored but not enforced per user. - tag_rpm_limit: Optional[dict] - Per-request-tag rpm limit, keyed by request tag {"cell-1": 1000, "cell-2": 500}. Enforced for keys only; values set on a user are stored but not enforced per user. - model_tpm_limit: Optional[float] - Model-specific tpm limit for user. [Docs](https://docs.litellm.ai/docs/proxy/users#add-model-specific-limits-to-keys) - spend: Optional[float] - Amount spent by user. Default is 0. Will be updated by proxy whenever user is used. You can set duration as seconds ("30s"), minutes ("30m"), hours ("30h"), days ("30d"), months ("1mo"). - agent_id: Optional[str] - The agent id associated with the user. - team_id: Optional[str] - [DEPRECATED PARAM] The team id of the user. Default is None. - duration: Optional[str] - [NOT IMPLEMENTED]. - key_alias: Optional[str] - [NOT IMPLEMENTED]. - object_permission: Optional[LiteLLM_ObjectPermissionBase] - internal user-specific object permission. Example - {"vector_stores": ["vector_store_1"], "mcp_servers": ["github"], "mcp_tool_permissions": {"github": ["list_issues"]}}. The MCP grants act as a ceiling on every key this user holds. IF null or {} then no object permission. - prompts: Optional[List[str]] - List of allowed prompts for the user. If specified, the user will only be able to use these specific prompts. - budget_limits: Optional[list] - List of concurrent budget windows for the user. Each window specifies a budget_limit, time_period, and optional budget_duration. Example - [{"budget_limit": 10.0, "time_period": "1d"}, {"budget_limit": 50.0, "time_period": "7d"}]. z /user/update: Received data = %s)rrNz@litellm.proxy.proxy_server.user_update(): Exception occured - %srzAuthentication Error()paramrr)messagerrcodezAuthentication Error, )rrrrr traceback format_excrfrrrr auth_errorrHTTP_400_BAD_REQUESTrw)r_rrkrs rI user_updaters~ ""#EtL :/!     &&'iklm""9#7#7#9: a ' 8/DQCq-IJ$//a&1Q v/J/JK   > *G,s1v5 ++!Wf-,,    s1D5&313D53 D2C1D--D22D5users_to_updatec Kg}d}d} |D]c} t|||d{}|jt|r|jdn |j|j d||dz }et|t||| S7h#t $r}tjd|jxs |j |t|} tjd|jxs |j | |jt|j|j d| |dz }Yd}~/d}~wwxYw#t $r3}tjd |td d t|id}~wwxYww)Nr)rrrroTrorsuccess updated_userrzFailed to update user %s: %sF)rorrrrtotal_requestedsuccessful_updatesfailed_updateszFailed to update users: %srrr)rrr8rirorrrrrwrr6rr) rrrrrrrrkr error_messages rIbulk_update_processed_usersrPs .0GN.G+# $L" $!;!-&7'9" $| !| dkDr@tK| t|| | $S|j r |j }ntddd%i|stdddid}t||kDrtddd|dt|ditMtOtPtR|||&d{S797p#t@$r }tCjDd"|Yd}~d}~wwxYw#t@$rd}tCjFd#||D]>}|jjI}|j0|_|j-|@Yd}~Jd}~wwxYw7w)'a Bulk update multiple users at once. This endpoint allows updating multiple users in a single request. Each user update is processed independently - if some updates fail, others will still succeed. Parameters: - users: Optional[List[UpdateUserRequest]] - List of specific user update requests - all_users: Optional[bool] - Set to true to update all users in the system - user_updates: Optional[UpdateUserRequest] - Updates to apply when all_users=True Returns: - results: List of individual update results - total_requested: Total number of users requested for update - successful_updates: Number of successful updates - failed_updates: Number of failed updates Example request for specific users: ```bash curl --location 'http://0.0.0.0:4000/user/bulk_update' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "users": [ { "user_id": "user1", "user_role": "internal_user", "max_budget": 100.0 }, { "user_email": "user2@example.com", "user_role": "internal_user_viewer", "max_budget": 50.0 } ] }' ``` Example request for all users: ```bash curl --location 'http://0.0.0.0:4000/user/bulk_update' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "all_users": true, "user_updates": { "user_role": "internal_user", "max_budget": 50.0 } }' ``` rrNrrrrr{c3NK|]}|j|jywrF)r{)rus rIrz#bulk_user_update..sV1akk>U1;;Vs%%rrz/Only proxy admins can update all users at once.rydesc)orderrzNo users found to updatezMaximum z% users can be updated at once. Found z users.Trrrorrr_rrrrzUpdated z usersrz#Failed to create bulk audit log: %sz!Failed to perform bulk update: %srzkMust specify either 'users' for individual updates or 'all_users=True' with 'user_updates' for bulk updates)rrr)*rrrBr user_updatesrusersnextr{r|r}r~ all_usersrJrqrrQrrhr2rG update_manyrr8rorrrrrrdumpsrrrr model_copyr6rr rUpdateUserRequest)r_rrrrB _bulk_rolerall_users_in_dbMAX_BATCH_SIZErmrrrrrqrruser_update_requests rIbulk_user_updatersOFS56  CGBSBS**K>Y]JdjjV VX\] "3"="=AQA]A]AcAc"c=  Y[O ~~$++  & &*:*F*F*L*L LH  (3='A'K'KS_agRh'K'i!i!;<    . 0x'77\]`ap]q\rryz "&!2!2!=!=D!=!Q 7Sd&7&78  y$/|T2 !13) < /55AA'B   ( ($ $ #'?? $&/%TAS%T #a'" ( a##,KK 1 9 9 ?R(+=+ZARAZAZ*;1I'/O0D/EV%L$(JJ/A$B ,  !) #O 4#5-   **G   78  N ?n,8N#33XY\]lYmXnnuv  -T"34oF+- ["jD < a$,,-RT_`` a < * *+NPQ R' <&*&7&7&B&B&D#.2ll#+&&':; < DD"%(@ ABE   w   M sA A A Asort_by sort_orderci}|ygd}||vr!tddddj|i|jdvrtdddi|j||<|S) N)rorryrArwr{rrz%Invalid sort column. Must be one of: z, r)ascrz+Invalid sort order. Must be 'asc' or 'desc')rjoinlower)rrorder_by valid_columnss rI_validate_sort_paramsrs&(HMm#DTYY}E]D^_`  0JK  #((*HW OrLrrr>proxy_logging_objzProxyLogging | NonecKt|r|S|jtdddi t|j||d|d{}|tdddi|j xsgDcgc]5}|j tjjk(r |j7}}|stdddi|rKtd|jd D}t|t|z} | stddd i| }d j|S7#t$rtdddiwxYwcc}ww) a Authorize the /user/list request and return the (possibly scoped) organization_ids string. - Proxy admins: returns organization_ids unchanged (may be None). - Org admins: returns comma-separated org IDs scoped to their allowed orgs. - Others: raises 403. Nrrz9Only proxy admins and organization admins can list users.rFrorBruser_id_upsertrc3^K|]%}|js|j'ywrF)r)roids rIrz/_authorize_user_list_request..s"asUXU^U^U`syy{as--,zBYou do not have org_admin access to the requested organization(s).)r rorrrorganization_membershipsr{r| ORG_ADMINr~rrsplitrr) rrrBrrrsmallowed_org_ids requestedr9s rI_authorize_user_list_requestr%s-.  (XY    #2%--'1 / $  XY  66<" ;;*44:: : O XY  a6F6L6LS6Qaa "9s?/C#CD !ef ' 88O $$Q   XY   s;)D?D D D#D?1:D:+A1D?DD77D?z /user/listzFilter users by rolezGet list of users by user_idsz Get list of users by sso_user_idz#Filter users by partial email matchzFilter users by team idrz Page number)rVgerdzNumber of items per page)rVr&lerzGColumn to sort by (e.g. 'user_id', 'user_email', 'created_at', 'spend')rzSort order ('asc' or 'desc')zIFilter users by organization membership. Comma-separated list of org IDs.r sso_user_idsrpage page_sizec RKddlm} m} m} | t ddd| it | | | | | d{} |d z |z}i}|r||d <|rnt |tr^|jd Dcgc]#}|js|j%}}t|d k(r |dd d |d<nd|i|d<|t |tr|d d |d<|t |trd|i|d<|Tt |trD|jd Dcgc]#}|js|j%}}d|i|d<| rJ| jd Dcgc]#}|js|j%}}|r ddd|iii|d<|jDcic] \}}| || }}}|t |tr t||nd}t| jj||||r|nddid{}t| jj!|d{}t#| |Dcgc]}|j$c}d{}t'j(d|| |z }g}|D]s}|j+}t-|j/d|d<|j1t2j5i|d|j/|j$diu|||||dS7cc}wcc}wcc}wcc}}w77cc}w7ŭw)a Get a paginated list of users with filtering and sorting options. Parameters: role: Optional[str] Filter users by role. Can be one of: - proxy_admin - proxy_admin_viewer - internal_user - internal_user_viewer user_ids: Optional[str] Get list of users by user_ids. Comma separated list of user_ids. sso_ids: Optional[str] Get list of users by sso_ids. Comma separated list of sso_ids. user_email: Optional[str] Filter users by partial email match team: Optional[str] Filter users by team id. Will match if user has this team in their teams array. page: int The page number to return page_size: int The number of items per page sort_by: Optional[str] Column to sort by (e.g. 'user_id', 'user_email', 'created_at', 'spend') sort_order: Optional[str] Sort order ('asc' or 'desc') rrBrrNrrzNo db connected. prisma client=r)rrrBrrrr{rrcontainsrrororhasrvr{somerrryrrskiptakerrzTotal count of users: %sr7 key_count)rtotalr+r, total_pages)rrBrrrr%rfrwr!rrrrr2rGrqr rrorrrQr<rirLiteLLM_UserTableWithKeyCountr) rrr*rrr+r,rrrrrBrrr4where_conditionsuid user_id_listsid sso_id_listr org_id_listr:r;rr total_countrquser_key_countsr8 user_list user_dumps rI get_usersrDsh >}oNO  :+)#-+ !8y(D+- (,%Jx-6>nnS6IYsSYY[syy{Y Y |  !(O%+ Y ' l+ Y '*Z"="!* &  JtS1 4% !J|S$A5A5G5G5L\cPSPYPYP[ciik\ \ ++ '5E5K5KC5P`cTWT]T]T_ciik` ` 6IjY`beNfgz2lp ESS`DaDgDgDqDq  #x,)? ErE?E%3=$A$G$G$M$MTd$M$eeK$7}`eFfX\t||Ff#ggO9;G(<945K68I OO% @zAZ [ * ) 8 8P9Pk?+>+>t||Q+OP   "  s$Z.] a T?fGggs2L'L:L'/LLA;L'L (L :L'L.L"L'" L-L2AL'L,L'3L4L'L  L'L% B$L'L'L' L'z /user/deletec^ Kddlm}ddlm}m}ddlm}m}m}|tdddi |jtd dd i |jtjjk(} t} | s|j rHt#|j%|j tj&jd  d{ng} | D chc]} | j(s| j(} } | stdddi i} | st#|j%dd|jii d{}|D]L} | j(s| j+| j tj-| j(N|jD]T}t/|j0j3d|i d{}|tddd|i | s@| j5|t}|r|j7| stddd|di |r|j9d}t;j<|t?tAtCjDtGjHtJjL|||||jNtPjR|dd| tU|j0j%dd|jVii d{}g}|D]}|tXj[|j]t_|j`|j |jb\}}|s^|D cgc]} | j]}} |je|j`tgjh|f|D]7\}}tU|j0jkd|id |i!d{9Wtm|jodd|jii d{tq|jod"dd|jiid#d|jiid$d|jiigi d{t#|jodd|jii d{ts|jodd|jii d{tu|jodd|jii d{}|S7@cc} w77M7cc} w787777W7(w)%a{ delete user and associated user keys ``` curl --location 'http://0.0.0.0:4000/user/delete' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data-raw '{ "user_ids": ["45e3e396-ee08-4a61-a88e-16b3ce7e0849"] }' ``` Parameters: - user_ids: List[str] - The list of user id's to be deleted. r)_cleanup_members_with_roles)get_audit_log_changed_byis_audit_logging_enabled)create_audit_log_for_updaterrBNrrNo db connectedrrzNo user id passed in)ror{rrz5Only PROXY_ADMIN or ORG_ADMIN users may delete users.roror[zUser not found, passed user_id=r\zk is not within your admin scope. Only PROXY_ADMIN may delete users outside your administered organizations.Tr)rrrdeletedz{}) rrz changed_bychanged_by_api_keyrr object_idrupdated_valuesr) request_datar)rror)existing_team_rowr_members_with_rolesrr  created_by updated_by);rrF+litellm.proxy.management_helpers.audit_logsrGrHrrIrrBrrr{r|r}r~rrorUrqr r setdefaultaddr2rGrmriissubsetrrrLiteLLM_AuditLogsrwrrxrnowrutcapi_keyLitellmTableNamesUSER_TABLE_NAMEr1rvrrrrQTeamMemberDeleteRequestrrrrrupdaterR delete_manyrXr^rJ)r_rrrFrGrHrIrrBcaller_is_proxy_admincaller_admin_org_idscaller_membershipsr"target_org_ids_by_userall_target_membershipsror}target_org_ids _user_rowfetch_all_teamsteams_to_updaterremoved_team_membersnew_team_members_db_new_team_membersrrR deleted_userss rI delete_userrosz@ W>O4PQQ }}W>T4UVV$5#>#>BRB^B^BdBd#d%(U !(( 1?II088!1!;!;!A!AJ   >,B C DFE24# YD5P"3"B"B4??CT"U, LL$,,'226 2 "2$L\3]qALLN3]$3]&& djjAU6V'WX Y,;  'G' /55<< '**,>?=   OK^ $M 2 > >iRVX\XeXeQfEg > hhh ! / ; ; T4==12dmm45dmm45  <  ) 7 C C9W[]a]j]jVkJl C mmm ! / ; ;9tUYUbUbNcBd ; eee"-]!;!G!Gy[_aeananZoNp!G!qqM E  d) efFE4^  infrsCT- T  T-T &T 4AT-7T8BT-TD4T-<T=A%T-#T-'T>A)T-'T(5T-T"AT-/T%00T- T'!0T-T)0T-T+T- T-T-T-T-"T-%T-'T-)T-+T-rz,prisma_models.LiteLLM_OrganizationMembershipcHKddlm}| td t|j d|id{}|td|t |j j|||d d{}|S7G7#t$r}td |d}~wwxYww) a Helper function to add an internal user to an organization Adds the user to LiteLLM_OrganizationMembership table - Checks if organization_id exists Raises: - Exception if database not connected - Exception if user_id or organization_id not found rriNrrrz/Organization not found, passed organization_id=)rorr{rbz$Failed to add user to organization: )rrBrr[rmr/rGcreate)rorr{rBorganization_rownew_membershiprs rI!add_internal_user_to_organizationrtK s 9011D(;M(J(V(V$o6)W) #   #MoM^_` `Uu U %"#2&  O %#  O  D>qcBCCDsKB" BA?AB8B9B>B"?BB B BBB"cKddlm}|d{}|jddsyt|ryd}|j# t |j||d|d{}g}|'|jxsgD cgc]} | j}} |r|S|xs |j} | t|| |||d{Stddd i 77m#t $rd}YxwxYwcc} w7-w) z Return a list of org IDs to filter by, or ``None`` for no filter. Reads the ``scope_user_search_to_org`` UI-setting flag and applies role-based access rules when the flag is ON. r)get_ui_settings_cachedNscope_user_search_to_orgFrrrzmscope_user_search_to_org is enabled. Only proxy admins, organization admins, or team admins can search users.r) 7litellm.proxy.ui_crud_endpoints.proxy_setting_endpointsrvrir rorrrrr_resolve_team_org_filterr) rrrBrrrv ui_settingsrsmember_org_idsr"resolved_team_ids rI#_resolve_org_filter_for_user_searchr}y s4 677K ??5u =-.K  ,  /)11+#5$"3 !K!#N6A6Z6Z6`^`b!++bb&B):)B)B#-           E  S8 K c s]C+C1C+C#C$C(C+>C$*C+;C)<C+C C!C+ C!! C+c Kddlm} t||||d{}|||stddd i |jr |jgStddd i 7D#t$rtddd|di wxYww) zCLook up the team and return its org as a filter list, or raise 403.r)r)rrBrrNrrz.scope_user_search_to_org is enabled but team 'z' was not found.rzWscope_user_search_to_org is enabled. You must be an admin of this team to search users.zscope_user_search_to_org is enabled and this team is not part of an organization. Contact your proxy admin to adjust this setting.)/litellm.proxy.management_endpoints.common_utilsrrrr)rrrBrrrrps rIryry sT  /'1/ !   0( ;vw  (())  Z  +  MgYVfgh   s,BA#A!A#AB!A##BBz/user/filter/uimodel)rrr responsesz$User email in the request parametersuJTeam ID — used when a team admin searches for users to add to their teamzPage number for pagination)rVrr&2)rVrr&r)cKddlm}m}m}|t dddi t |||||d{} |d z |z} i} |r|d d | d <|r|d d | d <| ddd| iii| d<t |j| | |ddid{} | sgS| D cgc]%} tj| j'c} S77;cc} w#t$rt$r+}tjd|t dd|d}~wwxYww)a Filter users based on partial match of user_id or email with pagination. Behaviour depends on the ``scope_user_search_to_org`` UI-setting flag (stored in the ``litellm_uisettings`` table): * **Flag OFF (default):** any authenticated user can search all users. * **Flag ON:** - Proxy admins see all users. - Org admins see only users in their org(s). - Team admins for an org-bound team see users in that org. - Others receive a 403. rr.NrrrJr)rrrBrrrrr/rorr2rrorryrr3zError searching users: %szError searching users: )rrBrrrr}rJrqLiteLLM_UserTableFilteredrrQrrr)rorrr+r,rrBrrorg_filter_idsr4r:rrqrs rI ui_view_usersr stB W>O4PQQ0S&I/'1/ ' ! ax9,MO #%+ Y ' &%. \ *  % _  S&&'BAF6MaS4QRRSsiDCB?ACCC DC*C<C>D?CCCD&DDDrecordsc NK|Dchc]%}tt|ddx}ts!|s$|'}}|siSt|j ddt |iid{}|Dcic]&}|j |j|jd(c}Scc}w7;cc}ww)zMap each user_id on the page to its email/alias so the Usage dashboard can label the 'Spend Per User' chart with the email instead of the raw UUID.roNror)rrw) rfrrwrJrqrrorrw)rBrrecordrorrrqs rI_resolve_user_email_metadatarC s &wvyZ^?_4_Gad)ejqH  $]3==YQUW[\dWePfDg=hhEej k]aDLLX X kk  i ks7B%"BBB1B%"B#B%++B  B% B%z/user/daily/activityzBudget & Spend TrackingzStart date in YYYY-MM-DD formatzEnd date in YYYY-MM-DD formatzFilter by specific modelzFilter by specific API keyz}Filter by specific user ID. Admins can filter by any user or omit for global view. Non-admins must provide their own user_id.zItems per pageizrTimezone offset in minutes from UTC (e.g., 480 for PST). Matches JavaScript's Date.getTimezoneOffset() convention.zWhen the range ends on the caller's current local day, extend it to today's UTC bucket so spend written after the caller's local midnight (in UTC terms) is included. Requires the timezone parameter. Historical ranges are never extended. start_dateend_dater\rinclude_current_utc_dayc  Kddlm'tddtjj i||tt jddi t| } | r|} n3t| } || }|| k7rtt jddi|} td d | d||||||||fd  d{S7#t$rt$r;} tjd | tt jdd| id} ~ wwxYww)ad [BETA] This is a beta endpoint. It will change. Meant to optimize querying spend data for analytics for a user. Returns: (by date) - spend - prompt_tokens - completion_tokens - cache_read_input_tokens - cache_creation_input_tokens - total_tokens - api_requests - breakdown by model, api_key, provider rriNrrr&Please provide start_date and end_date3Non-admin users can only view their own spend data.litellm_dailyuserspendroct|SrF)r)rrBs rIrJz)get_user_daily_activity.. s4PQ^`g4hrL)rBrrentity_id_fieldr`entity_metadata_fieldrrrr\r+r,timezone_offset_minutesrresolve_entity_metadataz./spend/daily/analytics: Exception occured - %sFailed to fetch analytics: )rrBrrrr~rrr r!r$rrrrHTTP_500_INTERNAL_SERVER_ERROR)rrrr\ror+r,rrris_adminr`caller_user_idrrBs @rIget_user_daily_activityrQ sTx9.EEKKL  X-33EF  ( ./@A I$HIZ$[N(.(# & 9 9#%Z[ I''/%"&!$,$;$h    "   &&'WYZ[==:1#>?   s=ADA"B>7B<8B>;D<B>>D 6DD  Dz/user/daily/activity/aggregatedc Kddlm}|'tddtjj i||tt jddi t|} | r|} n3t|} || }|| k7rtt jddi|} t|d d | d|||||| d{S7#t$rt$r;} tjd | tt jdd | id} ~ wwxYww)z Aggregated analytics for a user's daily activity without pagination. Returns the same response shape as the paginated endpoint with page metadata set to single-page. rriNrrrrrrro) rBrrrr`rrrrr\rrz7/user/daily/activity/aggregated: Exception occured - %sr)rrBrrrr~rrr r!r$rrrrr) rrrr\rorrrrBrr`rrs rI"get_user_daily_activity_aggregatedr sJ\9.EEKKL  X-33EF  % ./@A I$HIZ$[N(.(# & 9 9#%Z[ I2'/%"&!$,$;       &&'`bcd==:1#>?   s=ADAB70B51B74D5B77D 6C??DD)rBrCrDz-TableActions[prisma_models.LiteLLM_UserTable])rBrCrDz-TableActions[prisma_models.LiteLLM_TeamTable])rBrCrDz5TableActions[prisma_models.LiteLLM_VerificationToken])rBrCrDz:TableActions[prisma_models.LiteLLM_OrganizationMembership])rBrCrDz2TableActions[prisma_models.LiteLLM_InvitationLink])rBrCrDz5TableActions[prisma_models.LiteLLM_OrganizationTable])rBrCrDz2TableActions[prisma_models.LiteLLM_TeamMembership])rDN)NNrqrF)__doc__rrrcollections.abcrrrrrtypingrr r r fastapir r rrrrrylitellm._loggingr litellm._uuidrlitellm.proxy._typeslitellm.proxy.auth.auth_checksrr$litellm.proxy.auth.user_api_key_authr-litellm.proxy.common_utils.user_api_key_cacherr,litellm.proxy.hooks.model_max_budget_limiterr/litellm.proxy.hooks.user_management_event_hooksr8litellm.proxy.management_endpoints.common_daily_activityrrrrrr r!r"r#;litellm.proxy.management_endpoints.key_management_endpointsr$r%r&8litellm.proxy.management_helpers.object_permission_utilsr'r(&litellm.proxy.management_helpers.utilsr)litellm.proxy.utilsr*r+,litellm.repositories.organization_repositoryr,%litellm.repositories.prisma_protocolsr-'litellm.repositories.table_repositoriesr.r/r0$litellm.repositories.team_repositoryr1$litellm.repositories.user_repositoryr22litellm.repositories.verification_token_repositoryr3>litellm.types.proxy.management_endpoints.common_daily_activityr4@litellm.types.proxy.management_endpoints.internal_user_endpointsr5r6r7r80litellm.types.proxy.management_endpoints.scim_v2r9r:r; TYPE_CHECKINGprismar< prisma_modelsr= prisma_typesr>rr?r@rA__annotations__rJrOrRrUrXr[r^rgrcrlNewUserRequestrrwboolrrrrrrfloatrrrrpostrrrirrrTeamListResponseObjectLiteLLM_TeamMembershipr rrr"r&rr5 frozensetr6objectr<rrRrUQueryr'rur|rrbrNr UpdateUserRequestNoUserIDorEmailrrPrrrrrrrrrrrintrrr%rDDeleteUserRequestror|rtr}ryrrrrrrrLrIrs  88',,NN1"KBVT  OHO> @?  .,M70 (4(4(<(A(9(<!(!9!;;$; <!!N!t!R# ''t')'  ' : ' 'T #* Mb gk  C$J G\ ae  9  99 9" 9& 9N"'+*0 8 8 8&8d 8  8 ' 8v49t4F/G#G$#N09 9d 9&9 9t./ / 9 " 9B $ %+,-"   )00A(Bw+ w+%w+ w+t $ %+,-  )00A(B%  : %&.D)EEL   //$6  s t g#**'C$J3QU:sTznY]<11 4Z1Tz1& 1  4& '.D)E)L LM 1h(1!#ACZ[(u Y3;$& Y #v+ Y$CG  4ZTz ( )D 0*+  ( )D 0  !d3;&7!784? > $ %+,-#   ('--Bef(/0A(BK+ K+ 4ZK+&K+ K+\8%88.8v $ %+,-%   ('--Bef(/0A(BX+ X+ 4ZX+&X+ X+v;N;|' ( )D 0'%&.D)EEL'T.D.8ILl8l.qu.by38ny 4'yd y& y "Dj y  y< # % !4'   8cV ,c c" V,= V$ VgsTzgZ_`ceh`hZignrgB&*]#]%]d ] #s(^ ]@ %      $ %+,-  )00A(BR R %R   R p&*8G+,8G%8Gd 8G 8Gv $ %+,-)   )00A(B%+ t&J J%Jd J J^"&"("3i$" S#X"J3:34S>TXCX@?%%?%Dj?%)?%* ?% - ?%  4Z ?%D $ %+,-#  %w}}T?UV(7==Cbc,w}}TGij*W]]4Ejk$w}}T?XY aA=I"W]]2!Icd''--]$gmmE?]^#07==_$)00A(B#Z *ZDjZ*Zd Z * Z  ZZ4ZZZDjZ"&#Z  Zz $ %+,-  )00A(B%+ t&y y%yd y  yx+D +D+D +D4 +D\?%? 4Z?)?* ? - ?  #Y ?D%%% %)%* % - %  #Y %P $ %+,- gt56 7  ('--Bef*W]]4Ekl''--` a5QVWX"W]]2;UZ[`cd(/0A(BQS 4ZQSd QS4ZQS QSQS&QSQSn l! l,45E,F l #t)_ l #%? @+,-2   *W]]5)7==3& .('--0('--T a5QVWX"W]]2;KPQVZ[(7==D %2GMM%)00A(BGk d k Dj k  :k 4Zk "4Z#k * +k ,-k .Dj/k 8"9k F&Gk H%Ik  k \% #%? @+,-2   *W]]5)7==3& .('--0('--T)7==D %2GMM%)00A(BCZ d Z Dj Z  :Z 4ZZ "4Z#Z *Dj+Z 4"5Z B&CZ D%EZ  Z rL