^h!L SrSSKrSSKrSSKrSSKrSSKrSSKrSSKJrJrJ r SSK J r J r J r Jr SSKrSSKJrJrJrJrJrJrJr SSKrSSKJr SSK7 SSKJrJrJrJr SS K J!r! SS K"J#r# SS K$J%r% SS K&J'r'J(r(J)r) SS K*J+r+ SSK,J-r-J.r.J/r/ S\04Sjr1S\2S\ \3S\ \44Sjr5S\2S\6S\ \/4Sjr7S\0S\ \ \34Sjr8S\2S\6S\04Sjr9S\6S\ \.4Sjr:S\6S\04Sjr;S\ \2S\6S\0S\<4Sjr=\"5r>\>RSS /\"\!5/\@S!9\%\"\!5\"SS"S#94S\0S\6S$\ \34S%jj55rAS\BS&\CS'\CS\C4S(jrDS\E\F\G44S)jrH\>RS*S /\"\!5/S+9\%\"\!5\"SS"S#94S,\S\FS\6S$\ \34S-jj55rI\>RS.S /\"\!5/S+9\%\"\!5\"SS"S#94S\JS\6S$\ \34S/jj55rK\>RS0S /\"\!5/S1S29S\"\!54S\ \JS\64S3jj5rL\>RS4S /\"\!5/S+9\R("SS5S69\"\!54S7\ \3S\64S8jj5rNS/00S9SSSSSSSSSSSSSSS0SSS:SS/00SSSSSSS4$S;\OS<S=\ \3S>\PS?\CS@\CSA\QSB\ \QSC\ \3SD\ \QSE\ \QSF\ \QSG\ \<SH\ \3SI\ \3S7\ \3S\ \3SJ\ \3SK\ \3SL\ \3SM\ \3SN\ \RSO\ \CSP\ \RSQ\ \RSR\OSSST\ \CSU\ \3SV\ \PSW\ \CSX\ \CSY\ \CSZ\ \CS[\ \PS\\ \PS]\ \3S^\ \OS_S`\ \<4JSajjrSSSb\ S\ \3S\ \ \T\ \U44ScjjrV\>RSdS /\"\!5/S+9\%S\"\!5\"SS"S#94S7\3S\ \GS\6S$\ \3S\ \@4 Sejj55rW\>RSfS /\"\!5/S+9\%\"\!5\"SgShSgSi9\"SjSkSgSlSm9\"SSnS#9\"SSoS#9\"SSpS#94S,\S\6Sq\RSr\RS\ \3SK\ \3SU\ \34Ssjj55rX\>RStS /\"\!5/S+9\%\"\!5\"SS"S#94S\YSu\S\6S$\ \3S\ \U4 Svjj55rZ\>RSwS /\"\!5/S+9\%\"\!5\"SS"S#94S\YSu\S\6S$\ \34Sxjj55r[\>RSyS /\"\!5/\\S!9\%\"\!54S,\S\64Szjj55r]S\6S7\ \3S{\US\<4S|jr^S\6S,\S}\ \T\3\_4S\`4S~jraSSU\ \3S\_S\ \3SS4SjjrbSX\ \TSS4Sjrcg)za KEY MANAGEMENT All /key management endpoints /key/generate /key/info /key/update /key/delete N)datetime timedeltatimezone)ListOptionalTuplecast) APIRouterDependsHeader HTTPExceptionQueryRequeststatus)verbose_proxy_logger)*)_cache_key_object_delete_cache_key_objectget_key_objectget_team_object)user_api_key_auth)KeyManagementEventHooks)management_endpoint_wrapper)_hash_token_if_neededduration_in_secondshandle_exception_on_proxy) get_secret)GenericBudgetInfoPersonalUIKeyGenerationConfigTeamUIKeyGenerationConfigdatacURSL$N)team_idr!s u/home/james-whalen/.local/lib/python3.13/site-packages/litellm/proxy/management_endpoints/key_management_endpoints.py _is_team_keyr'1s <> %&..G*CM0 r(user_api_key_dictteam_key_generationcUbSU;ag[XRS9nUc$[SSURSUR3S9eURUS;a[SSURS US3S9eg) Nallowed_team_member_rolesT)r)r*zUser=z not assigned to team= status_codedetailzTeam member role z" not in allowed_team_member_roles=)r/r*r r$role)r)r0r1 user_in_teams r&&_team_key_generation_team_member_checkr:@s # &.A A$'@'@L,4455KJL^L^K_`   34O PP&|'8'8&99[\oqL]M\NO   r(required_paramscbUcgURSS9nUHnX2;dM [SSUS3S9e g)NT exclude_unsetr4zRequired param z not in datar5) model_dumpr )r!r; data_dictparams r&$_key_generation_required_param_checkrB\sNd3I   !(|< ! r(c[Rb [RRS5cg[RSn[UUUS9 [ UURS55 g)Nr1T)r)r0r1r;)litellmkey_generation_settingsgetr:rB)r)r0r!_team_key_generations r&_team_key_generation_checkrHlso ''/  * * . ./D E M"::;PQ*+0 )   !23 r(personal_key_generationcUbSU;agURUS;a.[SS[RSSSUR3S9eg)Nallowed_user_rolesTr4zBPersonal key creation has been restricted by admin. Allowed roles=rIz . Your role=r5) user_roler rDrE)r0rIs r&_personal_key_membership_checkrMs ' '> >""*ABV*WWWX_XwXwyRYSThYiXjjvwHwRwRvST  r(c[Rb [RRS5cg[RSn[UUS9 [ UURS55 g)NrIT)rIr;)rDrErFrMrB)r0r!_personal_key_generations r&_personal_key_generation_checkrPsl ''/  * * . ./H I Q&>>?XY" 8 )  $$%67 r(c[Rb(UR[RR :Xag[ US9nU(a%Uc[SSUR3S9e[UUUS9$[XS9$)zV Check if admin has restricted key creation to certain roles for teams or individuals Tr%r4z1Unable to find team object in database. Team ID: r5r)r0r!)r0r!) rDrErLLitellmUserRoles PROXY_ADMINvaluer'r r$rHrP)r)r0r! is_team_keys r&key_generation_checkrWs ''/  & &*:*F*F*L*L LD)K  J4<<.Y *!/  ./  r(z /key/generatezkey management)tags dependenciesresponse_modelzThe litellm-changed-by header enables tracking of actions performed by authorized users on behalf of other users, providing an audit trail for accountability) descriptionlitellm_changed_byc ^ # SSKJnJnJnJn [ R "S5 Ub{[R"U5(aU"U5IShvN nO [S5eURSS5nURSS 5n U(d[[RU S 9eOT[RbCUR cSn O([#UR UUUR$S 9IShvN n ['U UUS 9 [R(bUHn U upU c2U S ;a,[+X [R(RU S55 M<U S:Xa2U /:Xa,[+X [R(RU /55 MtU S:XdM|U 0:XdM[+X [R(RU 055 M [R,bUHn U up[/[R,U S5nUcM'U c[+X U5 M8U S;aX:a[SSU SU SU30S 9eMYU S;dMa[1US9n[1U S9nUU:dM{[SSU SU SU30S 9e SnUbUR2b[5UR2UR6=(d 0S9nUR9UR;SS95nUR<R>RA0UEURB=(d UURB=(d US.ES9IShvN n[/USS5nURESSS9nSU;aURGSS5US'UbUUS'SU;aURGSS5US 'S!U;adSS"KJ$n USLa,US!b&[S#[JRLRN35eUSc S!US!0US'O US!USS!'URGS!5 [QURS$S5US%9IShvN [SS,S&S'0UDS(S'0D6IShvN nUR2US)'[RT"[VRX"UUUUS*95 [[S,0UD6$GNGNpGNPNkNT![\a>n[ R^"S+Ra[cU555 [eU5eSnAff=f7f)-a Generate an API key based on the provided data. Docs: https://docs.litellm.ai/docs/proxy/virtual_keys Parameters: - duration: Optional[str] - Specify the length of time the token is valid for. You can set duration as seconds ("30s"), minutes ("30m"), hours ("30h"), days ("30d"). - key_alias: Optional[str] - User defined key alias - key: Optional[str] - User defined key value. If not set, a 16-digit unique sk-key is created for you. - team_id: Optional[str] - The team id of the key - user_id: Optional[str] - The user id of the key - models: Optional[list] - Model_name's a user is allowed to call. (if empty, key is allowed to call all models) - aliases: Optional[dict] - Any alias mappings, on top of anything in the config.yaml model list. - https://docs.litellm.ai/docs/proxy/virtual_keys#managing-auth---upgradedowngrade-models - config: Optional[dict] - any key-specific configs, overrides config in config.yaml - spend: Optional[int] - Amount spent by key. Default is 0. Will be updated by proxy whenever key is used. https://docs.litellm.ai/docs/proxy/virtual_keys#managing-auth---tracking-spend - send_invite_email: Optional[bool] - Whether to send an invite email to the user_id, with the generate key - max_budget: Optional[float] - Specify max budget for a given key. - budget_duration: Optional[str] - Budget is reset at the end of specified duration. If not set, budget is never reset. You can set duration as seconds ("30s"), minutes ("30m"), hours ("30h"), days ("30d"). - max_parallel_requests: Optional[int] - Rate limit a user based on the number of parallel requests. Raises 429 error, if user's parallel requests > x. - metadata: Optional[dict] - Metadata for key, store information for key. Example metadata = {"team": "core-infra", "app": "app2", "email": "ishaan@berri.ai" } - guardrails: Optional[List[str]] - List of active guardrails for the key - permissions: Optional[dict] - key-specific permissions. Currently just used for turning off pii masking (if connected). Example - {"pii": false} - model_max_budget: Optional[Dict[str, GenericBudgetInfo]] - Model-specific budgets {"gpt-4": {"budget_limit": 0.0005, "time_period": "30d"}}}. IF null or {} then no model specific budget. - model_rpm_limit: Optional[dict] - key-specific model rpm limit. Example - {"text-davinci-002": 1000, "gpt-3.5-turbo": 1000}. IF null or {} then no model specific rpm limit. - model_tpm_limit: Optional[dict] - key-specific model tpm limit. Example - {"text-davinci-002": 1000, "gpt-3.5-turbo": 1000}. IF null or {} then no model specific tpm limit. - allowed_cache_controls: Optional[list] - List of allowed cache control values. Example - ["no-cache", "no-store"]. See all values - https://docs.litellm.ai/docs/proxy/caching#turn-on--off-caching-per-request - blocked: Optional[bool] - Whether the key is blocked. - rpm_limit: Optional[int] - Specify rpm limit for a given key (Requests per minute) - tpm_limit: Optional[int] - Specify tpm limit for a given key (Tokens per minute) - soft_budget: Optional[float] - Specify soft budget for a given key. Will trigger a slack alert when this soft budget is reached. - tags: Optional[List[str]] - Tags for [tracking spend](https://litellm.vercel.app/docs/proxy/enterprise#tracking-spend-for-custom-tags) and/or doing [tag-based routing](https://litellm.vercel.app/docs/proxy/tag_routing). - enforced_params: Optional[List[str]] - List of enforced params for the key (Enterprise only). [Docs](https://docs.litellm.ai/docs/proxy/enterprise#enforce-required-params-for-llm-requests) Examples: 1. Allow users to turn on/off pii masking ```bash curl --location 'http://0.0.0.0:4000/key/generate' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "permissions": {"allow_pii_controls": true} }' ``` Returns: - key: (str) The generated api key - expires: (datetime) Datetime object for when key expires. - user_id: (str) Unique user id - used for tracking spend across multiple keys for same user id. r)litellm_proxy_admin_name prisma_clientuser_api_key_cacheuser_custom_key_generatezentered /key/generateNz,user_custom_key_generate must be a coroutinedecisionTmessagez(Authentication Failed - Custom Auth Ruler5)r$r_r`parent_otel_spanrR) max_budgetr*r$max_parallel_requests tpm_limit rpm_limitbudget_durationmodelsmetadata)rerfrgrhr4errorz. is over max limit set in config - user_value=z ; max_value=)ridurationrm) soft_budgetmodel_max_budget) exclude_none) created_by updated_byr% budget_idr>rqrekey_max_budgetrikey_budget_durationrX) premium_userz)Only premium users can add tags to keys. key_alias)ryr_ request_typekey table_namero)r!responser0r\zDlitellm.proxy.proxy_server.generate_key_fn(): Exception occured - {})3litellm.proxy.proxy_serverr^r_r`rardebugasyncioiscoroutinefunction ValueErrorrFr rHTTP_403_FORBIDDENrDrEr$rrdrWdefault_key_generate_paramssetattrupperbound_key_generate_paramsgetattrrroLiteLLM_BudgetTablerpjsonify_objectjsondblitellm_budgettablecreater*r?poprxCommonProxyErrorsnot_premium_userrU_enforce_unique_key_aliasgenerate_key_helper_fn create_taskrasync_key_generated_hookGenerateKeyResponse Exception exceptionformatstrr)r!r0r\r^r_r`raresultrbrcr)elemr{rUupperbound_valueupperbound_duration user_duration _budget_id budget_row new_budget_budget data_jsonrxr}es r&generate_key_fnrsNDm+   ""#:; # /**+CDD7== !OPPzz*d3Hjj,VWG# & 9 9' , , 8||#CG #2 LL"/'9%6%G%G $ !%"3   . . :! =S-&7#F#F#J#J3PT#UH_"Dw'J'J'N'NsTV'WXJ&5B;Dw'J'J'N'NsTV'WX#(  1 1 =! #*::C$ $/}+;<# %7&303(/C58fglfmmy{KzL2M,&'"!" 8!$CC2E)93/-@,OM,/BB&303(/C58fglfmmy{KzL2M,&'"!"?N  $)9)9)E, ,,!%!6!6!<"J'55T2J*,,@@GG "3";";"W?W"3";";"W?WHG!+thF  $ +&& R Y YA  (** +sR-A Q"QBQ"(Q)BQ"Q"A$Q"76Q"1Q" CQ" Q C&Q"2Q3Q" Q  AQ"R-Q"Q"Q"Q" Q"" R*,9R%%R**R-non_default_valuesexisting_metadatacdSU;aUR5US'[[US5nURSSS9nUR 5HupVU[ ;dMXcU'M X1S'U$![ a8n[R"SR[U555 SnANCSnAff=f)zm Check LiteLLM_ManagementEndpoint_MetadataFields (proxy/_types.py) for fields that are allowed to be updated rkTruzLlitellm.proxy.proxy_server.prepare_metadata_fields(): Exception occured - {}N) copyr dictr?items)LiteLLM_ManagementEndpoint_MetadataFieldsrrrrr)r!rrcasted_metadatarkvrs r&prepare_metadata_fieldsrs ++):)?)?)A:&4!3J!?@OdFI  OO%DA==%&"&&5z"   && Z a aA    sA-A-- B/7.B**B/cURSS9nURSS5 0nUR5HupEU[;aMXSU'M SU;awURS5nU(a_[ U[ 5(aJ[ U5S:a;[US9n[R"[R5[US9-nXS'S U;a{URS 5n U (ac[ U [ 5(aN[ U 5S:a?[U S9n[R"[R5[US9-n XS 'XS 'UR=(d 0n S U;a[US 5 [XU S 9nU$) NTr=r{rmrrnsecondsexpiresribudget_reset_atrp)r!rr)r?rrr isinstancerlenrrnowrutcrrkvalidate_model_max_budgetr) r!existing_key_rowrrrrrm duration_srri key_reset_at _metadatas r&prepare_key_update_datarscooDo9I MM%! 9 9  !1" ''%))*5 Hc22H 8I,h?Jll8<<09Z3PPG,3y )..,001BC OS11O$q(,oFJ#<< 5 *8UUL4@0 14C0 1 ))/RI//!"45G"HI0 I r(z /key/update)rXrYrequestc r# SSKJnJnJn UR SS9nUR S5nUc [ S5eURURSSS 9IShvN n U c[S S S UR30S 9e[XS9n [U RSS5UU RS9IShvN URU0U ESU0ES9IShvN n [![#U5UUS9IShvN [$R&"[(R*"UU U UUS95 U c [-S5eSU0U SE$NNNgNM![ an [.R0"SR3[5U 555 [7U [5(aV[9[;U SS[5U 5S35[<R>[;U SS5[;U S[@RB5S9e[7U [85(aU e[9S[5U 5-[<R>[;U SS5[@RBS9eSn A ff=f7f) a Update an existing API key's parameters. Parameters: - key: str - The key to update - key_alias: Optional[str] - User-friendly key alias - user_id: Optional[str] - User ID associated with key - team_id: Optional[str] - Team ID associated with key - models: Optional[list] - Model_name's a user is allowed to call - tags: Optional[List[str]] - Tags for organizing keys (Enterprise only) - enforced_params: Optional[List[str]] - List of enforced params for the key (Enterprise only). [Docs](https://docs.litellm.ai/docs/proxy/enterprise#enforce-required-params-for-llm-requests) - spend: Optional[float] - Amount spent by key - max_budget: Optional[float] - Max budget for key - model_max_budget: Optional[Dict[str, GenericBudgetInfo]] - Model-specific budgets {"gpt-4": {"budget_limit": 0.0005, "time_period": "30d"}} - budget_duration: Optional[str] - Budget reset period ("30d", "1h", etc.) - soft_budget: Optional[float] - Soft budget limit (warning vs. hard stop). Will trigger a slack alert when this soft budget is reached. - max_parallel_requests: Optional[int] - Rate limit for parallel requests - metadata: Optional[dict] - Metadata for key. Example {"team": "core-infra", "app": "app2"} - tpm_limit: Optional[int] - Tokens per minute limit - rpm_limit: Optional[int] - Requests per minute limit - model_rpm_limit: Optional[dict] - Model-specific RPM limits {"gpt-4": 100, "claude-v1": 200} - model_tpm_limit: Optional[dict] - Model-specific TPM limits {"gpt-4": 100000, "claude-v1": 200000} - allowed_cache_controls: Optional[list] - List of allowed cache control values - duration: Optional[str] - Key validity duration ("30d", "1h", etc.) - permissions: Optional[dict] - Key-specific permissions - send_invite_email: Optional[bool] - Send invite email to user_id - guardrails: Optional[List[str]] - List of active guardrails for the key - blocked: Optional[bool] - Whether the key is blocked - aliases: Optional[dict] - Model aliases for the key - [Docs](https://litellm.vercel.app/docs/proxy/virtual_keys#model-aliases) - config: Optional[dict] - [DEPRECATED PARAM] Key-specific config. Example: ```bash curl --location 'http://0.0.0.0:4000/key/update' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "key": "sk-1234", "key_alias": "my-key", "user_id": "user-1234", "team_id": "team-1234", "max_budget": 100, "metadata": {"any_key": "any-val"}, }' ``` r)r_proxy_logging_objr`Tr=r{NNot connected to DB! find_uniquetokenr| query_typeirlzTeam not found, passed team_id=r5r!rry)ryr_existing_key_tokenr)rr! hashed_tokenr`r)r!rr}r0r\z(Failed to update key got response = Noner!zBlitellm.proxy.proxy_server.update_key_fn(): Exception occured - {}r7zAuthentication Error()rANoner6rctyperAcodeAuthentication Error, )"rr_rr`r?rrget_datar{r r$rrrFr update_datar hash_tokenrrrasync_key_updated_hookrrrrrrProxyExceptionrProxyErrorTypes auth_errorrHTTP_400_BAD_REQUEST) rr!r0r\r_rr`rr{rrr}rs r& update_key_fnrsov J ///= mmE"  23 3!.!7!7((u"8"    ##B4<<.!QR  5 ((,,[$?'/55   '22@1@7C@3   '#C1/    # : :!1!"3#5     GH Hs/hv.//[    *  && P W WA  a ' ' 8/DSVHA-NO$//a&1Q v/J/JK   > * *G,s1v5 ++!Wf-,,    st H7A D6D.AD6,D0-D6 D2 D6&D4'AD6-H7.D60D62D64D66 H4C/H//H44H7z /key/deletec # SSKJnJn Uc [S5eURn[ U5S:Xa+[ SU3[RS[RS9eURn[R"SUR35 URb UR[R :XaSn[#XVS 9IShvN upxUc([ S [R$S[R&S9e[R"S US 35 [ U5US :XdeUH0n UR+U 5 [-U 5n UR+U 5 M2 [R"SUR.R035 [2R4"[6R8"UUUUUS95 S U0$N![a [)S SS[ U5SUS 30S9ef=f![an [;U 5eSn A ff=f7f)a Delete a key from the key management system. Parameters:: - keys (List[str]): A list of keys or hashed keys to delete. Example {"keys": ["sk-QWrxEynunsNpV1zT48HIrw", "837e17519f44683334df5291321d97b8bf1098cd490e49e215f6fea935aa28be"]} Returns: - deleted_keys (List[str]): A list of deleted keys. Example {"deleted_keys": ["sk-QWrxEynunsNpV1zT48HIrw", "837e17519f44683334df5291321d97b8bf1098cd490e49e215f6fea935aa28be"]} Example: ```bash curl --location 'http://0.0.0.0:4000/key/delete' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "keys": ["sk-QWrxEynunsNpV1zT48HIrw"] }' ``` Raises: HTTPException: If an error occurs during key deletion. r)r_r`Nrz"No keys provided, passed in: keys=keysrzuser_api_key_dict.user_role: tokensr*zFFailed to delete keys got None response from delete_verification_tokenz/key/delete - deleted_keys= deleted_keysr4rlzNot all keys passed in were deleted. This probably means you don't have access to delete all the keys passed in. Keys passed in=z, Deleted keys =r5z#/keys/delete - cache after delete: )r!keys_being_deletedr0r\r})rr_r`rrrrrrrrr*rrrLrSrTdelete_verification_tokeninternal_server_errorHTTP_500_INTERNAL_SERVER_ERRORr delete_cacherin_memory_cache cache_dictrrrasync_key_deleted_hookr) r!r0r\r_r`rr*number_deleted_keys_keys_being_deletedr{rrs r& delete_key_fnrs_DH+P  23 3yy t9> H ?G-)G**G-- H7 HHH z /v2/key/infoF)rXrYinclude_in_schemac# SSKJn Uc [S5eUc[[R SS0S9eUR URSS S 9IShvN nUc[[RSS 0S9e/nUH%nUR5nURU5 M' URUS .$N]![a UR5nNBf=f![an[U5eSnAff=f7f) a Retrieve information about a list of keys. **New endpoint**. Currently admin only. Parameters: keys: Optional[list] = body parameter representing the key(s) in the request user_api_key_dict: UserAPIKeyAuth = Dependency representing the user's API key Returns: Dict containing the key and its associated information Example Curl: ``` curl -X GET "http://0.0.0.0:4000/key/info" -H "Authorization: Bearer sk-1234" -d {"keys": ["sk-1", "sk-2", "sk-3"]} ``` rr_NDatabase not connected. Connect a database to your proxy - https://docs.litellm.ai/docs/simple_proxy#managing-auth---virtual-keysrcz%Malformed request. No keys passed in.r5r{find_allrz No keys foundr{info) rr_rr rHTTP_422_UNPROCESSABLE_ENTITYrrHTTP_404_NOT_FOUNDr?rappendr)r!r0r_key_infofiltered_key_inforrs r&info_key_fn_v2r s69+  T  <"@@!#JK  '//))*0    "55!?3 A LLN  $ $Q ' yy*;<r&5"#">r&5"#>r!+JJx(M./ JJ'78III3}  * *  w  *  w       U  f     $%:        x %&%>&6&?& H ''(?@@8??+a/C8J4Kq4P-5__*=0%2%>%>&#)*;&?& H 33&:+? !  ! & &'H( S(5(A(A%)B)# $++>#NHZ &H[v " Oc  #   "" Y ` `A  ""9#7#7#9: a ' 'G==56    soF,U/H*R:R4A'R:R6R:U*R:R8R:U4R:6R:8R:: UBU  UUrc# SSKJnJn U(aUVs/sH n[US9PM nnURR R SSU00S9IShvN nX:XaURUS9IShvN nOlURXS 9IShvN nUc [S 5eURS S5nU[U5:wa[S [U5-5eXe4$[S 5eXe4$s snfNN|Nf![a^n[R"SR[U555 [R"[ R""55 UeSnAff=f7f)a: Helper that deletes the list of tokens from the database Args: tokens: List of tokens to delete user_id: Optional user_id to filter by Returns: Tuple[Optional[Dict], List[LiteLLM_VerificationToken]]: Optional[Dict]: - Number of deleted tokens List[LiteLLM_VerificationToken]: - List of keys being deleted, this contains information about the key_alias, token, and user_id being deleted, this is passed down to the KeyManagementEventHooks to delete the keys from the secret manager and handle audit logs r)r^r_rrinrN)rrz>Failed to delete tokens got response None when deleting tokensrzOFailed to delete all tokens. Tried to delete tokens that don't belong to user: 'DB not connected. prisma_client is NonezNlitellm.proxy.proxy_server.delete_verification_token(): Exception occured - {})rr^r_rrr find_many delete_datarrFrrrrlrrr'r() rr*r^r_r{rdeleted_tokens_num_deleted_tokensrs r&rrs$S% BHI&3+#6&FI#&&@@JJ"T6N3K 2'4'@'@'@'O!O(5'@'@!(A("")#X'5&8&8&K#&#f+5#ig,'6  ..EF F#4  ..IJ"P" "" \ c cA  ""9#7#7#9:sv E C3C(,C3C-C32C/3C3 C1 A C3E C3$E(C3/C31C33 E=AEEEz/key/{key:path}/regeneratec# SSKJnJnJnJnJn USLa&[ S[RR35eUc[[RSS0S9eS U;aUn OU"U5n URRRS U 0S 9IShvN n U c[[R SS US 30S9e["R$"SU 5 S[&R("S53n U"U 5n SU SS3n U U S.n0nUb [+XS9n["R$"SU5 UR-U5 UR/US9nURRR-S U 0US9IShvN n0nUb [1U5nU US'UR3S 5 U(a[5U"U5UUS9IShvN U (a[5U"U5UUS9IShvN [7S0UD6$GNONxN4N![8an[;U5eSnAff=f7f)a2 Regenerate an existing API key while optionally updating its parameters. Parameters: - key: str (path parameter) - The key to regenerate - data: Optional[RegenerateKeyRequest] - Request body containing optional parameters to update - key_alias: Optional[str] - User-friendly key alias - user_id: Optional[str] - User ID associated with key - team_id: Optional[str] - Team ID associated with key - models: Optional[list] - Model_name's a user is allowed to call - tags: Optional[List[str]] - Tags for organizing keys (Enterprise only) - spend: Optional[float] - Amount spent by key - max_budget: Optional[float] - Max budget for key - model_max_budget: Optional[Dict[str, GenericBudgetInfo]] - Model-specific budgets {"gpt-4": {"budget_limit": 0.0005, "time_period": "30d"}} - budget_duration: Optional[str] - Budget reset period ("30d", "1h", etc.) - soft_budget: Optional[float] - Soft budget limit (warning vs. hard stop). Will trigger a slack alert when this soft budget is reached. - max_parallel_requests: Optional[int] - Rate limit for parallel requests - metadata: Optional[dict] - Metadata for key. Example {"team": "core-infra", "app": "app2"} - tpm_limit: Optional[int] - Tokens per minute limit - rpm_limit: Optional[int] - Requests per minute limit - model_rpm_limit: Optional[dict] - Model-specific RPM limits {"gpt-4": 100, "claude-v1": 200} - model_tpm_limit: Optional[dict] - Model-specific TPM limits {"gpt-4": 100000, "claude-v1": 200000} - allowed_cache_controls: Optional[list] - List of allowed cache control values - duration: Optional[str] - Key validity duration ("30d", "1h", etc.) - permissions: Optional[dict] - Key-specific permissions - guardrails: Optional[List[str]] - List of active guardrails for the key - blocked: Optional[bool] - Whether the key is blocked Returns: - GenerateKeyResponse containing the new key and its updated parameters Example: ```bash curl --location --request POST 'http://localhost:4000/key/sk-1234/regenerate' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data-raw '{ "max_budget": 100, "metadata": {"team": "core-infra"}, "models": ["gpt-4", "gpt-3.5-turbo"] }' ``` Note: This is an Enterprise feature. It requires a premium license to use. r)rrxr_rr`Tz4Regenerating Virtual Keys is an Enterprise feature, Nrlr8r5skrr7Key z not found.z key_in_db: %srrrr)rrrznon_default_values: %sr%rr!r{rr~)rrrxr_rr`rrrrUr rrrrrrrrr!r"rr)rrrrrrr)r{r!r0r\rrxr_rr`hashed_api_key _key_in_db new_tokennew_token_hashnew_token_key_namerr updated_tokenupdated_token_dictrs r&regenerate_key_fnrHszd+   t #FGXGiGiGoGoFpq   "AA!JK  s? N'_N(++EEQQN+R    "554uK!89  ""?J?'//345 #I.%in%56$*    !8"  ! & &'?AS T-.#22 2D +..HHOON+P     $!%m!4 $-5!w' *'_#5"3   *'_#5"3   #    y @    +'**+ssHBG+G"CG+,G%-AG+2G'3G+G)G+!H"G+%G+'G+)G++ H5 HHHz /key/listz Page number)r[ge z Page sized)r[rJlezFilter keys by user IDzFilter keys by team IDzFilter keys by key aliaspagesizec @# SSKnSSKJn URS5 UcUR S5 [ S5e1Skn [ URR55U - n U (a[[SSRU 5SSRU 53[RSRU 5[RS 9e0n U(a[U[ 5(aXKS 'U(a[U[ 5(aX[S 'U(a[U[ 5(aXkS 'URS U 35 US- U-n URSU SU35 UR"R$R'U U US9IShvN n URS[)U 5S35 UR"R$R+U S9IShvN nURSU35 U*U-*n/nU H5nUR-5nUR/S5nUR1U5 M7 UUUUS.nURS5 U$NNx![ an[U[25(aV[[5USS[!U5S35[R6[5USS5[5US[R85S 9e[U[5(aUe[S[!U5-[R6[5USS5[R8S 9eSnAff=f7f) NrrzEntering list_keys functionzDatabase not connected>rNrOr$r*ryzUnsupported parameter(s): z, z. Supported parameters: rr*r$ryzFilter conditions: rIzPagination: skip=z, take=)rskiptakezFetched z keysr7zTotal count of keys: r)r total_count current_page total_pageszSuccessfully prepared responser7zerror(rrArr6r)loggingrr_rrlrset query_paramsrrjoinrbad_request_errorrrrrrrr9rcountrrFrr rrr)rr0rNrOr*r$ryrVr_supported_paramsunsupported_paramsrrQrrSrUkey_listr{key_dict_tokenr}rs r& list_keysrajsZ < 34  MM2 345 5O !5!5!:!:!<=@PP  4TYY?Q5R4SSklpluluwGmHlIJ$66ii 2300   z'3//&)  z'3//&)  Is33!*+  +E734qD  )$wtf=>#%%??IIJ    T 512*,,FFLLM    -k];<% ,- CxxzH\\'*F OOF # & &    67E  6  a ' ' 8vc!fXQ-?@$::a&1Q v/T/TU   > * *G,s1v5 66!Wf-66    sPLFI IAI I A5I LI I LCLLLz /key/block http_requestc*# SSKJnJnJnJnJnJn Uc2[SR[RR55eURRS5(aU"URS9n O URn [RSLGaUR R"R%SU 0S 9IShvN n U c6['S URS 3[(R*S [,R.S 9e[0R2"U"[5[7[8R:"55[<R>"[@RB5U=(d URD=(d UURF[HRJU SSU RM5S9 S95 UR R"ROSU 0SS0S9IShvN n [QU UU SUS9IShvN n SU l)[UU U U US9IShvN U $GNIN9N&N 7f)a Block an Virtual key from making any requests. Parameters: - key: str - The key to block. Can be either the unhashed key (sk-...) or the hashed key value Example: ```bash curl --location 'http://0.0.0.0:4000/key/block' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "key": "sk-Fn8Ej39NxjAXrvpUGKghGw" }' ``` Note: This is an admin-only endpoint. Only proxy admins can block keys. rcreate_audit_log_for_updaterr^r_rr`N{}rrTrr7r? not foundr{rr  id updated_at changed_bychanged_by_api_keyr| object_idactionupdated_values before_value request_datar@rr_r`rdrruser_api_key_objr`r+rrerr^r_rr`rrrdb_not_connected_errorrUr{ startswithrDstore_audit_logsrrrrrrZrrrrLiteLLM_AuditLogsruuiduuid4rrrrr*rLitellmTableNamesKEY_TABLE_NAMEmodel_dump_jsonr)rr r r!rbr0r\rerr^r_rr`rrecord key_objects r& block_keyrs> $5$L$L$R$RSTT xx5!!!1 xx 4'$''AAMML)N   > txxj 3$66..    '.4::<('||HLL91 0(00 0/'8'@'@0??*$#'!'!7!7!9   $!##==DD %Y,=EF&!#-+ JJ !#-+   Mm 8IB?HH DHH H(H)HHH HHHz /key/unblockc*# SSKJnJnJnJnJnJn Uc2[SR[RR55eURRS5(aU"URS9n O URn [RSLGaUR R"R%SU 0S 9IShvN n U c6['S URS 3[(R*S [,R.S 9e[0R2"U"[5[7[8R:"55[<R>"[@RB5U=(d URD=(d UURF[HRJU SSU RM5S9 S95 UR R"ROSU 0SS0S9IShvN n [QU UU SUS9IShvN n SU l)[UU U U US9IShvN U $GNIN9N&N 7f)a Unblock a Virtual key to allow it to make requests again. Parameters: - key: str - The key to unblock. Can be either the unhashed key (sk-...) or the hashed key value Example: ```bash curl --location 'http://0.0.0.0:4000/key/unblock' --header 'Authorization: Bearer sk-1234' --header 'Content-Type: application/json' --data '{ "key": "sk-Fn8Ej39NxjAXrvpUGKghGw" }' ``` Note: This is an admin-only endpoint. Only proxy admins can unblock keys. rrdNrfrrTrr7r?rgr{rr rhrqFr@rsrtrvrs r& unblock_keyrAs> $5$L$L$R$RSTT xx5!!!1 xx 4'$''AAMML)N   > txxj 3$66..    '.4::<('||HLL91 0(00 0/'8'@'@0??*$#'!'!7!7!9   $!##==DD %Y,>EF&!#-+ JJ !#-+   Mm 8rz /key/healthc v# URn[SSS9nU(a:SU;a4[UUUSS9IShvN nXCS'URS5S:XaSUS '[S0UD6$N-![aDn[ S [ U53[R[US S 5[RS 9eSnAff=f7f)a Check the health of the key Checks: - If key based logging is configured correctly - sends a test log Usage Pass the key in the request header ```bash curl -X POST "http://localhost:4000/key/health" -H "Authorization: Bearer sk-1234" -H "Content-Type: application/json" ``` Response when logging callbacks are setup correctly: ```json { "key": "healthy", "logging_callbacks": { "callbacks": [ "gcs_bucket" ], "status": "healthy", "details": "No logger exceptions triggered, system is healthy. Manually check if logs were sent to ['gcs_bucket']" } } ``` Response when logging callbacks are not setup correctly: ```json { "key": "unhealthy", "logging_callbacks": { "callbacks": [ "gcs_bucket" ], "status": "unhealthy", "details": "Logger exceptions triggered, system is unhealthy: Failed to load vertex credentials. Check to see if credentials containing partial/invalid information." } } ``` healthyN)r{logging_callbacksrV)r0r key_loggingrr unhealthyr{zKey health check failed: rArrr~) rkKeyHealthResponsetest_key_loggingrFrrrrrrrr)rr0 key_metadata health_statuslogging_statusesrs r& key_healthrsr (11 +<", I5%5"3(3&   2B- . ##H-<'2 e$ 1=11   /Ax8 66!Wf-66    s8B94A(A&,A(%B9&A(( B62?B11B66B9rcUR[RR:Xd(UR[RR:XagUR U:XagUR UR :Xagg)z: Helper to check if the user has access to the key's info TF)rLrSrTrUPROXY_ADMIN_VIEW_ONLYrr*rs r&rrsi ##'7'C'C'I'II  & &*:*P*P*V*V V  " "c )   .66 6 r(rc # SSKnSSKJn SSKJn SSKJnJn /nUH4n U RS5bURU S5 M+[S5e U"5n URU 5n U RUR5 UR5n U RU 5 SS S S ./S S .n U"U UUUUS9IShvN n [ R""S0U D6IShvN [*R,"S5IShvN U R/5nU R1U 5 U(a['USSU3S9$['USSUS3S9$NNi![$a!n['USS[)U53S9sSnA$SnAff=fN{7f)a Test the key-based logging - Test that key logging is correctly formatted and all args are passed correctly - Make a mock completion call -> user can check if it's correctly logged - Check if any logger.exceptions were triggered -> if they were then returns it to the user client side rN)StringIO)add_litellm_data_to_request)general_settings proxy_config callback_namez(callback_name is required in key_loggingzopenai/litellm-key-health-testrzQHello, this is a test from litellm /key/health. No LLM API call was made for this)r8contentz test response)modelmessages mock_response)r!r0rrrrzLogging test failed: ) callbacksrdetailsz2Logger exceptions triggered, system is unhealthy: rzWNo logger exceptions triggered, system is healthy. Manually check if logs were sent to  r~)rVior$litellm.proxy.litellm_pre_call_utilsrrrrrFrr StreamHandlersetLevelERROR getLogger addHandlerrD acompletionrLoggingCallbackStatusrrsleepgetvalue removeHandler)r0rrrVrrrrrcallbacklog_capture_stringchloggerr!r log_contentss r&rrsPI#% << ( 4  $ $Xo%> ?GH H  "   1 2BKK     F b 5#r -  1/%-   !!     --   &..0L $'HW  %'mnnAABC  ?    $'+CF84   sgB)E=,E E E !E "E &E=?E;A E= E E E8E3-E8.E=3E88E=r_rc# UbqUbmSU0nU(aSU0US'URRRUS9IShvN nUb,[SUS3[R S[ RS9egggN67f) a Helper to enforce unique key aliases across all keys. Args: key_alias (Optional[str]): The key alias to check prisma_client (Any): Prisma client instance existing_key_token (Optional[str]): ID of existing key being updated, to exclude from uniqueness check (The Admin UI passes key_alias, in all Edit key requests. So we need to be sure that if we find a key with the same alias, it's not the same key we're updating) Raises: ProxyException: If key alias already exists on a different key NryrNOTr7zKey with alias 'zB' already exists. Unique key aliases across all keys are required.r)rr find_firstrrrZrr)ryr_r where_clause existing_keys r&rrks"!:(3Y'? #*,>"?L *--GGRRS    # *9+5wx$66!00   $";  s?A:A87A:c.Ucg[U5S:XagUbSUR5H>up[U[5(deSU;a[ US5US'[ S0UD6 M@ gg![ an[S[U5S35eSnAff=f)z Validate the model_max_budget is GenericBudgetConfigType Raises: Exception: If model_max_budget is not a valid GenericBudgetConfigType Nr budget_limitzInvalid model_max_budget: zM. Example of valid model_max_budget: https://docs.litellm.ai/docs/proxy/usersr~)rrrrfloatrrr)rp_model _budget_infors r&rrs  #   A %   '(8(>(>(@$!&#...."\138n9U3VL0!1L1 )A (  (Q0} ~   s"A-A-AA-- B7BBr#)d__doc__rrrr!r'r{rrrtypingrrrr fastapir r r r rrrrDlitellm._loggingrlitellm.proxy._typeslitellm.proxy.auth.auth_checksrrrr$litellm.proxy.auth.user_api_key_authr.litellm.proxy.hooks.key_management_event_hooksr&litellm.proxy.management_helpers.utilsrlitellm.proxy.utilsrrrlitellm.secret_managers.mainrlitellm.types.utilsrrr GenerateKeyRequestr'LiteLLM_TeamTableCachedObjrMemberr/UserAPIKeyAuthr:rBrHrMrPboolrWrouterpostrr BaseModelrrUnionUpdateKeyRequestRegenerateKeyRequestrr KeyRequestrrrFrLiterallistrintrDictLiteLLM_VerificationTokenrrHraBlockKeyRequestrrrrrAnyrrrrr~r(r&rs    22..UUU1" CRN 4$)$*5=c] f*%"";<8   /7S /B  *% 4%%&CD&%-?2 34 %     D   +,-&   )00A(B(. t)h+ h+%h+! h+ h+V )-BF :(  "66 7(V)*'BS:T9U )00A(B(. t) G G G &G ! G G T)*'BS:T9U )00A(B(. t)f+ f+%f+! f+f+R  +,-  "&(/0A(B5+ : 5+%5+  5+p'(@Q8R7S !"A)00A(B J+ #J+& J+J+b#&*)-!% "&"%) ! $! $#+/!##8E(,#-/"$')&*&*!% %)37(,Wllsm l  l  l l lUOl"#ll ll d^!l"c]#l$ C=%l&   'l,c]-l. /l0c]1l2 3l4}5l6$C=7l8tn9l:};l<}=l>45?l@ ~AlB}ClD%TNElF$GlHtnIlJd^KlLd^MlNOlP D>QlRc]SlT/0UlV ~Wl`,0:/ :/#C=:/ 8D>4 9: :;:/z  +,-  ,0(/0A(B(. t) [+ [+ ' ([+&[+! [+!"[+  [+|  +,-  )00A(Ba]q9bkaC@"45MN"45MN$T7QRc c %c  c   c c] c c] c }c   c L()AR9S8T )00A(B(. t) d dd&d! d'(ddN*+7CT;U:V )00A(B(. t) d dd&d! ddN  +,-$   )00A(BP P %P  P f% #( *M %M M d38n%M  M f)- }  !   F  4 r(