From 285ddf82e1825438f7d87d96dfac793d73a6e918 Mon Sep 17 00:00:00 2001
From: Nurlan Mammadli <116812760+nurlanmnn@users.noreply.github.com>
Date: Tue, 10 Nov 2026 19:32:49 -0500
Subject: [PATCH] fix(proxy): allow management_routes keys to call PATCH
 /model/{model_id}/update (#50979)

The PATCH model update endpoint was missing from the management_routes group, so virtual keys restricted to management_routes got a 403 on it while the legacy POST /model/update worked. Fixes #50918.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 litellm/proxy/_types.py                    |  1 +
 tests/unit/proxy/auth/test_route_checks.py | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index 736c09277f1..0d40faf55fb 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -713,6 +713,7 @@ class LiteLLMRoutes(enum.Enum):
             # model
             "/model/new",
             "/model/update",
+            "/model/{model_id}/update",
             "/model/delete",
             "/model/info",
             "/model/{model_id}/kubernetes_pods",
diff --git a/tests/unit/proxy/auth/test_route_checks.py b/tests/unit/proxy/auth/test_route_checks.py
index c1011310af3..d36e9558c86 100644
--- a/tests/unit/proxy/auth/test_route_checks.py
+++ b/tests/unit/proxy/auth/test_route_checks.py
@@ -387,6 +387,25 @@ def test_virtual_key_allowed_routes_with_litellm_routes_member_name_allowed(grou
     assert result is True
 
 
+@pytest.mark.parametrize(
+    "route,method",
+    [
+        ("/model/update", "POST"),
+        ("/model/123e4567-e89b-12d3-a456-426614174000/update", "PATCH"),
+    ],
+)
+def test_virtual_key_management_routes_allows_model_update(route: str, method: str) -> None:
+    valid_token: Final = UserAPIKeyAuth(user_id="test_user", allowed_routes=["management_routes"])
+
+    result: Final = RouteChecks.is_virtual_key_allowed_to_call_route(
+        route=route,
+        valid_token=valid_token,
+        request=_mock_request(method),
+    )
+
+    assert result is True
+
+
 def test_virtual_key_mcp_routes_allows_v1_mcp_server():
     """Regression test for #20325: allow virtual keys to list MCP servers."""