From 8e7178aaf8eca87f376473f89857bdd1d579d907 Mon Sep 17 00:00:00 2001 From: Milan Date: Fri, 8 May 2026 20:08:56 +0300 Subject: [PATCH] fix(proxy): allow org admins past route gate for team update/delete/block/unblock Add these routes to self_managed_routes so non-proxy-admin callers reach handlers that already enforce access via _verify_team_access. The org-admin branch in non_proxy_admin_allowed_routes_check requires organization_id in the JSON, which team update/delete/block/unblock typically omit. Co-authored-by: Cursor --- litellm/proxy/_types.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index ed20fe86cdc..20937310c9b 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -691,6 +691,14 @@ class LiteLLMRoutes(enum.Enum): "/team/member_add", "/team/member_delete", "/team/member_update", + # Team lifecycle writes: handlers call _verify_team_access (proxy admin, + # team admin, or org admin of the team's org). Route-level org-admin + # detection only inspects organization_id in the body, which these + # payloads often omit, so they must be self-managed like member_*. + "/team/update", + "/team/delete", + "/team/block", + "/team/unblock", "/team/permissions_list", "/team/permissions_update", "/team/daily/activity",