9 views
-/https://github.com/berriai/litellm/issues/26582
GitHub Β· issue

#26582 [Feature]: Open /spend/logs/ui (and remaining read-only routes) to proxy_admin_viewer

  • State: open
  • Author: @kimsehwan96
  • Labels: enhancement, proxy, stale

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### The Feature

Add the following read-only endpoints to `admin_viewer_routes` in `litellm/proxy/_types.py` so the `proxy_admin_viewer` role can call them:

- `/spend/logs` - `/spend/logs/ui` - `/spend/logs/v2` - `/spend/logs/session/ui` - `/spend/logs/ui/{request_id}`

All are pure GET / read endpoints.

### Motivation, pitch

The official LiteLLM RBAC table describes `proxy_admin_viewer` as:

> Can login, view all keys, **view all spend across the platform**. > Cannot create keys/delete keys/add new users.

But in practice `proxy_admin_viewer` gets `403 Forbidden` on `/spend/logs/ui`

### What part of LiteLLM is this about?

Proxy

### LiteLLM is hiring a founding backend engineer, are you interested in joining us and shipping to all our users?

No

### Twitter / LinkedIn details

https://www.linkedin.com/in/μ„Έν™˜-κΉ€-a31543202/

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (1 events)
#0 of 0 Β· 31d17h50m16s ago β€” entered Β· #import:https:::github.com:berriai:litellm post #3019
The right issue is substantially harder: it requires designing and integrating a new security-sensitive, cryptographic audit mechanism with callback lifecycle behavior, durable chaining, key management, verification tooling, performance considerations, and broad testing. The left issue is a narrowly scoped authorization configuration change involving existing read-only routes.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search