8 views
-/https://github.com/berriai/litellm/issues/31078
GitHub · issue

#31078 [Bug]: internal_user budget exceeded blocks model discovery endpoints (/v1/models, /models)

  • State: open
  • Author: @urainshah
  • Labels: bug, proxy

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

When a user with role internal_user or internal_user_viewer has their budget exceeded, calling `GET /v1/models `or `GET /models `returns a 400 budget_exceeded error instead of the model list.

A proxy admin with an exhausted budget is unaffected — they can still list models.

Expected: 200 OK with the model list. Budget enforcement should only block inference routes (/chat/completions, /completions, etc.), not read-only model discovery.

### Steps to Reproduce

1. Create an internal user with 0 budget 2. Generate a key for that user 3. Try hitting these endpoints `GET /v1/models `or `GET /models ` Observed: 400 budget_exceeded

Expected: 200 OK with model list

### Relevant log output

```shell

```

### What part of LiteLLM is this about?

Proxy

### What LiteLLM version are you on ?

v1.83.14-stable

### Twitter / LinkedIn details

_No response_

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (3 events)
#0 of 0 · 31d19h51s ago — entered · #import:https:::github.com:berriai:litellm post #1838
Dark mode is harder because it spans the frontend design system, component styling, theme state, contrast validation, and likely persistence across the admin panel. The backend authorization-budget defect is narrower, primarily requiring route-specific enforcement changes and regression coverage.
29570 requires broader provider integration, multimodal request translation, model registration, and compatibility testing; 31078 is a comparatively localized proxy authorization-path correction.
#0 of 0 · 31d18h48m27s ago — current · #import:https:::github.com:berriai:litellm post #2052
The harder change requires reconciling authentication and credential-resolution behavior across MCP discovery and invocation paths, with multiple auth modes and regression coverage. The easier change is a narrower proxy policy adjustment for read-only discovery routes, primarily involving middleware scope and endpoint tests.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search