docs(proxy): document require_managed_files setting

docs/proxy/config_settings.md

@@ -223,6 +223,7 @@ router_settings:
 | disable_hf_tokenizer_download | boolean | If true, it defaults to using the openai tokenizer for all models (including huggingface models). |
 | enable_json_schema_validation | boolean | If true, enables json schema validation for all requests. |
 | enable_key_alias_format_validation | boolean | If true, validates `key_alias` format on `/key/generate` and `/key/update`. Must be 2-255 chars, start/end with alphanumeric, only allow `a-zA-Z0-9_-/.@`. Default `false`. |
+| require_managed_files | boolean | Default `false`. When `true`, `POST /v1/files` requires `target_model_names` and rejects classic provider file uploads with `400`. Use to enforce LiteLLM managed files for file ownership and access control. [Further docs](./litellm_managed_files#optional-enforce-managed-files-on-upload) |
 | user_url_validation | boolean | Default `true`. When `true`, the proxy validates user-controlled URLs (e.g. OpenAPI `spec_path` when it is an `http(s)` URL, image URLs, and similar) before fetching: DNS is resolved and connections to non–globally-routable addresses (RFC1918, loopback, link-local, etc.) are blocked unless the **hostname in the URL** is listed in `user_url_allowed_hosts`. Set to `false` to skip validation (only if you trust who can supply URLs). **Must be set under `litellm_settings`**, not `general_settings`. |
 | user_url_allowed_hosts | array of strings | Hostnames allowed to resolve to private/internal IPs when `user_url_validation` is `true`. Match the host **as it appears in the URL** (e.g. `api.corp.internal`, `127.0.0.1`, `127.0.0.1:8080`, `[::1]:443`). For split-horizon DNS, allowlist the public hostname, not the resolved `10.x` address. **Must be set under `litellm_settings`**, not `general_settings`. See [MCP from OpenAPI](../mcp_openapi#internal-spec-urls-ssrf). |
 | disable_copilot_system_to_assistant | boolean | **DEPRECATED** - GitHub Copilot API supports system prompts. |

docs/proxy/litellm_managed_files.md

@@ -42,6 +42,28 @@ model_list:
 general_settings: 
   master_key: sk-1234  # alternatively use the env var - LITELLM_MASTER_KEY
   database_url: "postgresql://<user>:<password>@<host>:<port>/<dbname>" # alternatively use the env var - DATABASE_URL
+
+litellm_settings:
+  require_managed_files: true # optional - reject POST /v1/files without target_model_names
+```
+
+#### (Optional) Enforce managed files on upload
+
+By default, `POST /v1/files` falls back to the classic provider file path when `target_model_names` is omitted. Set `require_managed_files: true` under `litellm_settings` to require managed files on every upload.
+
+```yaml
+litellm_settings:
+  require_managed_files: true
+```
+
+When enabled, uploads without `target_model_names` return `400`. Existing managed-file behavior is unchanged when `target_model_names` is provided.
+
+```python
+# String (comma-separated for multiple models)
+extra_body={"target_model_names": "gpt-4o-mini-openai, gemini-2.0-flash"}
+
+# List (OpenAI Python SDK sends this as target_model_names[] in multipart form)
+extra_body={"target_model_names": ["gpt-4o-mini-openai"]}
 ```
 
 ### 2. Start proxy

docs/proxy/managed_batches.md

@@ -62,6 +62,10 @@ general_settings:
   # skip_batch_input_file_rate_limiting_for_models:
   #   - my-vllm-batch-model
 
+litellm_settings:
+  # Optional: require target_model_names on POST /v1/files (blocks classic file uploads)
+  # require_managed_files: true
+
 ```
 
 ### 2. Create Virtual Key