litellm ryan march 31

docs/my-website/docs/proxy/config_settings.md

@@ -201,6 +201,7 @@ router_settings:
 | enable_json_schema_validation | boolean | If true, enables json schema validation for all requests. |
 | enable_key_alias_format_validation | boolean | If true, validates `key_alias` format on `/key/generate` and `/key/update`. Must be 2-255 chars, start/end with alphanumeric, only allow `a-zA-Z0-9_-/.@`. Default `false`. |
 | disable_copilot_system_to_assistant | boolean | **DEPRECATED** - GitHub Copilot API supports system prompts. |
+| default_team_params | object | Default parameters applied to every new team created via `/team/new` (including SSO auto-created teams). Only fills in fields not explicitly set in the request. Sub-fields: `max_budget` (float), `budget_duration` (string, e.g. `"30d"`), `tpm_limit` (integer), `rpm_limit` (integer), `team_member_permissions` (array of strings, e.g. `["/team/daily/activity", "/key/generate"]`), `models` (array of strings — only applied to SSO auto-created teams). |
 
 ### general_settings - Reference
 

docs/my-website/docs/proxy/self_serve.md

@@ -358,10 +358,15 @@ When you connect litellm to your SSO provider, litellm can auto-create teams. Us
 
 ```yaml showLineNumbers title="Default Params for new teams"
 litellm_settings:
-  default_team_params:             # Default Params to apply when litellm auto creates a team from SSO IDP provider
-    max_budget: 100                # Optional[float], optional): $100 budget for the team
-    budget_duration: 30d           # Optional[str], optional): 30 days budget_duration for the team
-    models: ["gpt-3.5-turbo"]      # Optional[List[str]], optional): models to be used by the team
+  default_team_params:             # Applied to all /team/new calls (including SSO auto-created teams) when the field is not explicitly set
+    max_budget: 100                # Optional[float]: $100 budget for the team
+    budget_duration: 30d           # Optional[str]: 30 days budget_duration for the team
+    models: ["gpt-3.5-turbo"]      # Optional[List[str]]: models for the team (only applied to SSO auto-created teams)
+    tpm_limit: 100000              # Optional[int]: tokens per minute limit
+    rpm_limit: 1000                # Optional[int]: requests per minute limit
+    team_member_permissions:       # Optional[List[str]]: permissions granted to non-admin team members
+      - "/team/daily/activity"     # Allow members to view team usage
+      - "/key/generate"            # Allow members to generate API keys
 ```
 
 
@@ -390,10 +395,14 @@ litellm_settings:
         max_budget_in_team: 100 # Optional[float], optional): $100 budget for the team. Defaults to None.
         user_role: "user" # Optional[str], optional): "user" or "admin". Defaults to "user"
 
-  default_team_params:             # Default Params to apply when litellm auto creates a team from SSO IDP provider
-    max_budget: 100                # Optional[float], optional): $100 budget for the team
-    budget_duration: 30d           # Optional[str], optional): 30 days budget_duration for the team
-    models: ["gpt-3.5-turbo"]      # Optional[List[str]], optional): models to be used by the team
+  default_team_params:             # Applied to all /team/new calls (including SSO auto-created teams) when the field is not explicitly set
+    max_budget: 100                # Optional[float]: $100 budget for the team
+    budget_duration: 30d           # Optional[str]: 30 days budget_duration for the team
+    models: ["gpt-3.5-turbo"]      # Optional[List[str]]: models for the team (only applied to SSO auto-created teams)
+    tpm_limit: 100000              # Optional[int]: tokens per minute limit
+    rpm_limit: 1000                # Optional[int]: requests per minute limit
+    team_member_permissions:       # Optional[List[str]]: permissions granted to non-admin team members
+      - "/team/daily/activity"
 
 
   upperbound_key_generate_params:    # Upperbound for /key/generate requests when self-serve flow is on

docs/my-website/docs/tutorials/msft_sso.md

@@ -123,10 +123,12 @@ Navigate to your litellm config file and set the following params
 
 ```yaml showLineNumbers title="litellm config with default_team_params"
 litellm_settings:
-  default_team_params:             # Default Params to apply when litellm auto creates a team from SSO IDP provider
-    max_budget: 100                # Optional[float], optional): $100 budget for the team
-    budget_duration: 30d           # Optional[str], optional): 30 days budget_duration for the team
-    models: ["gpt-3.5-turbo"]      # Optional[List[str]], optional): models to be used by the team
+  default_team_params:             # Applied to all /team/new calls (including SSO auto-created teams) when the field is not explicitly set
+    max_budget: 100                # Optional[float]: $100 budget for the team
+    budget_duration: 30d           # Optional[str]: 30 days budget_duration for the team
+    models: ["gpt-3.5-turbo"]      # Optional[List[str]]: models for the team (only applied to SSO auto-created teams)
+    team_member_permissions:       # Optional[List[str]]: permissions granted to non-admin team members
+      - "/team/daily/activity"     # Allow members to view team usage
 ```
 
 ### 3.2 Auto-create a new team on LiteLLM

litellm/proxy/_types.py

@@ -3809,6 +3809,10 @@ class OrganizationMemberUpdateResponse(MemberUpdateResponse):
 
 class TeamInfoResponseObjectTeamTable(LiteLLM_TeamTable):
     team_member_budget_table: Optional[LiteLLM_BudgetTable] = None
+    # Resources inherited from access groups (separate from direct assignments)
+    access_group_models: Optional[List[str]] = None
+    access_group_mcp_server_ids: Optional[List[str]] = None
+    access_group_agent_ids: Optional[List[str]] = None
 
 
 class TeamInfoResponseObject(TypedDict):

litellm/proxy/management_endpoints/key_management_endpoints.py

@@ -4382,6 +4382,42 @@ async def list_keys(
         )
 
 
+async def _apply_non_admin_alias_scope(
+    user_api_key_dict: UserAPIKeyAuth,
+    prisma_client: Any,
+    query_params: List[Any],
+    where_parts: List[str],
+) -> None:
+    """Append SQL scope conditions so non-admin users only see aliases for
+    keys they own or keys belonging to teams they are members of."""
+    scope_conditions: List[str] = []
+    if user_api_key_dict.user_id:
+        query_params.append(user_api_key_dict.user_id)
+        scope_conditions.append(f"user_id = ${len(query_params)}")
+
+    # Look up the user's teams from the user table
+    user_teams: List[str] = []
+    if user_api_key_dict.user_id:
+        user_row = await prisma_client.db.litellm_usertable.find_unique(
+            where={"user_id": user_api_key_dict.user_id}
+        )
+        if user_row is not None:
+            user_teams = getattr(user_row, "teams", []) or []
+
+    if user_teams:
+        team_placeholders = ", ".join(
+            f"${len(query_params) + i + 1}" for i in range(len(user_teams))
+        )
+        query_params.extend(user_teams)
+        scope_conditions.append(f"team_id IN ({team_placeholders})")
+
+    if scope_conditions:
+        where_parts.append(f"({' OR '.join(scope_conditions)})")
+    else:
+        # No user_id and no teams — return nothing
+        where_parts.append("FALSE")
+
+
 @router.get(
     "/key/aliases",
     tags=["key management"],
@@ -4395,6 +4431,9 @@ async def key_aliases(
     search: Optional[str] = Query(
         None, description="Search key aliases (case-insensitive partial match)"
     ),
+    team_id: Optional[str] = Query(
+        None, description="Filter aliases to keys belonging to this team"
+    ),
 ) -> Dict[str, Any]:
     """
     Lists key aliases with pagination and optional search.
@@ -4439,37 +4478,18 @@ async def key_aliases(
             LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY.value,
         ]
         if not is_proxy_admin:
-            scope_conditions: List[str] = []
-            if user_api_key_dict.user_id:
-                query_params.append(user_api_key_dict.user_id)
-                scope_conditions.append(f"user_id = ${len(query_params)}")
-
-            # Look up the user's teams from the user table
-            user_teams: List[str] = []
-            if user_api_key_dict.user_id:
-                user_row = await prisma_client.db.litellm_usertable.find_unique(
-                    where={"user_id": user_api_key_dict.user_id}
-                )
-                if user_row is not None:
-                    user_teams = getattr(user_row, "teams", []) or []
-
-            if user_teams:
-                team_placeholders = ", ".join(
-                    f"${len(query_params) + i + 1}" for i in range(len(user_teams))
-                )
-                query_params.extend(user_teams)
-                scope_conditions.append(f"team_id IN ({team_placeholders})")
-
-            if scope_conditions:
-                where_parts.append(f"({' OR '.join(scope_conditions)})")
-            else:
-                # No user_id and no teams — return nothing
-                where_parts.append("FALSE")
+            await _apply_non_admin_alias_scope(
+                user_api_key_dict, prisma_client, query_params, where_parts
+            )
 
         if search:
             query_params.append(f"%{search}%")
             where_parts.append(f"key_alias ILIKE ${len(query_params)}")
 
+        if team_id:
+            query_params.append(team_id)
+            where_parts.append(f"team_id = ${len(query_params)}")
+
         where_sql = " AND ".join(where_parts)
 
         count_sql = f'SELECT COUNT(*) AS count FROM "LiteLLM_VerificationToken" WHERE {where_sql}'