feat: Allow Admin Viewers to Access Spend Logs

[kimsehwan96]

Relevant issues

Fixes #26582
Related: #17086 (closed by stale-bot without fix)

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

AS-IS

403 Forbidden with Admin Viewer role

TO-BE

User with Admin Viewer role can retrieve logs correctly.

Type

🆕 New Feature
✅ Test

Changes

• litellm/proxy/_types.py: 5 entries added to admin_viewer_routes
• tests/test_litellm/proxy/auth/test_route_checks.py: parametrized test test_proxy_admin_viewer_can_access_spend_logs (5 cases)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

This PR grants the PROXY_ADMIN_VIEW_ONLY role access to /spend/logs, /spend/logs/ui, /spend/logs/v2, /spend/logs/session/ui, and /spend/logs/ui/{request_id} by adding them to admin_viewer_routes. It also adds /spend/logs/v2 and /spend/logs/ui/{request_id} to spend_tracking_routes for parity with INTERNAL_USER / INTERNAL_USER_VIEW_ONLY, along with corresponding unit tests that use only mocks and make no real network calls.

Confidence Score: 5/5

Safe to merge — changes are additive route allowlist entries with no risk of privilege escalation or data mutation.

The PR only appends read-only endpoint strings to two allowlists and adds mock-only unit tests. All three affected roles (PROXY_ADMIN_VIEW_ONLY, INTERNAL_USER, INTERNAL_USER_VIEW_ONLY) receive access to the correct subset of routes, consistent with the existing design. No network calls, DB queries, or security boundaries are affected.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/_types.py	Adds /spend/logs/v2 and /spend/logs/ui/{request_id} to spend_tracking_routes (INTERNAL_USER parity) and all five spend log routes to admin_viewer_routes (PROXY_ADMIN_VIEW_ONLY fix); changes are minimal and surgical.
tests/test_litellm/proxy/auth/test_route_checks.py	Adds two parametrized unit tests (mock-only, no network calls) covering the new route access for PROXY_ADMIN_VIEW_ONLY and for INTERNAL_USER/INTERNAL_USER_VIEW_ONLY; follows the existing test pattern in this file.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Request to /spend/logs/*] --> B{non_proxy_admin_allowed_routes_check}
    B --> C{Role?}
    C -->|PROXY_ADMIN_VIEW_ONLY| D[_check_proxy_admin_viewer_access]
    D --> E{In management_routes?}
    E -->|No| F{In admin_viewer_routes?}
    F -->|YES after this PR| G[✅ Allow]
    F -->|No| H{In global_spend_tracking_routes?}
    H -->|No| I[❌ 403 Forbidden]
    C -->|INTERNAL_USER| J{In internal_user_routes?}
    J -->|YES - includes spend_tracking_routes| G
    J -->|No| I
    C -->|INTERNAL_USER_VIEW_ONLY| K{In internal_user_view_only_routes = spend_tracking_routes?}
    K -->|YES - /spend/logs/v2 added| G
    K -->|No| I

Loading

_{Reviews (3): Last reviewed commit: "Add /spend/logs/v2 and /spend/logs/ui/{r..." | Re-trigger Greptile}

[greptile-apps]

/spend/logs/v2 missing from spend_tracking_routes

/spend/logs/v2 is added to admin_viewer_routes but its three sibling routes (/spend/logs, /spend/logs/ui, /spend/logs/session/ui) are already present in spend_tracking_routes, making them accessible to INTERNAL_USER and INTERNAL_USER_VIEW_ONLY roles as well. The new public-API endpoint /spend/logs/v2 shares the same handler as /spend/logs/ui but will be inaccessible to those roles, creating an inconsistency where the internal UI path works but the public API path does not for the same users. Consider adding /spend/logs/v2 to spend_tracking_routes for parity.

[kimsehwan96]

Done: 1c8901f

[kimsehwan96]

@greptileai

[8keithkwok]

Thank you for this PR.

This appears to fix the exact issue we are currently hitting in production.

In our setup, a team member with role=user and "/spend/logs" permission can load the Request Logs list, but opening request/response details fails on /spend/logs/ui/{request_id} with an internal_user auth error.

We have already confirmed that store_prompts_in_spend_logs: true is enabled and that proxy admin users can view the same payload correctly, so the issue is the route allowlist rather than missing stored data.

Since this PR adds /spend/logs/ui/{request_id} to spend_tracking_routes, it looks like exactly the fix we need.

We are deploying from a prebuilt Docker image, so we cannot easily patch this locally. If possible, we would greatly appreciate a review/merge and inclusion in a near-term stable image release.

Thanks again.

[xanoysky]

We’re hitting this issue as well. This PR looks like the right fix for Admin Viewer/read-only access to spend logs.

Any chance this can be reviewed and included in an upcoming stable release?