fix(proxy): resolve team wildcard credentials for vector store files

[shivamrawat1]

Resolves LIT-3598
Issue
Vector store file requests (GET /v1/vector_stores/{id}/files) fail with invalid_api_key / api_key=None when a team has both a team-scoped OpenAI wildcard model (openai/) and other yaml/db models (e.g. Bedrock, Anthropic). The same request works when the team only has openai/

Cause
Team wildcard deployments like openai/* live in team-scoped router indexes (team_model_to_deployment_indices, team_pattern_routers), not the global router indexes. The vector store files endpoint resolves credentials via get_deployment_credentials_with_provider, which only checked global indexes, so it never found the team's openai/* deployment. With a single team model, a fallback set data["model"] and normal router routing still worked; with multiple team models that fallback was skipped and the request went to OpenAI without credentials

Fix
Add optional team_id to get_deployment_credentials_with_provider and fall back to team model indexes and team pattern routers when global lookup fails. Pass the caller's team_id from the vector store files endpoint into credential resolution so team wildcard OpenAI credentials are attached correctly

Review follow-ups: team_pattern_routers is now reset by set_model_list and pruned when a deployment is removed, so deleted or replaced team wildcard deployments can no longer serve stale credentials. Credential resolution also consults the team wildcard router before the global pattern router, so a global pattern like openai/* no longer shadows the team's own entry. Regression tests cover both in tests/test_litellm/test_router.py

Before:

After:

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ yucheng-berri
❌ Shivam Rawat

---

Shivam Rawat seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR fixes credential resolution for vector-store file endpoints when a team has both a team-scoped OpenAI wildcard (openai/*) and other non-OpenAI models. The root cause was that get_deployment_credentials_with_provider only checked global router indexes, missing team-scoped wildcard entries entirely.

• Credential resolution: get_deployment_credentials_with_provider now accepts an optional team_id and checks team_model_to_deployment_indices then team_pattern_routers before falling back to the global pattern router, so team wildcards take priority over identically-named global patterns.
• Lifecycle correctness: team_pattern_routers is now reset in set_model_list and pruned per-deployment in _remove_deployment_from_index_maps, preventing stale credentials from persisting after a deployment is deleted or the model list is reloaded.
• Test coverage: Four new mock-only regression tests cover the shadowing fix, post-delete stale access, remove_deployment correctness, and upsert/reload credential refresh.

Confidence Score: 5/5

Safe to merge — the change is narrowly scoped to credential lookup for the vector-store files passthrough endpoint and adds explicit lifecycle cleanup for team pattern routers.

The fix correctly threads team_id through both call sites in the endpoint, the three-step lookup in get_deployment_credentials_with_provider (exact team key then team pattern router then global pattern router) matches the intended priority order, and the team_pattern_routers reset/prune paths close the stale-credential window that existed before. The new tests exercise each of these paths without real network calls.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/vector_store_files_endpoints/endpoints.py	Passes caller's team_id to both get_deployment_credentials_with_provider call sites so team-scoped wildcard credentials are resolved correctly
litellm/router.py	Extends get_deployment_credentials_with_provider with team_id lookup (exact key then team_pattern_routers), resets team_pattern_routers in set_model_list, and prunes stale entries on delete_deployment
litellm/router_utils/pattern_match_deployments.py	Adds remove_deployment method that correctly prunes deployments by model_info.id and drops patterns whose deployment list becomes empty
tests/test_litellm/test_router.py	Adds four regression tests covering team wildcard priority over global wildcard, stale credential access after delete, remove_deployment correctness, and upsert/set_model_list refresh; all are mock-only with no real network calls

_{Reviews (2): Last reviewed commit: "test(router): cover PatternMatchRouter.r..." | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
litellm/router.py	86.66%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_list_vs_fil (72ac741) with litellm_internal_staging (010b200)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (6d5f24f) during the generation of this report, so 010b200 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[shivamrawat1]

@greptile review again with the new comments that resolve the p2 issues.