fix(ui): hide admin-only Logs tabs from roles that cannot call their endpoints

[yuneng-berri]

TLDR

Problem this solves:

• Logs page fires two admin-only calls for internal users
• Both come back 401, so the tabs render empty
• Opening Deleted Keys wrongly activated the Audit Logs panel

How it solves it:

• Audit Logs and Deleted Teams tabs now require an admin role
• Hidden tabs are never mounted, so no request goes out
• Active tab is derived from the visible tabs, not a fixed index

User Flow

Before: an internal user opens the Logs page and two of its four tabs are dead ends that quietly get rejected by the gateway

1. They sign in at https://litellm-domain/ui/ with an account whose role is Internal User
2. They open https://litellm-domain/ui/?page=logs and see four tabs: Request Logs, Audit Logs, Deleted Keys, Deleted Teams
3. On load, the page issues GET https://litellm-domain/v2/team/list?page=1&page_size=100&status=deleted, which comes back 401 with "Only admin users can query all teams/other teams"
4. They click Deleted Keys, and the page issues GET https://litellm-domain/audit?page=1&page_size=50, which comes back 401 with "Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route=/audit"
5. They click Audit Logs and Deleted Teams and both show an empty table with no explanation of why

After: the same user sees only the two tabs their account can actually load, and the page makes no rejected calls

1. They sign in at https://litellm-domain/ui/ with an account whose role is Internal User
2. They open https://litellm-domain/ui/?page=logs and see two tabs: Request Logs and Deleted Keys
3. On load, the page issues GET https://litellm-domain/spend/logs/ui for their own requests and GET https://litellm-domain/key/list?status=deleted, both 200, and no call to /audit or /v2/team/list
4. They click Deleted Keys and the deleted keys table loads on its own, with no request to /audit
5. A Proxy Admin opening the same page still sees all four tabs, and Audit Logs and Deleted Teams load their data as before

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Captured at 30c4898, against a live proxy on localhost:4000 and the dashboard dev server on localhost:3000

Proxy and dev server:

PYTHONPATH="$PWD:$PWD/enterprise" python litellm/proxy/proxy_cli.py --config litellm/proxy/dev_config.yaml --detailed_debug --reload --use_v2_migration_resolver 2>&1 | tee litellm.log

cd ui/litellm-dashboard && npm run dev

Create the internal user the UI steps below use, then give it a password so it can sign in:

curl -s -X POST http://localhost:4000/user/new -H "Authorization: Bearer $LITELLM_MASTER_KEY" -H "Content-Type: application/json" -d '{"user_email":"gating-demo@example.com","user_role":"internal_user","user_alias":"gating-demo"}'

curl -s -X POST http://localhost:4000/user/update -H "Authorization: Bearer $LITELLM_MASTER_KEY" -H "Content-Type: application/json" -d '{"user_id":"<user_id from the call above>","password":"<pick one>"}'

Both endpoints reject that user's key and accept the master key. INTERNAL_KEY is the key field returned by /user/new:

for ep in "/audit?page=1&page_size=1" "/v2/team/list?status=deleted&page=1&page_size=100"; do for who in INTERNAL MASTER; do if [ "$who" = "INTERNAL" ]; then K="$INTERNAL_KEY"; else K="$LITELLM_MASTER_KEY"; fi; printf '=== GET %s [%s key] ===\n' "$ep" "$who"; curl -s -w '\nHTTP %{http_code}\n' -H "Authorization: Bearer $K" "http://localhost:4000$ep" | head -c 320; printf '\n\n'; done; done

=== GET /audit?page=1&page_size=1 [INTERNAL key] ===
{"error":{"message":"Authentication Error, Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route=/audit. Your role=internal_user. Your user_id=edd610****************************62","type":"auth_error","param":"None","code":"401"}}
HTTP 401

=== GET /audit?page=1&page_size=1 [MASTER key] ===
{"audit_logs":[{"id":"16513a6c-ade0-40dc-8769-f9db39add14b","updated_at":"2026-08-01T16:52:02.514000Z","changed_by":"default_user_id","changed_by_api_key":"","action":"updated","table_name":"LiteLLM_UserTable","object_id":"default_user_id","before_value":{"spend":0.0,"teams":["a4e2ed0f-c5fc-45fc-9ba6-aba27b7d2261","3df
HTTP 200

=== GET /v2/team/list?status=deleted&page=1&page_size=100 [INTERNAL key] ===
{"detail":{"error":"Only admin users can query all teams/other teams. Your user role=internal_user"}}
HTTP 401

=== GET /v2/team/list?status=deleted&page=1&page_size=100 [MASTER key] ===
{"teams":[{"team_alias":"v-team","team_id":"9189c8aa-367f-4731-aefc-c6670724cb7c","organization_id":null,"admins":[],"members":[],"members_with_roles":[{"user_id":"default_user_id","user_email":null,"role":"admin"},{"user_id":"7807f6e8-32a3-4de4-827f-4a082e4c45be","user_email":"v-user@example.com","role":"user"}],"team
HTTP 200

Screenshots to take, as the internal user first:

1. Sign in at http://localhost:3000/ as gating-demo@example.com with the password set above, open the browser devtools Network tab, then go to http://localhost:3000/logs/
2. Screenshot the tab strip: only Request Logs and Deleted Keys are there
3. Filter the Network tab on audit and then on team/list, and screenshot both: no request to /audit, and no request to /v2/team/list
4. Click Deleted Keys and screenshot the deleted keys table loading, with the Network tab still showing no /audit request
5. Click back to Request Logs and screenshot the request log rows loading

Then as an admin:

6. Sign in at http://localhost:3000/ with the master key credentials and go to http://localhost:3000/logs/
7. Screenshot the tab strip: all four tabs are there
8. Click Audit Logs and screenshot the audit rows plus the 200 on GET /audit in the Network tab
9. Click Deleted Teams and screenshot the deleted teams table plus the 200 on GET /v2/team/list?status=deleted

Type

🐛 Bug Fix

Changes

Audit Logs and Deleted Teams are gated on two new capabilities in the shared capability map that PR #35812 introduced for Tool Policies, so a role that cannot call the endpoint never sees the tab and the panel behind it never mounts. Everything else on the page is untouched: Request Logs and Deleted Keys stay open to internal users

Tab selection previously treated index 0 as Request Logs and every other index as Audit Logs, so opening Deleted Keys or Deleted Teams activated the audit panel and sent its request. The active tab is now looked up in the visible tab list, which keeps working once tabs are filtered out by role

Tests cover the capability map for both new entries, the tab visibility for internal users and admins, and a network-level check that renders the real panels with the fetch boundary stubbed: an internal user reaches the network for deleted keys but never for /audit or /v2/team/list, while an admin gets both. Removing either gate fails four of them, and restoring the old index mapping fails three

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

The PR gates Audit Logs and Deleted Teams behind shared admin capabilities and maps tab selection through the filtered visible-tab list. It adds unit and integration coverage for role-based visibility, panel mounting, request suppression, and corrected tab activation.

Confidence Score: 5/5

The PR appears safe to merge with the admin-only panels withheld from unauthorized roles and the remaining tabs mapped correctly.

The visible tabs and mounted panels now use the same capability-filtered list, while the added tests cover both authorized and unauthorized request paths without revealing a concrete regression.

Important Files Changed

Filename	Overview
ui/litellm-dashboard/src/components/view_logs/index.tsx	Filters admin-only tabs before rendering and derives active panel state from the selected visible tab without an accepted correctness issue.
ui/litellm-dashboard/src/utils/capabilities.ts	Adds dedicated audit-log and deleted-team capabilities backed by the existing administrator-role set.
ui/litellm-dashboard/src/components/view_logs/index.integration.test.tsx	Verifies internal users do not issue admin-only requests while administrators retain access to both endpoints.
ui/litellm-dashboard/src/components/view_logs/index.test.tsx	Covers role-based tab visibility, panel mounting, and selection behavior after filtering.
ui/litellm-dashboard/src/utils/capabilities.test.ts	Covers grants and denials for both newly introduced capabilities.

_{Reviews (1): Last reviewed commit: "fix(ui): hide admin-only Logs tabs from ..." | Re-trigger Greptile}