fix(proxy): forward every method on the typesafe pass-through route

[yuneng-berri]

TLDR

Problem this solves:

• CircleCI's pass-through method test has been red on main since feat(proxy): add TypeSafe AI Jev evaluate passthrough with registry-priced spend tracking #41607
• The proxy answered 405 itself for PUT, DELETE and PATCH instead of letting TypeSafe answer
• test_models_by_provider also went red because typesafe is not a routable provider

How it solves it:

• The typesafe route forwards every method like the other REST pass-throughs, so TypeSafe decides
• A GHA unit test sends each method through the proxy to a mocked upstream so the PR gate catches this
• test_models_by_provider skips evaluation-mode providers the way it already skips search ones

User Flow

Before: a developer sending anything but GET or POST to /typesafe/... gets the proxy's own 405, and a TypeSafe endpoint added with another method would need a proxy release first

1. The proxy admin sets TYPESAFE_API_KEY and restarts the proxy
2. The developer sends PUT https://litellm-domain/typesafe/v1/systemone with their virtual key and a JSON body
3. The gateway answers 405 {"detail":"Method Not Allowed"} and nothing reaches TypeSafe

After: the same request is forwarded and TypeSafe's own answer comes back

1. The proxy admin sets TYPESAFE_API_KEY and restarts the proxy
2. The developer sends PUT https://litellm-domain/typesafe/v1/systemone with their virtual key and a JSON body
3. The gateway forwards it with the proxy's TypeSafe key and returns whatever TypeSafe answers, a 405 for today's API and a real response for any endpoint TypeSafe adds later

Relevant issues

Follows up #41607. CircleCI pipeline 89758 on main flagged both gaps: https://app.circleci.com/pipelines/github/BerriAI/litellm/89758

TypeSafe's public OpenAPI (v0.2.0 at https://api.typesafe.ai/openapi.json, read 2026-09-18) lists only POST /v1/systemone and GET /v1/models, and TypeSafe itself answers 405 to PUT, DELETE and PATCH today. #41607 mirrored that surface with GET and POST. The wider method set is this repo's pass-through convention, enforced by test_pass_through_routes_support_all_methods: the proxy forwards every method and the upstream decides, with the exemption list reserved for wire protocols that admit a single method like Amazon Comprehend Medical. That test only runs on CircleCI, so the PR gate never showed it

Registering typesafe in models_by_provider would have turned test_models_by_provider green too, but it was dropped on purpose. typesafe has no LlmProviders member, so a typesafe/* deployment fails to load, get_valid_models returns nothing for it, and its spend is priced straight from model_cost. The registry entry would only silence the test. The test already carves out search-mode providers for the same reason, so the carve-out now covers evaluation mode as well

Affected release

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• The handful of test files covering my change pass locally, e.g. uv run pytest tests/test_litellm/<your_test_file>.py -v. Leave the suites (make test-unit-*, make test-unit) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Shared setup. TYPESAFE_API_BASE points at a local echo server that answers every method with what it received, because no TypeSafe credentials are available on this machine; the proxy side, which is what changes here, is the real proxy

general_settings:
  master_key: sk-1234

TYPESAFE_API_KEY=sk-local TYPESAFE_API_BASE=http://127.0.0.1:53612 LITELLM_LOCAL_MODEL_COST_MAP=True \
  python -m litellm.proxy.proxy_cli --config config.yaml --port 53611

Before (7e03084)

1. curl -s -w '\nHTTP %{http_code}\n' -X PUT http://127.0.0.1:53611/typesafe/v1/systemone -H "Authorization: Bearer sk-1234" -H "Content-Type: application/json" -d '{"state":"x"}'
2. Observed output

{"detail":"Method Not Allowed"}
HTTP 405

After (50ccb2c)

1. curl -s -w '\nHTTP %{http_code}\n' -X PUT http://127.0.0.1:53611/typesafe/v1/systemone -H "Authorization: Bearer sk-1234" -H "Content-Type: application/json" -d '{"state":"x"}'
2. Observed output

{"upstream_saw": {"method": "PUT", "path": "/v1/systemone", "body": "{\"state\":\"x\"}"}}
HTTP 200

Type

🐛 Bug Fix
✅ Test

Caveats (if any)

Low

• The proof's upstream is a local echo server, not api.typesafe.ai
• The test_models_by_provider change only runs on CircleCI, hence the run-ci label

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[codspeed]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_/circleci-specific-sha-0cf414 (50ccb2c) with main (c25c098)¹}

Footnotes

1. No successful run was found on main (7e03084) during the generation of this report, so c25c098 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[greptile-apps]

Confidence Score: 4/5

The TypeSafe route change is sound, but the generated audit API regression and required behavioral test coverage should be fixed before merging

Findings

1.  Audit search typing removed ▶
2.  Test checks routing only ▶

Summary

This PR expands the TypeSafe pass-through route to accept PUT, DELETE, and PATCH and updates generated API artifacts

• Adds route-resolution coverage for the five supported pass-through methods
• Exempts evaluation-mode entries from the model-provider registry consistency test
• Accidentally removes an existing audit-log query parameter from the generated dashboard schema

_{Reviews (1) · Last reviewed commit: "chore(proxy): regenerate the OpenAPI sna..."}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!