Security advisory — Malicious litellm versions 1.82.7 and 1.82.8 were removed from PyPI (potential API key exfiltration). Uninstall them, rotate exposed credentials, and upgrade to a safe release (e.g. 1.82.9+). Run pip show litellm to verify. PyPI · README

Admin Console API

Base URL: http://localhost:3001

Admin Console API

Source root: apps/admin-console/src/app/api/

Page root: apps/admin-console/src/app/

Base URL: http://localhost:3001

All /api/admin/*, /api/policy/*, /api/audit/*, and /api/metering/* routes require an admin session and RBAC scope checks.

Page routes

PathModule
/loginLogin
/dashboardOverview
/iam, /iam/users, /iam/departments, /iam/roles, /iam/bulk-importIdentity and access
/auditGateway audit
/metering, /metering/quotaToken usage / quota
/policyPolicy rule center
/admin/modelsModel service
/admin/channelsGateway Channel
/settings/ssoSSO Provider

Auth

MethodPathDescription
POST/api/auth/loginAdmin-console password login
POST/api/auth/logoutLog out
GET/api/auth/sessionCurrent session
GET/POST/api/auth/sso/oidc/*, /api/auth/sso/saml/*SSO (same as portal)

IAM

MethodPathScope example
GET/api/admin/usersuser:read
POST/api/admin/usersuser:create
GET/PATCH/DELETE/api/admin/users/:iduser:read/update/delete
POST/api/admin/users/:id/reset-passworduser:manage
GET/PUT/api/admin/users/:id/modelsmodel:manage — visible-model assignment
GET/POST/api/admin/departmentsdept:*
GET/PATCH/DELETE/api/admin/departments/:id
GET/POST/api/admin/rolesrole:*
PATCH/DELETE/api/admin/roles/:id
GET/api/admin/roles/:id/users
POST/api/admin/iam/bulk-importCSV bulk import

Model service

MethodPathDescription
GET/POST/api/admin/providersProvider list / create
GET/PATCH/DELETE/api/admin/providers/:id
POST/api/admin/providers/:id/testConnectivity probe
POST/api/admin/providers/:id/modelsAdd a model
PATCH/DELETE/api/admin/providers/:id/models/:modelNameEnable / disable a model

Provider API keys are stored as AES-GCM ciphertext in api_key_cipher (key AGX_PROVIDER_SECRET_KEY).

Gateway Channel

MethodPathDescription
GET/POST/api/admin/channelsChannel CRUD
GET/PUT/DELETE/api/admin/channels/:id
GET/api/admin/channels/healthAggregated Channel health
GET/api/gateway/healthGateway process probe

Policy rule center

MethodPathDescription
GET/POST/api/policy/packsRule packs
PATCH/DELETE/api/policy/packs/:code
GET/POST/api/policy/rulesRules (draft/active)
PATCH/DELETE/api/policy/rules/:idSoft delete → grayed out + restore
POST/api/policy/publishPublish snapshot
GET/api/policy/publishesPublish history
POST/api/policy/publishes/:id/rollbackRollback
POST/api/policy/testSample test (merged with form preview)

Audit

MethodPathScope
POST/api/audit/queryaudit:read:all or audit:read:dept
POST/api/audit/exportaudit:export
GET/api/audit/chain-verifyaudit:read:all — checksum chain verification

Metering

MethodPathDescription
POST/api/metering/queryFour-dimensional query
POST/api/metering/exportExport
GET/PUT/api/metering/quotaTenant quota read / write

SSO Provider management

MethodPathDescription
GET/POST/api/admin/sso/providersProvider CRUD
PATCH/DELETE/api/admin/sso/providers/:id
POST/api/admin/sso/providers/:id/testConfig test
POST/api/admin/sso/providers/:id/healthHealth check
GET/api/admin/sso/providers/statsStats

Client-secret encryption key: SSO_PROVIDER_SECRET_KEY.

Internal API (Gateway fetch)

See internal-api.md. Path prefix /api/internal/.

Key environment variables

VariablePurpose
ADMIN_CONSOLE_LOGIN_EMAIL / ADMIN_CONSOLE_LOGIN_PASSWORDPassword login
ADMIN_CONSOLE_SESSION_SECRETSession signing
GATEWAY_BASE_URLGateway health check
GATEWAY_INTERNAL_TOKENInternal API Bearer
GATEWAY_INTERNAL_BASE_URLChannel health aggregation (distinct from gateway 8088)
AGX_PROVIDER_SECRET_KEYProvider key encryption
SSO_PROVIDER_SECRET_KEYSSO secret encryption

Made-with: Damon Li