From a5ff668f5e2a9584796eaf87f569d611f1ff7d5d Mon Sep 17 00:00:00 2001
From: Ryan Crabbe <ryan@berri.ai>
Date: Thu, 26 Mar 2026 14:56:32 -0700
Subject: [PATCH] fix: add /user/bulk_update to management_routes so proxy
 admins can access it

/user/bulk_update was missing from the management_routes list in _types.py,
causing it to fall through to a 403 in non_proxy_admin_allowed_routes_check
even for proxy admin users. Also added it to the PROXY_ADMIN_VIEW_ONLY
blocked write operations list in route_checks.py to prevent view-only
admins from using it.
---
 litellm/proxy/_types.py            | 1 +
 litellm/proxy/auth/route_checks.py | 1 +
 2 files changed, 2 insertions(+)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index b59fc85d4b..8faf36df4c 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -525,6 +525,7 @@ class LiteLLMRoutes(enum.Enum):
         # user
         "/user/new",
         "/user/update",
+        "/user/bulk_update",
         "/user/delete",
         "/user/info",
         "/user/list",
diff --git a/litellm/proxy/auth/route_checks.py b/litellm/proxy/auth/route_checks.py
index 53cc88e3b1..26bbdef309 100644
--- a/litellm/proxy/auth/route_checks.py
+++ b/litellm/proxy/auth/route_checks.py
@@ -629,6 +629,7 @@ class RouteChecks:
                 in [
                     "/user/new",
                     "/user/delete",
+                    "/user/bulk_update",
                     "/team/new",
                     "/team/update",
                     "/team/delete",