Fix spend logs v2 route permissions

[ryan-crabbe-berri]

Relevant issues

Reported issue: /spend/logs/v2 returns Unauthorized for virtual keys with Key Type = Management.

Linear ticket

N/A

Pre-Submission checklist

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

uv run pytest tests/test_litellm/proxy/auth/test_route_checks.py -q
273 passed in 8.31s

uv run ruff check litellm/proxy/_types.py tests/test_litellm/proxy/auth/test_route_checks.py
All checks passed!

Type

🐛 Bug Fix
✅ Test

Changes

• Adds /spend/logs/v2 to spend-tracking and key-management route inventories.
• Adds route-check regressions verifying Management virtual keys can call /spend/logs/v2 and AI API virtual keys remain denied.

Slack Thread

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR fixes a bug where virtual keys with Key Type = Management received 401 Unauthorized when calling /spend/logs/v2, by adding the route to the appropriate permission groups in _types.py.

• Adds SPEND_LOGS_V2 = "/spend/logs/v2" to the KeyManagementRoutes enum and registers it in key_management_routes and spend_tracking_routes, exactly mirroring the treatment of the existing /spend/logs entry.
• Adds three new unit tests confirming the route is classified as a management route (not LLM API), that management virtual keys are allowed, and that LLM-API-only virtual keys are correctly denied with 403; also registers the route in ADMIN_VIEWER_LOGS_PAGE_ROUTES so admin-viewer tests cover it.

Confidence Score: 5/5

Safe to merge — the change is a minimal, targeted addition to route permission lists with no logic changes and full test coverage.

Both changed files are clean: _types.py follows the exact same pattern already used for /spend/logs, and the new tests are pure unit tests covering the allow/deny cases without real network calls. No existing tests were weakened and no auth logic was modified.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/_types.py	Adds SPEND_LOGS_V2 to KeyManagementRoutes enum and registers /spend/logs/v2 in both key_management_routes and spend_tracking_routes, matching the existing pattern for /spend/logs
tests/test_litellm/proxy/auth/test_route_checks.py	Adds three new unit tests verifying /spend/logs/v2 route classification and virtual key access control; also adds the route to ADMIN_VIEWER_LOGS_PAGE_ROUTES for viewer-role coverage

_{Reviews (1): Last reviewed commit: "Fix spend logs v2 route permissions" | Re-trigger Greptile}