Check for existing issues

• I have searched the existing issues and checked that my issue is not a duplicate.

What happened?

/v1/models wildcard expansion has two related issues for team-scoped BYOK wildcard models.

1. Team-scoped wildcard deployment is not found

A team BYOK wildcard can be stored like this:

team.models = ["openai/*"]
router model_name = model_name_<team_id>_<uuid>
model_info.team_public_model_name = "openai/*"

But wildcard expansion looks up the route with:

llm_router.get_model_list(model_name="openai/*")

without passing the effective team_id. That misses the team-scoped deployment because the router row is keyed by the generated internal model_name, while the public wildcard name is stored in model_info.team_public_model_name.

The relevant code is in litellm/proxy/auth/model_checks.py in _get_wildcard_models():

model_list = llm_router.get_model_list(model_name=model)

Router.get_model_list() already accepts an optional team_id parameter and uses it to look up team_pattern_routers[team_id], but the caller never passes it.

2. LiteLLM falls back to generic provider expansion without hydrating credentials

When no deployment is found, LiteLLM falls back to:

get_known_models_from_wildcard("openai/*", litellm_params=None)

Even when a wildcard deployment IS found, provider discovery (_get_valid_models_from_provider_api in litellm/utils.py) only extracts api_key and api_base from litellm_params — it never resolves litellm_credential_name via CredentialAccessor.get_credential_values().

The correct credential resolution pattern already exists in the Router (e.g., during request routing), but is not applied on the discovery path.

With check_provider_endpoint: false, the fallback uses the static local provider catalog, so /v1/models appears to expand correctly. With check_provider_endpoint: true, the provider model-list call goes out without auth and returns no models.

Expected behavior: /v1/models should expand openai/* into concrete OpenAI model IDs when the team has access to a valid team-scoped BYOK wildcard deployment.

Actual behavior: /v1/models returns only literal openai/* rows and no concrete openai/<model> rows.

This affects model discovery. It does not necessarily mean inference fails with stored credentials.

Steps to Reproduce

1. Configure LiteLLM proxy with provider endpoint discovery enabled:

litellm_settings:
  check_provider_endpoint: true

1. Add a wildcard model to a team using a stored credential via the /model/new API:

curl -X POST "$BASE/model/new" \
  -H "Authorization: Bearer $ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model_name": "openai/*",
    "litellm_params": {
      "model": "openai/*",
      "custom_llm_provider": "openai",
      "litellm_credential_name": "my-openai-credential"
    },
    "model_info": {
      "team_id": "<team_id>"
    }
  }'

LiteLLM internally stores this as a team-scoped deployment with a generated model_name (e.g., model_name_<team_id>_<uuid>) and sets model_info.team_public_model_name = "openai/*".

3. Ensure the team allows the wildcard model:

```json
{
  "team_id": "<team_id>",
  "models": ["openai/*"]
}

1. Call /v1/models with a team key:

curl -fsS "$BASE/v1/models?team_id=$TEAM_ID&return_wildcard_routes=true" \
  -H "Authorization: Bearer $VIRTUAL_KEY" \
  | jq '[.data[]?.id | select(startswith("openai/"))] | {count: length, sample: .[:10]}'

1. Observe that only literal wildcard rows are returned — no concrete openai/<model> entries.

2. Compare with check_provider_endpoint: false — the static catalog fallback makes it appear to work.

Relevant log output

No stack trace observed. The endpoint succeeds but wildcard discovery returns no concrete provider models.

What part of LiteLLM is this about?

Proxy

What LiteLLM version are you on?

Observed on v1.83.10. The relevant code path still exists in v1.85.0-rc.2.

Suggested fix direction

1. Pass the effective team_id into wildcard expansion so the router can resolve team-scoped deployments:

llm_router.get_model_list(model_name=model, team_id=team_id)

1. Before calling provider model discovery, hydrate litellm_credential_name into the effective params. This mirrors the existing router credential resolution:

credential_name = litellm_params.get("litellm_credential_name")
if credential_name:
    credential_values = CredentialAccessor.get_credential_values(credential_name)
    litellm_params.update(credential_values)
    litellm_params.pop("litellm_credential_name", None)

1. Suggested regression tests:
   • check_provider_endpoint=true, team-scoped wildcard with litellm_credential_name: /v1/models returns concrete model IDs
   • check_provider_endpoint=true, global wildcard with litellm_credential_name: provider discovery receives hydrated credentials
   • check_provider_endpoint=false: wildcard still expands via static catalog
   • /v1/models response does not expose credential values

Twitter / LinkedIn details

N/A