@acarmisc/backstage-plugin-litellm-backend 0.5.0 → 0.6.1

package/dist/bridge.d.ts

@@ -75,13 +75,3 @@ export declare function bridgeListKeys(client: LiteLLMClient, claims: BridgeClai
 export declare function bridgeGenerateKey(client: LiteLLMClient, claims: BridgeClaims, provisioningEnabled: boolean, provisioningDefaults: ProvisioningDefaults, logger: {
     info: (...args: unknown[]) => void;
 }, request: Partial<GenerateKeyRequest>, userIdDomain?: string): Promise<GenerateKeyResponse>;
-/**
- * Rotates the caller's key identified by alias, returning a fresh secret. The
- * bridge can't recover a usable secret from a listing (it's masked), so a CLI
- * that lost its cached key but whose stable alias still exists uses this to
- * rotate in place instead of minting a duplicate. Throws 404 when no key with
- * that alias exists for the caller — the CLI then mints one.
- */
-export declare function bridgeRegenerateKey(client: LiteLLMClient, claims: BridgeClaims, provisioningEnabled: boolean, provisioningDefaults: ProvisioningDefaults, logger: {
-    info: (...args: unknown[]) => void;
-}, alias: string, userIdDomain?: string): Promise<GenerateKeyResponse>;

package/dist/bridge.js

@@ -7,7 +7,6 @@ exports.resolveBridgeUserId = resolveBridgeUserId;
 exports.getOrProvisionUserFromClaims = getOrProvisionUserFromClaims;
 exports.bridgeListKeys = bridgeListKeys;
 exports.bridgeGenerateKey = bridgeGenerateKey;
-exports.bridgeRegenerateKey = bridgeRegenerateKey;
 /**
  * Bridge — lets CLI clients (Abby) list/mint LiteLLM virtual keys without ever
  * holding the LiteLLM master key.
@@ -153,20 +152,3 @@ async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioni
     };
     return client.generateKey(enriched);
 }
-/**
- * Rotates the caller's key identified by alias, returning a fresh secret. The
- * bridge can't recover a usable secret from a listing (it's masked), so a CLI
- * that lost its cached key but whose stable alias still exists uses this to
- * rotate in place instead of minting a duplicate. Throws 404 when no key with
- * that alias exists for the caller — the CLI then mints one.
- */
-async function bridgeRegenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, alias, userIdDomain) {
-    await getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain);
-    const userId = resolveBridgeUserId(claims, userIdDomain);
-    const keys = await client.listKeys(userId);
-    const match = keys.find(k => k.key_alias === alias);
-    if (!match) {
-        throw new provisioning_1.ProvisioningError('Key not found', `No key with alias "${alias}" for this identity; mint one first.`, false, 404);
-    }
-    return client.regenerateKey(match.token);
-}

package/dist/client.d.ts

@@ -57,13 +57,6 @@ export declare class LiteLLMClient {
     unblockKey(key: string): Promise<unknown>;
     resetKeySpend(key: string): Promise<unknown>;
     getAuditLogs(params: AuditLogsParams): Promise<PaginatedAuditLogs>;
-    /**
-     * Rotates an existing key in place, returning a fresh `sk-` secret while
-     * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM
-     * stores (the same value used for delete/update) — passed in the path because
-     * it isn't an `sk-` prefixed secret, so LiteLLM matches it without re-hashing.
-     */
-    regenerateKey(token: string): Promise<GenerateKeyResponse>;
     /**
      * Returns the proxy's model catalogue normalised to the ModelInfo shape.
      *
@@ -98,6 +91,6 @@ export declare class LiteLLMClient {
      *   - usage_by_key    → which keys drove cost / traffic (with key_alias + team_id from metadata)
      */
     private transformDailyActivity;
-    getUsage(startDate: string, endDate: string, userId?: string, _groupBy?: string): Promise<UsageMetrics>;
+    getUsage(startDate: string, endDate: string, userId?: string): Promise<UsageMetrics>;
     getTeamUsage(teamId: string, startDate: string, endDate: string): Promise<UsageMetrics>;
 }

package/dist/client.js

@@ -12,6 +12,11 @@ class LiteLLMClient {
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), this.timeout);
         try {
+            // Auth note: the LiteLLM OpenAPI spec declares the security scheme as an
+            // `x-litellm-api-key` header, but Bearer + master key is the deliberate,
+            // production-tested choice — LiteLLM's proxy accepts both, and Bearer is
+            // what every observed deployment actually uses. Do not "correct" this to
+            // match the spec literally without testing against a live gateway.
             const response = await fetch(`${this.baseUrl}${path}`, {
                 ...options,
                 signal: controller.signal,
@@ -204,15 +209,6 @@ class LiteLLMClient {
             query.set('sort_order', params.sort_order);
         return this.request(`/audit?${query.toString()}`);
     }
-    /**
-     * Rotates an existing key in place, returning a fresh `sk-` secret while
-     * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM
-     * stores (the same value used for delete/update) — passed in the path because
-     * it isn't an `sk-` prefixed secret, so LiteLLM matches it without re-hashing.
-     */
-    async regenerateKey(token) {
-        return this.request(`/key/${encodeURIComponent(token)}/regenerate`, { method: 'POST', body: JSON.stringify({}) });
-    }
     /**
      * Returns the proxy's model catalogue normalised to the ModelInfo shape.
      *
@@ -237,6 +233,8 @@ class LiteLLMClient {
                     supports_vision: info.supports_vision ?? m.supports_vision,
                     input_cost_per_token: info.input_cost_per_token ?? params.input_cost_per_token,
                     output_cost_per_token: info.output_cost_per_token ?? params.output_cost_per_token,
+                    max_input_tokens: info.max_input_tokens ?? m.max_input_tokens,
+                    max_output_tokens: info.max_output_tokens ?? m.max_output_tokens,
                 };
             });
             const filtered = normalised.filter(m => m.model_name);
@@ -404,7 +402,7 @@ class LiteLLMClient {
             daily_by_model,
         };
     }
-    async getUsage(startDate, endDate, userId, _groupBy) {
+    async getUsage(startDate, endDate, userId) {
         const params = new URLSearchParams({
             start_date: startDate,
             end_date: endDate,

package/dist/index.cjs.js

@@ -251,18 +251,6 @@ var LiteLLMClient = class {
     if (params.sort_order) query.set("sort_order", params.sort_order);
     return this.request(`/audit?${query.toString()}`);
   }
-  /**
-   * Rotates an existing key in place, returning a fresh `sk-` secret while
-   * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM
-   * stores (the same value used for delete/update) — passed in the path because
-   * it isn't an `sk-` prefixed secret, so LiteLLM matches it without re-hashing.
-   */
-  async regenerateKey(token) {
-    return this.request(
-      `/key/${encodeURIComponent(token)}/regenerate`,
-      { method: "POST", body: JSON.stringify({}) }
-    );
-  }
   /**
    * Returns the proxy's model catalogue normalised to the ModelInfo shape.
    *
@@ -286,7 +274,9 @@ var LiteLLMClient = class {
           supports_function_calling: info.supports_function_calling ?? m.supports_function_calling,
           supports_vision: info.supports_vision ?? m.supports_vision,
           input_cost_per_token: info.input_cost_per_token ?? params.input_cost_per_token,
-          output_cost_per_token: info.output_cost_per_token ?? params.output_cost_per_token
+          output_cost_per_token: info.output_cost_per_token ?? params.output_cost_per_token,
+          max_input_tokens: info.max_input_tokens ?? m.max_input_tokens,
+          max_output_tokens: info.max_output_tokens ?? m.max_output_tokens
         };
       });
       const filtered = normalised.filter((m) => m.model_name);
@@ -440,7 +430,7 @@ var LiteLLMClient = class {
       daily_by_model
     };
   }
-  async getUsage(startDate, endDate, userId, _groupBy) {
+  async getUsage(startDate, endDate, userId) {
     const params = new URLSearchParams({
       start_date: startDate,
       end_date: endDate,
@@ -480,6 +470,256 @@ var LiteLLMClient = class {
   }
 };
 
+// src/openapi.ts
+var openApiSpec = {
+  openapi: "3.1.0",
+  info: {
+    title: "LiteLLM Governance Plugin API",
+    version: "0.1.0",
+    description: "Backstage backend surface for the LiteLLM governance plugin. UI routes authenticate via the Backstage identity system; CLI bridge routes authenticate with a Keycloak access token."
+  },
+  servers: [
+    { url: "/api/litellm", description: "Backstage backend plugin mount point" }
+  ],
+  tags: [
+    { name: "System", description: "Health and configuration" },
+    { name: "User", description: "Current user info and provisioning" },
+    { name: "Keys", description: "Virtual key lifecycle" },
+    { name: "Models", description: "Model catalogue" },
+    { name: "Teams", description: "Team membership and usage" },
+    { name: "Usage", description: "Spend and traffic analytics" },
+    { name: "Audit", description: "Audit logs (RBAC-gated)" },
+    { name: "Provisioning", description: "Provisioning dry-run (RBAC-gated)" },
+    { name: "Bridge", description: "CLI bridge (Keycloak-token auth)" }
+  ],
+  paths: {
+    "/health": {
+      get: {
+        tags: ["System"],
+        summary: "Health check",
+        responses: {
+          "200": {
+            description: "Plugin health",
+            content: { "application/json": { schema: { type: "object", properties: {
+              status: { type: "string" },
+              provisioning: { type: "boolean" }
+            } } } }
+          }
+        }
+      }
+    },
+    "/config": {
+      get: {
+        tags: ["System"],
+        summary: "Public LiteLLM proxy base URL (for snippet generation)",
+        responses: {
+          "200": {
+            description: "Proxy URL",
+            content: { "application/json": { schema: { type: "object", properties: {
+              baseUrl: { type: "string" }
+            } } } }
+          }
+        }
+      }
+    },
+    "/openapi.json": {
+      get: {
+        tags: ["System"],
+        summary: "This OpenAPI document",
+        responses: { "200": { description: "OpenAPI 3.1 JSON" } }
+      }
+    },
+    "/user/info": {
+      get: {
+        tags: ["User"],
+        summary: "Get the current user's info and quotas",
+        responses: {
+          "200": { description: "User info" },
+          "404": { description: "User not found in LiteLLM (provisioning disabled)" }
+        }
+      }
+    },
+    "/keys": {
+      get: {
+        tags: ["Keys"],
+        summary: "List the caller's virtual keys",
+        responses: { "200": { description: "Array of keys" } }
+      }
+    },
+    "/keys/generate": {
+      post: {
+        tags: ["Keys"],
+        summary: "Generate a new virtual key",
+        requestBody: {
+          required: true,
+          content: { "application/json": { schema: { type: "object", properties: {
+            alias: { type: "string" },
+            models: { type: "array", items: { type: "string" } },
+            team_id: { type: "string" },
+            duration: { type: "string" },
+            max_budget: { type: "number", nullable: true, description: "Positive number caps spend; null = unlimited" },
+            tpm_limit: { type: "number" },
+            rpm_limit: { type: "number" }
+          } } } }
+        },
+        responses: {
+          "200": { description: "Generated key (includes the raw secret \u2014 shown once)" },
+          "400": { description: "Missing required fields" }
+        }
+      }
+    },
+    "/keys/{keyId}": {
+      delete: {
+        tags: ["Keys"],
+        summary: "Revoke/delete a virtual key (caller must own it)",
+        parameters: [{ name: "keyId", in: "path", required: true, schema: { type: "string" } }],
+        responses: { "200": { description: "Deleted" }, "403": { description: "Not the key owner" } }
+      }
+    },
+    "/keys/{keyId}/update": {
+      post: {
+        tags: ["Keys"],
+        summary: "Update alias / models / budget / limits (caller must own it)",
+        parameters: [{ name: "keyId", in: "path", required: true, schema: { type: "string" } }],
+        requestBody: { content: { "application/json": { schema: { type: "object" } } } },
+        responses: { "200": { description: "Updated" }, "403": { description: "Not the key owner" } }
+      }
+    },
+    "/keys/{keyId}/block": {
+      post: {
+        tags: ["Keys"],
+        summary: "Suspend a key without revoking (caller must own it)",
+        parameters: [{ name: "keyId", in: "path", required: true, schema: { type: "string" } }],
+        responses: { "200": { description: "Blocked" }, "403": { description: "Not the key owner" } }
+      }
+    },
+    "/keys/{keyId}/unblock": {
+      post: {
+        tags: ["Keys"],
+        summary: "Re-enable a blocked key (caller must own it)",
+        parameters: [{ name: "keyId", in: "path", required: true, schema: { type: "string" } }],
+        responses: { "200": { description: "Unblocked" }, "403": { description: "Not the key owner" } }
+      }
+    },
+    "/keys/{keyId}/reset_spend": {
+      post: {
+        tags: ["Keys"],
+        summary: "Zero out a key spend counter (caller must own it)",
+        parameters: [{ name: "keyId", in: "path", required: true, schema: { type: "string" } }],
+        responses: { "200": { description: "Spend reset" }, "403": { description: "Not the key owner" } }
+      }
+    },
+    "/models": {
+      get: {
+        tags: ["Models"],
+        summary: "List available LLM models",
+        responses: { "200": { description: "Model catalogue" } }
+      }
+    },
+    "/teams": {
+      get: {
+        tags: ["Teams"],
+        summary: "List teams the current user belongs to",
+        responses: { "200": { description: "Array of teams" } }
+      }
+    },
+    "/teams/{teamId}/usage": {
+      get: {
+        tags: ["Teams"],
+        summary: "Usage metrics for a team",
+        parameters: [
+          { name: "teamId", in: "path", required: true, schema: { type: "string" } },
+          { name: "start_date", in: "query", required: true, schema: { type: "string" } },
+          { name: "end_date", in: "query", required: true, schema: { type: "string" } }
+        ],
+        responses: { "200": { description: "Team usage" }, "400": { description: "Missing date range" } }
+      }
+    },
+    "/usage": {
+      get: {
+        tags: ["Usage"],
+        summary: "Usage metrics for the current user",
+        parameters: [
+          { name: "start_date", in: "query", required: true, schema: { type: "string" } },
+          { name: "end_date", in: "query", required: true, schema: { type: "string" } }
+        ],
+        responses: { "200": { description: "Usage metrics" }, "400": { description: "Missing date range" } }
+      }
+    },
+    "/audit": {
+      get: {
+        tags: ["Audit"],
+        summary: "Audit logs (gated by litellm.audit.group membership)",
+        parameters: [
+          { name: "page", in: "query", schema: { type: "integer" } },
+          { name: "page_size", in: "query", schema: { type: "integer" } },
+          { name: "start_date", in: "query", schema: { type: "string" } },
+          { name: "end_date", in: "query", schema: { type: "string" } },
+          { name: "action", in: "query", schema: { type: "string" } },
+          { name: "table_name", in: "query", schema: { type: "string" } },
+          { name: "changed_by", in: "query", schema: { type: "string" } }
+        ],
+        responses: { "200": { description: "Paginated audit logs" }, "403": { description: "Not configured or not authorized" } }
+      }
+    },
+    "/provisioning/preview": {
+      get: {
+        tags: ["Provisioning"],
+        summary: "Resolve which role a Backstage group maps to (dry-run)",
+        parameters: [
+          { name: "group", in: "query", required: true, schema: { type: "string" }, description: "e.g. group:default/ai-platform" }
+        ],
+        responses: {
+          "200": { description: "Resolved role and effective defaults" },
+          "400": { description: "Missing group parameter" },
+          "403": { description: "Not configured or not authorized" }
+        }
+      }
+    },
+    "/bridge/health": {
+      get: {
+        tags: ["Bridge"],
+        summary: "Bridge health + configured clientId (no auth)",
+        responses: { "200": { description: "Bridge health" } }
+      }
+    },
+    "/bridge/keys": {
+      get: {
+        tags: ["Bridge"],
+        summary: "List the caller virtual keys (Keycloak token auth)",
+        responses: { "200": { description: "Array of keys" }, "401": { description: "Invalid token" } }
+      },
+      post: {
+        tags: ["Bridge"],
+        summary: "Mint a virtual key for the caller (Keycloak token auth)",
+        requestBody: { content: { "application/json": { schema: { type: "object" } } } },
+        responses: { "200": { description: "Generated key" }, "401": { description: "Invalid token" } }
+      }
+    },
+    "/bridge/models": {
+      get: {
+        tags: ["Bridge"],
+        summary: "List available LLM models (Keycloak token auth)",
+        responses: { "200": { description: "Model catalogue" }, "401": { description: "Invalid token" } }
+      }
+    }
+  },
+  components: {
+    securitySchemes: {
+      backstageUserToken: {
+        type: "http",
+        scheme: "bearer",
+        description: "Backstage-issued user token (Authorization: Bearer <token>)."
+      },
+      keycloakAccessToken: {
+        type: "http",
+        scheme: "bearer",
+        description: "Raw Keycloak access token. Bridge routes only; verified against the realm JWKS."
+      }
+    }
+  }
+};
+
 // src/provisioning.ts
 function toLiteLLMUserId(userEntityRef, userIdDomain) {
   const name = userEntityRef.split("/").pop() ?? userEntityRef;
@@ -2213,28 +2453,6 @@ async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioni
   };
   return client.generateKey(enriched);
 }
-async function bridgeRegenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, alias, userIdDomain) {
-  await getOrProvisionUserFromClaims(
-    client,
-    claims,
-    provisioningEnabled,
-    provisioningDefaults,
-    logger,
-    userIdDomain
-  );
-  const userId = resolveBridgeUserId(claims, userIdDomain);
-  const keys = await client.listKeys(userId);
-  const match = keys.find((k) => k.key_alias === alias);
-  if (!match) {
-    throw new ProvisioningError(
-      "Key not found",
-      `No key with alias "${alias}" for this identity; mint one first.`,
-      false,
-      404
-    );
-  }
-  return client.regenerateKey(match.token);
-}
 
 // src/router.ts
 async function createRouter(options) {
@@ -2261,6 +2479,57 @@ async function createRouter(options) {
   router.get("/config", (_req, res) => {
     res.json({ baseUrl: publicBaseUrl });
   });
+  router.get("/openapi.json", (_req, res) => {
+    res.json(openApiSpec);
+  });
+  router.get("/provisioning/preview", async (req, res) => {
+    if (!auditGroup) {
+      res.status(403).json({ error: "Preview is not configured (litellm.audit.group not set)" });
+      return;
+    }
+    const tokenEntityRef = await resolveUserId(req, auth);
+    if (!tokenEntityRef) {
+      res.status(401).json({ error: "Authentication required" });
+      return;
+    }
+    const allowed = await isUserMemberOfGroup(
+      tokenEntityRef,
+      auditGroup,
+      catalogClient,
+      auth,
+      logger
+    );
+    if (!allowed) {
+      res.status(403).json({ error: "Access denied: not a member of the audit group" });
+      return;
+    }
+    const group = req.query.group?.trim();
+    if (!group) {
+      res.status(400).json({ error: "group query parameter is required (e.g. group=group:default/ai-platform)" });
+      return;
+    }
+    if (!roleConfigs.length) {
+      res.json({
+        group,
+        matched_role: null,
+        effective_defaults: provisioningDefaults,
+        note: "No litellm.provisioning.roles configured \u2014 every group receives the base defaults."
+      });
+      return;
+    }
+    try {
+      const matched = roleConfigs.find((rc) => rc.group === group);
+      const effective = matched ? applyRoleOverrides(provisioningDefaults, matched) : provisioningDefaults;
+      res.json({
+        group,
+        matched_role: matched?.group ?? null,
+        effective_defaults: effective
+      });
+    } catch (error) {
+      logger.error("Failed to resolve provisioning preview", error);
+      res.status(500).json({ error: error.message });
+    }
+  });
   router.get("/user/info", async (req, res) => {
     try {
       const tokenEntityRef = await resolveUserId(req, auth);
@@ -2319,22 +2588,26 @@ async function createRouter(options) {
       res.status(500).json({ error: error.message });
     }
   });
-  router.post("/keys/:keyId/regenerate", async (req, res) => {
-    try {
-      const { keyId } = req.params;
-      if (!keyId) {
-        res.status(400).json({ error: "keyId is required" });
-        return;
-      }
-      const tokenEntityRef = await resolveUserId(req, auth);
-      const result = await client.regenerateKey(keyId);
-      logger.info({ action: "key.rotate", userId: tokenEntityRef ?? "unknown", keyId });
-      res.json(result);
-    } catch (error) {
-      logger.error("Failed to rotate key", error);
-      res.status(500).json({ error: error.message });
+  async function authorizeKeyAction(req, keyId) {
+    const tokenEntityRef = await resolveUserId(req, auth);
+    const userId = tokenEntityRef ? toLiteLLMUserId(tokenEntityRef, userIdDomain) : req.query.user_id;
+    if (!userId) {
+      throw { status: 403, body: { error: "Cannot verify key ownership without an authenticated user" } };
     }
-  });
+    const ownKeys = await client.listKeys(userId);
+    const owns = ownKeys.some((k) => (k.token ?? k.key) === keyId);
+    if (!owns) {
+      throw { status: 403, body: { error: "Access denied: key does not belong to the caller" } };
+    }
+    return { tokenEntityRef, userId };
+  }
+  function sendOwnershipError(err, res) {
+    if (err && typeof err.status === "number" && err.body) {
+      res.status(err.status).json(err.body);
+      return true;
+    }
+    return false;
+  }
   router.post("/keys/generate", async (req, res) => {
     try {
       const body = req.body ?? {};
@@ -2400,12 +2673,13 @@ async function createRouter(options) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
-      const tokenEntityRef = await resolveUserId(req, auth);
+      const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
       const request = { ...req.body, key: keyId };
       const result = await client.updateKey(request);
       logger.info({ action: "key.update", userId: tokenEntityRef ?? "unknown", keyId });
       res.json(result);
     } catch (error) {
+      if (sendOwnershipError(error, res)) return;
       logger.error("Failed to update key", error);
       res.status(500).json({ error: error.message });
     }
@@ -2417,11 +2691,12 @@ async function createRouter(options) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
-      const deleteEntityRef = await resolveUserId(req, auth);
+      const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
       await client.deleteKeys({ keys: [keyId] });
-      logger.info({ action: "key.delete", userId: deleteEntityRef ?? "unknown", keyId });
+      logger.info({ action: "key.delete", userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
+      if (sendOwnershipError(error, res)) return;
       logger.error("Failed to delete key", error);
       res.status(500).json({ error: error.message });
     }
@@ -2429,11 +2704,12 @@ async function createRouter(options) {
   router.post("/keys/:keyId/block", async (req, res) => {
     try {
       const { keyId } = req.params;
-      const tokenEntityRef = await resolveUserId(req, auth);
+      const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
       await client.blockKey(keyId);
       logger.info({ action: "key.block", userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
+      if (sendOwnershipError(error, res)) return;
       logger.error("Failed to block key", error);
       res.status(500).json({ error: error.message });
     }
@@ -2441,11 +2717,12 @@ async function createRouter(options) {
   router.post("/keys/:keyId/unblock", async (req, res) => {
     try {
       const { keyId } = req.params;
-      const tokenEntityRef = await resolveUserId(req, auth);
+      const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
       await client.unblockKey(keyId);
       logger.info({ action: "key.unblock", userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
+      if (sendOwnershipError(error, res)) return;
       logger.error("Failed to unblock key", error);
       res.status(500).json({ error: error.message });
     }
@@ -2453,11 +2730,12 @@ async function createRouter(options) {
   router.post("/keys/:keyId/reset_spend", async (req, res) => {
     try {
       const { keyId } = req.params;
-      const tokenEntityRef = await resolveUserId(req, auth);
+      const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
       await client.resetKeySpend(keyId);
       logger.info({ action: "key.reset_spend", userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
+      if (sendOwnershipError(error, res)) return;
       logger.error("Failed to reset key spend", error);
       res.status(500).json({ error: error.message });
     }
@@ -2567,7 +2845,7 @@ async function createRouter(options) {
   });
   router.get("/usage", async (req, res) => {
     try {
-      const { start_date, end_date, group_by } = req.query;
+      const { start_date, end_date } = req.query;
       if (!start_date || !end_date) {
         res.status(400).json({ error: "start_date and end_date are required" });
         return;
@@ -2590,8 +2868,7 @@ async function createRouter(options) {
       const usage = await client.getUsage(
         start_date,
         end_date,
-        userId,
-        group_by
+        userId
       );
       res.json(usage);
     } catch (error) {
@@ -2669,28 +2946,6 @@ async function createRouter(options) {
         handleBridgeError(error, res);
       }
     });
-    router.post("/bridge/keys/regenerate", async (req, res) => {
-      try {
-        const claims = await requireClaims(req);
-        const alias = (req.body ?? {}).alias?.trim();
-        if (!alias) {
-          res.status(400).json({ error: "alias is required" });
-          return;
-        }
-        const result = await bridgeRegenerateKey(
-          client,
-          claims,
-          provisioningEnabled,
-          provisioningDefaults,
-          logger,
-          alias,
-          userIdDomain
-        );
-        res.json(result);
-      } catch (error) {
-        handleBridgeError(error, res);
-      }
-    });
     router.get("/bridge/models", async (req, res) => {
       try {
         await requireClaims(req);