P2-D (parent): Enterprise platform features (RBAC, SCIM, audit, customer portal, prompt management, batch/files/fine-tune passthroughs)

Background

LiteLLM ships a thick enterprise/platform layer. ai-gateway has admin Bearer + a basic admin UI. Catch-up backlog after the core P0+P1 are done.

Backlog (each spawns its own child issue when scheduled)

Identity & access

• RBAC roles (proxy_admin / proxy_admin_viewer / internal_user / team) + scope checks on every admin endpoint
• SCIM 2.0 user/group provisioning endpoint (Entra ID / Okta / Workspace push)
• IP allowlist (per-org / per-key)
• Custom auth Python/Lua hook surface (callback into operator code)

Audit

• `audit_log` table + endpoint (every CRUD on models/keys/budgets/etc., who/when/what)
• Export to S3 / Sentinel / SIEM

Customer-facing

• End-user / consumer portal (separate from admin UI) — let downstream developers see their own usage / rotate their own keys
• Public API key gallery / catalog page

Prompt management

• Prompt template CRUD (versions, variables, A/B)
• Integrations with Langfuse / Humanloop / dotprompt / GitLab / BitBucket as the source of truth

OpenAI-API-equivalent passthroughs

• `/batches` (OpenAI Batch API)
• `/files` (OpenAI Files API)
• `/fine_tuning/jobs` (OpenAI Fine-Tune API)
• `/realtime` WebSocket (OpenAI Realtime)
• `/vector_stores` + `/vector_stores/{id}/files` (OpenAI Vector Stores) → bridge to Pinecone / Qdrant / Weaviate / Chroma / Milvus / MongoDB Atlas

Cost catalog

• `model_prices_and_context_window.json` per provider/model — replace flat `usd_per_1k_tokens` on ApiKey with real per-model pricing
• Auto-update mechanism (pull from upstream JSON or LiteLLM's catalog)

Pattern

Each is a substantial cross-repo project (DP + CP + UI + e2e). Track here, scope individually when prioritized.

No files, tests, or entry points are named. Start by selecting one capability and creating the child issue promised by this backlog, then map its DP, CP, UI, and e2e scope. Done should be defined separately for that capability before implementation begins.