docs(jwt): list the rag routes in the default team_allowed_routes

[shivamrawat1]

Summary

The litellm fix for LIT-9370 adds /rag/ingest, /v1/rag/ingest, /rag/query and /v1/rag/query to the default JWT team_allowed_routes. This updates the defaults line in the JWT auth docs to match, and it notes that teams overriding the list need to add the rag routes back

Companion to BerriAI/litellm#45497

Link to Devin session: https://app.devin.ai/sessions/3c64bf5ed39446d78fff9bccc0b6a790
Open in Devin Desktop: https://app.devin.ai/desktop/session/3c64bf5ed39446d78fff9bccc0b6a790?variant=devin
Requested by: @shivamrawat1

---

Note

Low Risk
Documentation-only change with no runtime or security behavior impact.

Overview
Updates the JWT auth docs so the documented default team_allowed_routes matches the proxy change from LIT-9370: team JWTs now include /rag/ingest, /v1/rag/ingest, /rag/query, and /v1/rag/query alongside the existing OpenAI, info, MCP, and Anthropic message routes.

The override note now warns that a custom team_allowed_routes list replaces the default, so operators must explicitly re-add MCP, /v1/messages, and the RAG paths if teams still need them.

^{Reviewed by Cursor Bugbot for commit ef1cdb6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
litellm	Ready	Preview	Oct 9, 2026 3:40am UTC

[mateo-berri]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ef1cdb6. Configure here.}