JuliusBrussee/caveman · error

bedrock: exact request payload hash is unavailable

Error message

bedrock: exact request payload hash is unavailable

What it means

Error "bedrock: exact request payload hash is unavailable" thrown in JuliusBrussee/caveman.

Source

Thrown at proxy/providers/bedrock/signing.go:125

		}
	}
	return out, nil
}

// requestPayloadHash returns the hash of the exact post-transform wire body.
// Gateways install it in context after transforming. Direct adapter callers and
// verification probes can fall back to net/http's replayable GetBody contract.
// A non-replayable body without a bound hash fails closed instead of emitting a
// signature over bytes that may differ from the request on the wire.
func requestPayloadHash(ctx context.Context, req *http.Request) (string, error) {
	if hash, ok := providers.RequestPayloadHash(ctx); ok {
		return hash, nil
	}
	if req.Body == nil {
		return awssig.HashPayload(nil), nil
	}
	if req.GetBody == nil {
		return "", fmt.Errorf("bedrock: exact request payload hash is unavailable")
	}
	body, err := req.GetBody()
	if err != nil {
		return "", fmt.Errorf("bedrock: exact request payload hash is unavailable")
	}
	defer body.Close()
	raw, err := io.ReadAll(body)
	if err != nil {
		return "", fmt.Errorf("bedrock: exact request payload hash is unavailable")
	}
	return awssig.HashPayload(raw), nil
}

func credentialAuthKind(credential providers.Credential) (string, error) {
	kind := strings.ToLower(strings.TrimSpace(credential.AuthKind))
	switch kind {
	case "bedrock_api_key", "aws_access_keys":
		return kind, nil

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Provide the exact request payload so its hash can be computed for signing.

When it happens

Trigger: Thrown at proxy/providers/bedrock/signing.go:125 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/5f8e492218a1e648. Report an issue: GitHub.