{"record":{"id":"0a94f8004c974f87","repo":"floci-io/floci","slug":"unknownservice","errorCode":"UnknownService","errorMessage":"Unsupported AWS service integration: \" + service","messagePattern":"Unsupported AWS service integration: \" \\+ service","errorType":"validation","errorClass":"AwsException","httpStatus":400,"severity":"error","filePath":"src/main/java/io/github/hectorvent/floci/services/apigateway/AwsServiceRouter.java","lineNumber":169,"sourceCode":"    public Response invoke(String service, String action, JsonNode requestBody, String region) {\n        LOG.debugv(\"AWS integration dispatch: {0}:{1} in {2}\", service, action, region);\n\n        try {\n            return switch (service) {\n                case \"states\" -> stepFunctionsHandler.handle(action, requestBody, region);\n                case \"dynamodb\" -> dynamoDbHandler.handle(action, requestBody, region);\n                case \"sqs\" -> sqsHandler.handle(action, requestBody, region);\n                case \"sns\" -> snsHandler.handle(action, requestBody, region);\n                case \"events\" -> eventBridgeHandler.handle(action, requestBody, region);\n                case \"ssm\" -> ssmHandler.handle(action, requestBody, region);\n                case \"kinesis\" -> kinesisHandler.handle(action, requestBody, region);\n                case \"logs\" -> logsHandler.handle(action, requestBody, region);\n                case \"monitoring\" -> metricsHandler.handle(action, requestBody, region);\n                case \"secretsmanager\" -> secretsManagerHandler.handle(action, requestBody, region);\n                case \"kms\" -> kmsHandler.handle(action, requestBody, region);\n                case \"cognito-idp\" -> cognitoHandler.handle(action, requestBody, region);\n                case \"acm\" -> acmHandler.handle(action, requestBody, region);\n                default -> throw new AwsException(\"UnknownService\",\n                        \"Unsupported AWS service integration: \" + service, 400);\n            };\n        } catch (AwsException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new AwsException(\"InternalError\",\n                    e.getMessage() != null ? e.getMessage() : \"Service invocation failed\", 500);\n        }\n    }\n\n    /**\n     * Dispatches an AWS query-protocol (form-encoded) integration request.\n     *\n     * <p>Used for {@code path/}-style integration URIs whose VTL request template renders an\n     * {@code application/x-www-form-urlencoded} body in the AWS query protocol, e.g.\n     * {@code Action=SendMessage&QueueUrl=...&MessageBody=...}. The {@code Action} parameter\n     * selects the operation, mirroring {@link io.github.hectorvent.floci.core.common.AwsQueryController}.\n     *","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/floci-io/floci/blob/62ff490619e7bd3554597c28c704081b4c15add5/src/main/java/io/github/hectorvent/floci/services/apigateway/AwsServiceRouter.java#L151-L187","documentation":"Thrown by API Gateway's AWS service integration router when an integration's URI names an AWS service that Floci does not route. invokeJson() switch-cases exactly these service names: dynamodb, sqs, sns, events, ssm, kinesis, logs, monitoring, secretsmanager, kms, cognito-idp, acm. Any other service token in the integration URI (e.g. 'lambda' via direct invoke, 's3', 'stepfunctions', or a typo like 'sqs2') falls to the default arm and yields UnknownService with HTTP 400.","triggerScenarios":"A RestApi method with integration type AWS whose URI is arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/... style but naming an unrouted service, or arn:aws:apigateway:<region>:<acct>:s3:path/..., or invoking the integration at runtime (or via test-invoke) with such a URI. Also triggered by typos in the service segment extracted from the integration URI.","commonSituations":"Porting APIs that integrate Step Functions, S3, or direct Lambda invokes through the generic AWS integration path — none are in the router's case list. Expecting LocalStack-level breadth from Floci's integration router. A service name that works in one Floci version but was never added, so the deploy succeeds and only the request fails.","solutions":["Check the integration's integrationUri/integration credentials URI and confirm the service token is one of: dynamodb, sqs, sns, events, ssm, kinesis, logs, monitoring, secretsmanager, kms, cognito-idp, acm.","For Lambda backends use integration type AWS_PROXY (Lambda proxy) instead of the generic service-router path — the router only covers direct service actions.","Fix typos in the service segment (e.g. 'sqs' not 'sqs2', 'events' not 'eventbridge').","If you need an unrouted service, switch the integration to HTTP_PROXY/HTTP pointing at that service's Floci endpoint, or raise a feature request for the service in Floci's router."],"exampleFix":"// before\nintegration: { type: \"AWS\", uri: \"arn:aws:apigateway:us-east-1:account:s3:path/bucket/key\", ... }\n\n// after\nintegration: { type: \"AWS\", uri: \"arn:aws:apigateway:us-east-1:account:sqs:path/123456789012/MyQueue\", ... }","handlingStrategy":"validation","validationCode":"// Java: whitelist the service before building the integration\nSet<String> ROUTED = Set.of(\"dynamodb\", \"sqs\", \"sns\", \"events\", \"ssm\", \"kinesis\",\n    \"logs\", \"monitoring\", \"secretsmanager\", \"kms\", \"cognito-idp\", \"acm\");\nString svc = uriServiceSegment(integrationUri); // lowercased, trimmed\nif (!ROUTED.contains(svc)) {\n    throw new UnsupportedOperationException(\n        \"Floci does not route AWS integration for service: \" + svc\n        + \"; use AWS_PROXY for lambda or HTTP_PROXY for others\");\n}","typeGuard":null,"tryCatchPattern":"catch (AwsException e) {\n    if (\"UnknownService\".equals(e.getCode())) {\n        // deterministic config error — fix the integration URI; retrying cannot help\n        throw new InvalidIntegrationException(e.getMessage(), e);\n    }\n    throw e;\n}","preventionTips":["Prefer AWS_PROXY (Lambda) or HTTP_PROXY integrations for services outside the router's list.","Validate integration URIs at deploy time in a pre-deploy hook, not at request time.","Pin your Floci version in CI and re-check the routed-service list on upgrade."],"tags":["apigateway","integration","routing","unsupported-service"],"backgroundTag":null,"analyzedSha":"62ff490619e7bd3554597c28c704081b4c15add5","analyzedAt":"2026-08-14T14:25:23.764Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}