{"record":{"id":"6576f7aec728432c","repo":"JuliusBrussee/caveman","slug":"bedrock-mantle-endpoint-is-not-enabled","errorCode":null,"errorMessage":"bedrock Mantle endpoint is not enabled","messagePattern":"bedrock Mantle endpoint is not enabled","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/providers/bedrock/routing.go","lineNumber":183,"sourceCode":"\tswitch kind {\n\tcase endpointRuntime:\n\t\tif !RegionAllowed(region) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock region %q is not on the allowlist\", region)\n\t\t}\n\t\tmodelID, action := parseModelPath(req.URL.Path)\n\t\tif modelID == \"\" || action == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"bedrock request path %q does not name a model and action\", req.URL.Path)\n\t\t}\n\t\tif !actionAllowed(action) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock action %q is not allowed\", action)\n\t\t}\n\t\tif !modelAllowed(modelID) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock model %q is not on the allowlist\", modelID)\n\t\t}\n\t\tbase.Path = strings.TrimRight(base.Path, \"/\") + strings.TrimPrefix(req.URL.Path, \"/bedrock\")\n\tcase endpointMantle:\n\t\tif !env.Bool(\"CAVE_BEDROCK_MANTLE_ENABLED\", false) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle endpoint is not enabled\")\n\t\t}\n\t\tif !MantleRegionAllowed(region) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle region %q is not on the allowlist\", region)\n\t\t}\n\t\tif !mantleActionAllowed(req.URL.Path) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle path %q is not allowed\", req.URL.Path)\n\t\t}\n\t\tbase, err = resolveMantleBase(base, region)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tbase.Path = strings.TrimRight(base.Path, \"/\") + strings.TrimPrefix(req.URL.Path, \"/bedrock\")\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"bedrock request path %q is not allowed\", req.URL.Path)\n\t}\n\tbase.RawQuery = req.URL.RawQuery\n\n\tif env.IsProduction() {","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/proxy/providers/bedrock/routing.go#L165-L201","documentation":"The Bedrock Mantle endpoint (bedrock-mantle.<region>.api.aws, the Anthropic Messages wire on a separate AWS surface) is deployment-opt-in: its IAM service, model coverage, quotas, and stream wire differ from Bedrock Runtime. ResolveUpstreamURL refuses every /bedrock/anthropic/... request unless CAVE_BEDROCK_MANTLE_ENABLED is explicitly set to true.","triggerScenarios":"Any request whose path starts with /bedrock/anthropic/ (e.g. POST /bedrock/anthropic/v1/messages) while the CAVE_BEDROCK_MANTLE_ENABLED environment variable is unset or false at proxy start.","commonSituations":"A client configured for the Mantle/Anthropic-on-Mantle route but the operator never enabled the flag; the flag set in a shell but not in the proxy's service environment (systemd unit, container env); operator upgraded and forgot to re-apply the opt-in env var.","solutions":["Set CAVE_BEDROCK_MANTLE_ENABLED=true in the proxy's process environment and restart the proxy","Confirm the variable is visible to the actual proxy process (e.g. systemctl show-environment, docker exec env) not just your shell","If Mantle is not intended, switch the client to the Runtime route (/bedrock/model/<modelId>/invoke or converse) instead","Check provider docs: Mantle is opt-in because model coverage and billing differ from Runtime"],"exampleFix":"# before (proxy env)\n# CAVE_BEDROCK_MANTLE_ENABLED unset -> /bedrock/anthropic/v1/messages rejected\n# after\nCAVE_BEDROCK_MANTLE_ENABLED=true","handlingStrategy":"validation","validationCode":"if os.Getenv(\"CAVE_BEDROCK_MANTLE_ENABLED\") != \"true\" && strings.HasPrefix(path, \"/bedrock/anthropic/\") {\n\t// enable the flag or reroute before sending\n}","typeGuard":null,"tryCatchPattern":"resp, err := client.Do(req)\nif err != nil && strings.Contains(err.Error(), \"Mantle endpoint is not enabled\") {\n\t// set CAVE_BEDROCK_MANTLE_ENABLED=true and restart, or fall back to\n\t// POST /bedrock/model/<id>/invoke\n}","preventionTips":["Declare CAVE_BEDROCK_MANTLE_ENABLED in the deployment manifest (systemd unit / compose / helm) not ad-hoc shells","Smoke-test one Mantle request after every deploy of the proxy config","Route Mantle traffic only from clients whose config documents the opt-in"],"tags":["bedrock","mantle","feature-flag","env-var"],"backgroundTag":"feature-not-enabled","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}