{"record":{"id":"e0e43c42edf02e09","repo":"openai/openai-python","slug":"the-bedrock-endpoint-hostname-does-not-match-the","errorCode":null,"errorMessage":"The Bedrock {endpoint} hostname does not match the selected `{expected_endpoint}` endpoint.","messagePattern":"The Bedrock (.+?) hostname does not match the selected `(.+?)` endpoint\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/providers/bedrock.py","lineNumber":217,"sourceCode":"        auth: BedrockAwsAuth | None = None,\n    ) -> None:\n        self._config = config\n        self._base_url = base_url\n        self._auth = auth\n\n    def _validate_request(self, request: httpx2.Request) -> bytes:\n        _assert_provider_owns_authorization(request)\n        if not _same_origin(request.url, self._base_url):\n            raise OpenAIError(\n                \"Refusing to sign a Bedrock request for an origin other than the configured provider URL.\"\n            )\n\n        canonical_endpoint = _parse_bedrock_endpoint_hostname(request.url.host)\n        if canonical_endpoint is not None:\n            endpoint, region = canonical_endpoint\n            expected_endpoint = \"runtime\" if self._config.service == \"bedrock\" else \"mantle\"\n            if endpoint != expected_endpoint:\n                raise OpenAIError(\n                    f\"The Bedrock {endpoint} hostname does not match the selected `{expected_endpoint}` endpoint.\"\n                )\n            if region != self._config.region:\n                raise OpenAIError(\n                    f\"The Bedrock endpoint region `{region}` does not match the SigV4 region `{self._config.region}`.\"\n                )\n\n        return _body_for_signing(request)\n\n    def _sign(self, request: httpx2.Request, *, auth: BedrockAwsAuth, body: bytes) -> None:\n        for header in _AWS_SIGNING_HEADERS:\n            request.headers.pop(header, None)\n\n        signed_headers = auth.sign(\n            method=request.method,\n            url=str(request.url),\n            headers=dict(request.headers),\n            body=body,","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/providers/bedrock.py#L199-L235","documentation":"During SigV4 request validation, the hostname was recognized as a canonical Bedrock endpoint whose family (parsed from the host) differs from the endpoint the config expects: \"runtime\" when service == \"bedrock\", else \"mantle\". Signing for the wrong service family would produce an invalid signature, so it aborts.","triggerScenarios":"A SigV4-configured provider (service \"bedrock\" expecting bedrock-runtime.*) whose request URL uses e.g. `bedrock.us-east-1.amazonaws.com` or a mantle-family host, or vice versa.","commonSituations":"Mixing base_urls between the Bedrock runtime and another Bedrock service family; FIPS or alternate endpoints pasted from AWS docs without matching the provider configuration.","solutions":["Align the request hostname family with the configured service/endpoint, or change base_url to the runtime hostname.","Construct the provider without a custom base_url so the default hostname is used."],"exampleFix":"# before\nprovider = bedrock(region=\"us-east-1\", base_url=\"https://bedrock.us-east-1.amazonaws.com\", aws_credentials=...)\n\n# after\nprovider = bedrock(region=\"us-east-1\", aws_credentials=...)  # default bedrock-runtime host","handlingStrategy":"validation","validationCode":"import re\nm = re.match(r\"^(bedrock[a-z-]*)\\.\", URL(base_url).host or \"\")\nif m:\n    expected = \"runtime\"\n    assert m.group(1).endswith(expected), f\"hostname family {m.group(1)} incompatible\"","typeGuard":"def hostname_family_ok(base_url: str, service: str) -> bool:\n    m = re.match(r\"^(bedrock[a-z-]*)\\.\", URL(base_url).host or \"\")\n    expected = \"runtime\" if service == \"bedrock\" else \"mantle\"\n    return m is None or m.group(1).endswith(expected)","tryCatchPattern":"try:\n    provider = bedrock(base_url=base_url, region=region, aws_credentials=creds)\nexcept OpenAIError as e:\n    if \"does not match the selected\" in str(e):\n        provider = bedrock(region=region, aws_credentials=creds)  # default hostname\n    else:\n        raise","preventionTips":["Let the provider construct default hostnames instead of overriding base_url.","When overriding, derive config from the hostname family.","Document which service each base_url belongs to."],"tags":["bedrock","aws","sigv4","endpoint"],"backgroundTag":"endpoint-mismatch","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}