{"record":{"id":"e395014d52a28066","repo":"JuliusBrussee/caveman","slug":"bedrock-action-q-is-not-allowed","errorCode":null,"errorMessage":"bedrock action %q is not allowed","messagePattern":"bedrock action %q is not allowed","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/providers/bedrock/routing.go","lineNumber":175,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkind := endpointKindForPath(req.URL.Path)\n\tif configuredKind := strings.ToLower(strings.TrimSpace(route.EndpointKind)); configuredKind != \"\" && configuredKind != kind {\n\t\treturn nil, fmt.Errorf(\"bedrock configured endpoint kind %q does not allow request kind %q\", configuredKind, kind)\n\t}\n\tswitch kind {\n\tcase endpointRuntime:\n\t\tif !RegionAllowed(region) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock region %q is not on the allowlist\", region)\n\t\t}\n\t\tmodelID, action := parseModelPath(req.URL.Path)\n\t\tif modelID == \"\" || action == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"bedrock request path %q does not name a model and action\", req.URL.Path)\n\t\t}\n\t\tif !actionAllowed(action) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock action %q is not allowed\", action)\n\t\t}\n\t\tif !modelAllowed(modelID) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock model %q is not on the allowlist\", modelID)\n\t\t}\n\t\tbase.Path = strings.TrimRight(base.Path, \"/\") + strings.TrimPrefix(req.URL.Path, \"/bedrock\")\n\tcase endpointMantle:\n\t\tif !env.Bool(\"CAVE_BEDROCK_MANTLE_ENABLED\", false) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle endpoint is not enabled\")\n\t\t}\n\t\tif !MantleRegionAllowed(region) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle region %q is not on the allowlist\", region)\n\t\t}\n\t\tif !mantleActionAllowed(req.URL.Path) {\n\t\t\treturn nil, fmt.Errorf(\"bedrock Mantle path %q is not allowed\", req.URL.Path)\n\t\t}\n\t\tbase, err = resolveMantleBase(base, region)\n\t\tif err != nil {\n\t\t\treturn nil, err","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/proxy/providers/bedrock/routing.go#L157-L193","documentation":"Only a fixed set of Runtime actions is allowed on /bedrock/model/{modelId}/{action}: invoke, invoke-with-response-stream, converse, converse-stream, and count-tokens. Any other trailing action segment is rejected so clients cannot invoke arbitrary Bedrock APIs through the proxy.","triggerScenarios":"A /bedrock/model/{modelId}/{action} request where action is something other than the five allowed values — e.g. /invoke-agent, /converse-stream-v2, /embeddings, or a mixed-case variant like /Invoke.","commonSituations":"Trying to reach other Bedrock APIs (agents, guardrails, embeddings/titan-embed) through the model route; SDK emitting a newer action name the proxy has not allowlisted; case-sensitivity mistakes.","solutions":["Use one of the allowed actions: invoke, invoke-with-response-stream, converse, converse-stream, or count-tokens.","For embeddings or other Bedrock APIs, call them directly against AWS rather than through this proxy route.","Check casing — actions are matched exactly, lowercase."],"exampleFix":"// before\nPOST /bedrock/model/anthropic.claude-3-5-sonnet/invoke-agent\n// after\nPOST /bedrock/model/anthropic.claude-3-5-sonnet/converse","handlingStrategy":"validation","validationCode":"var allowedActions = map[string]bool{\n\t\"invoke\": true, \"invoke-with-response-stream\": true,\n\t\"converse\": true, \"converse-stream\": true, \"count-tokens\": true,\n}\nfunc actionAllowed(path string) bool {\n\tseg := path[strings.LastIndex(path, \"/\")+1:]\n\treturn allowedActions[seg]\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Map desired operations to the five allowlisted actions before building URLs.","Use lowercase action names exactly as allowlisted.","Route non-supported Bedrock APIs (agents, embeddings) outside this adapter."],"tags":["bedrock","aws","action","allowlist","validation"],"backgroundTag":"unsupported-enum-value","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}