Using the Proxy results in a 404

[sterankin]

Any help being able to see the request Claude uses as I am getting a 404 and i would like to see the url and api request claude is using to access my AWS Bedrock claude model.

Note my url and request works in curl and postman. for example:

curl --request POST \
  --url https://my-company-url-api-endpoint/bedrock/us.anthropic.claude-3-7-sonnet-20250219-v1:0 \
  --header 'Authorization: Bearer {{BearerToken}}' \
  --header 'content-type: application/json' \
  --data '{
  "messages": [
    {
      "role": "user",
      "content": [
        {
          "text": "Give me joke"
        }
      ]
    }
  ],
  "system": [
    {
      "text": "You are a helpful assistant."
    }
  ]
}'

I have a get_proxy_token.sh file which successfully gets a Bearer token ok. For example I can run:

~/.claude/get_proxy_token.sh

and it echos the token and sets the ACCESS_TOKEN env variable.

In my Claude settings.json (/Users/me/.claude/settings.json) I have the following settings:

{
  "env": {
    "CLAUDE_CODE_USE_BEDROCK": "1",
    "ANTHROPIC_BEDROCK_BASE_URL": "https://my-company-url-api-endpoint/bedrock/",
    "CLAUDE_CODE_SKIP_BEDROCK_AUTH": "1",
    "ANTHROPIC_MODEL": "us.anthropic.claude-3-7-sonnet-20250219-v1:0"
  },
  "apiKeyHelper": "/Users/me/.claude/get_proxy_token.sh",
  "CLAUDE_CODE_API_KEY_HELPER_TTL_MS": 3600000
}

Claude output in terminal:

> summarise this project
  ⎿  API Error: 404 Resource not found

I have tried adding --verbose and --debug flags when running claude code but i cannot see the output anywhere.

Any ideas why this might not be working and how I can debug it?

EDIT:

2 things. Claude code is adding /invoke or /invoke-with-stream to the url path at the end. I had to account for this in my api gateway as it was giving a 404.

However:

I added the following line to my shell script which gets the token:

echo "Script called at $(date)" >> /tmp/proxy_token_called.log

I can tell that claude code is not calling my apiKeyHelper file as the log is out output to the tmp file. It does output when I manually run the .sh file. The path is correct and it the script is executable.

Any ideas why claude is not running this file?

[ant-kurt]

Try setting env vars ANTHROPIC_LOG=debug DEBUG=1 to see the requests going out.

Run the /status command and it should tell you whether the apiKeyHelper is being used - you want it to be used for "Auth token", since you're trying to set Authorization: Bearer. Generally if there is an ANTHROPIC_AUTH_TOKEN env var set, that will take precedence over the apiKeyHelper.

[sterankin]

QQ

does the settings files need to be .settings.json or settings.json (no dot) -> the latter seemed to have fixed it?

Is it possible to stop claude code from streaming requests and responses? When i type a query it fires off requests for every letter almost

I tried this in the settings: "outputFormat": "json"

But claude code is erroring on the response:

API Error: Cannot read properties of undefined (reading 'map')

Our API Gateway doesn't support streaming responses due to logging requirements.

It also tries to call: /bedrock/model/us.anthropic.claude-3-5-haiku-20241022-v1:0/invoke-with-response-stream even thought I have: "ANTHROPIC_MODEL": "us.anthropic.claude-3-7-sonnet-20250219-v1:0" in the settings json.

Thanks

[ant-kurt]

Hey @sterankin, hope this info is helpful:

1. Settings files are documented here https://docs.anthropic.com/en/docs/claude-code/settings, and are named without a preceding .
2. To override the Haiku calls, you'll need to set ANTHROPIC_SMALL_FAST_MODEL
3. To disable the requests on typing, you can set DISABLE_NON_ESSENTIAL_MODEL_CALLS

We don't currently support disabling streaming currently, though there should be a fallback to non-streaming after failure. Do you think the API Error: Cannot read properties of undefined (reading 'map') is related to the gateway not handling streaming?

Also, can you provide more information about:

Our API Gateway doesn't support streaming responses due to logging requirements.

Is this a custom API gateway or something off-the-shelf? What's preventing the SSE responses from being logged?

[sterankin]

I'm not sure about the map error I think it could be due to the format difference between anthropics API response and the response from the AWS converse format for Claude.

For example this is an example response from Bedrock Claude:

{
  "output": {
    "message": {
      "content": [
        {
          "text": "The capital of France is Paris. It's been the country's capital since 987 AD and is home to about 2.1 million people in the city proper, with over 12 million in the greater metropolitan area."
        }
      ],
      "role": "assistant"
    }
  },
  "stopReason": "end_turn",
  "usage": {
    "inputTokens": 30,
    "outputTokens": 628,
    "totalTokens": 658
  },
  "metrics": {
    "latencyMs": 1275
  }
}

This is Claudes normal response:

{
  "id": "msg_01AbCdEfGhIjKlMnOpQrStUv",
  "type": "message",
  "role": "assistant",
  "model": "claude-3-5-sonnet-20241022",
  "content": [
    {
      "type": "text",
      "text": "The capital of France is Paris. It's been the country's capital since 987 AD and is home to about 2.1 million people in the city proper, with over 12 million in the greater metropolitan area."
    }
  ],
  "stop_reason": "end_turn",
  "stop_sequence": null,
  "usage": {
    "input_tokens": 12,
    "output_tokens": 35
  }
}

The map error might be due to the missing "type": "text", In the Bedrock response?

With regards to our custom APi. We use an Azure API Gateway which proxies requests. The XML based structure of the APIM doesn't support streaming responses as the logging requires the complete response (to log token usages and complete response text etc).

Streaming responses use Server-Sent Events (SSE) which support only one subscriber. This creates a challenge when using APIM's Event Hub Logger as it would consume the stream, preventing the actual client from receiving the response.

[ant-kurt]

Is your Gateway transforming the responses, or directly responding with what Bedrock sends? We do support Bedrock, as you can see if you connect directly (without proxy).

I can't currently speak to plans to disable streaming entirely, but do appreciate understanding the context you're working in.

[sterankin]

This is the error i am seeing:

response parsed {
  url: 'https://our-gateway-url-example/bedrock/model/us.anthropic.claude-3-7-sonnet-20250219-v1:0/invoke',
  status: 200,
  body: {
    '$metadata': {
      httpStatusCode: 200,
      requestId: '060d47d4-70ca-4518-8c02-e8c928329223',
      attempts: 1,
  ⎿  API Error: Cannot read properties of undefined (reading 'map')

This is the response that comes back from our API Gateway - perhaps the issue is here but since "output" is at the top level then it should parse ok afaik. We don't modify the response at all, however we do wrap the Bedrock response in an API Gateway response object structure instead of returning the raw Bedrock response.

    command = new ConverseCommand({
      modelId,
      messages: requestBody ? requestBody.messages : [],
      additionalModelRequestFields: requestBody?.additionalModelRequestFields || {},
      inferenceConfig: requestBody?.inferenceConfig || {},
      system: requestBody?.system || [],
      ...guardrailsParams,
    });

const response = await client.send(command);

return {
  statusCode: 200,
  body: response,
};

We then pull the "body" out of the response from AWS in our APIM:

<set-body>@(((JObject)context.Variables["originalBody"])["body"].ToString())</set-body>

Response:

{
  "$metadata": {
    "httpStatusCode": 200,
    "requestId": "aa930dae-3266-4eea-8ad8-034ee4b73588",
    "attempts": 1,
    "totalRetryDelay": 0
  },
  "metrics": {
    "latencyMs": 1484
  },
  "output": {
    "message": {
      "content": [
        {
          "text": "Why don't scientists trust atoms?\n\nBecause they make up everything!"
        }
      ],
      "role": "assistant"
    }
  },
  "stopReason": "end_turn",
  "trace": {
    "guardrail": {
      "inputAssessment": {
        "u1evrf0vp": {
          "invocationMetrics": {
            "guardrailCoverage": {
              "textCharacters": {
                "guarded": 14,
                "total": 14
              }
            },
            "guardrailProcessingLatency": 277,
            "usage": {
              "contentPolicyImageUnits": 0,
              "contentPolicyUnits": 1,
              "contextualGroundingPolicyUnits": 0,
              "sensitiveInformationPolicyFreeUnits": 0,
              "sensitiveInformationPolicyUnits": 0,
              "topicPolicyUnits": 0,
              "wordPolicyUnits": 0
            }
          }
        }
      },
      "outputAssessments": {
        "u1evrf0vp": [
          {
            "invocationMetrics": {
              "guardrailCoverage": {
                "textCharacters": {
                  "guarded": 67,
                  "total": 67
                }
              },
              "guardrailProcessingLatency": 254,
              "usage": {
                "contentPolicyImageUnits": 0,
                "contentPolicyUnits": 1,
                "contextualGroundingPolicyUnits": 0,
                "sensitiveInformationPolicyFreeUnits": 0,
                "sensitiveInformationPolicyUnits": 0,
                "topicPolicyUnits": 0,
                "wordPolicyUnits": 0
              }
            }
          }
        ]
      }
    }
  },
  "usage": {
    "cacheReadInputTokenCount": 0,
    "cacheReadInputTokens": 0,
    "cacheWriteInputTokenCount": 0,
    "cacheWriteInputTokens": 0,
    "inputTokens": 17,
    "outputTokens": 17,
    "totalTokens": 34
  }
}

According to the AWS docs, the https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.html#http-api-develop-integrations-lambda.proxy-format

Additionally is it possible to set custom headers. For example we use AWS Guardrails and we allow some clients to override the severity with a header, but this causes Claude Code to error e.g. "ANTHROPIC_CUSTOM_HEADERS": "{\"Guardrails\": \"low\"}",

with

API Error: Headers.delete: "{"Guardrails"" is an invalid header name.

[ant-kurt]

Wrapping in output is likely the issue. The response needs to look like this: https://docs.aws.amazon.com/bedrock/latest/userguide/model-parameters-anthropic-claude-messages-request-response.html.

ANTHROPIC_CUSTOM_HEADERS should be in curl-style format (Name: Value) with newline separation for multiple. I'll see if we can update these docs to call out the newline requirement.

[sterankin]

@ant-kurt

it could be caused by the fact that the AWS Bedrock converse format is different to the Anthropic Claude format:

https://docs.aws.amazon.com/bedrock/latest/userguide/conversation-inference-call.html#conversation-inference-call-response

Converse response In the response from Converse, the output field (ConverseOutput) contains the message (Message) that the model generates. The message content is in the content (ContentBlock) field and the role (user or assistant) that the message corresponds to is in the role field.

I assume this is the problem and Claude code doesn't handle the Converse command response?

More details on converse:

https://docs.aws.amazon.com/bedrock/latest/userguide/conversation-inference.html

"We recommend using the Converse API as it provides consistent API, that works with all Amazon Bedrock models that support messages. This means you can write code once and use it with different models. Should a model have unique inference parameters, the Converse API also allows you to pass those unique parameters in a model specific structure."

[nmudur]

@sterankin I was wondering if you found a solution to this. I think I encounter a similar error: I can query models via a test Python script but encounter the error below when I run it via Claude Code.

⎿  API Error: 400 {"error":{"code":400,"message":"Invalid request. Model not supported by <Organization>'s Apigee-based AWS Bedrock API. Please note that only 
     Anthropic-Claude, Meta-LLama and Mistral are supported at this time."}}

I think the issue is that my Python script works with anthropic.claude-3-5-haiku-20241022-v1:0 for example, but throws the same error if I query us.anthropic.claude-3-5-haiku-20241022-v1:0 or anthropic.claude-3-5-haiku-20241022-v1:0/invoke-with-response-stream. The CC request default includes the /invoke-with-response-stream suffix, even if I override the us. prefix.

[github-actions[bot]]

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

[catherinewu]

Closing as this issue is likely stale. Please re-open if this is still happening. Thanks!

[github-actions[bot]]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.