fix(bedrock): allowlist Bedrock Invoke body fields and filter all anthropic-beta values

[mateo-berri]

Relevant issues

Fixes a 400 from Bedrock Invoke when Claude Code (or any client on a newer Anthropic extension) calls bedrock/us.anthropic.claude-opus-4-7 through the /v1/messages pass-through:

{"type":"error","error":{"type":"invalid_request_error","message":"context_management: Extra inputs are not permitted"}}

The narrow trigger is Claude Code sending context_management on every request. But the underlying pattern — Claude Code sends Anthropic-direct features, LiteLLM forwards them to Bedrock, Bedrock 400s on anything it doesn't recognize — will repeat whenever Anthropic ships a new body field or beta header. This PR closes both leak points.

What changed

Two fail-safes in the messages/invoke transformation (litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py):

1. Top-level body fields → typed allowlist

New BedrockInvokeAnthropicMessagesRequest TypedDict in litellm/types/llms/bedrock.py captures the Bedrock Invoke Anthropic Messages body schema. The runtime allowlist is derived from __annotations__ so the type and the filter share one definition — editing the type automatically updates the filter. Anchored to the AWS reference page in the TypedDict docstring and the transform comment.

Fields (13 total): anthropic_version, anthropic_beta, messages, system, max_tokens, stop_sequences, temperature, top_p, top_k, tools, tool_choice, thinking, metadata. The first 11 come straight from the AWS docs; thinking and metadata are part of the Anthropic Messages surface Bedrock implements but aren't spelled out on that AWS page (thinking is actively constructed for Opus 4.5 / Sonnet 4 extended thinking).

Drops context_management, output_config, speed, mcp_servers, container, inference_geo, cache_control top-level, internal litellm_metadata, and any future Anthropic addition Claude Code starts sending. output_format stays as an active inline-schema conversion rather than a plain strip. Stripped keys logged at DEBUG.

An exact-set assertion test pins the resolved allowlist so any future edit forces a conscious review — you can't silently broaden or narrow the surface.

2. anthropic-beta values → filtered + transformed for the full union (not just auto-injected)

Previously the code only ran filter_and_transform_beta_headers over auto-injected betas (beta_set - user_beta_set) and union'd user-provided values back in untouched. That left a real hole: a client (Claude Code, any SDK) on a new Anthropic-direct beta — e.g. advisor-tool-2026-03-01, or the context-management-2025-06-27 header that pairs with the body-field fix above — gets forwarded as-is and 400s. It also skipped the Bedrock-side rename (e.g. advanced-tool-use-2025-11-20 → tool-search-tool-2025-10-19), so even supported betas could fail because of Anthropic-spelling.

Mental model flip: in a proxy deployment the client doesn't know the backend, so its beta-header declarations are advisory; the provider mapping is authoritative. The code now filters + transforms the full beta_set, and warns at WARNING when a user-provided beta gets dropped so intentional overrides leave a breadcrumb.

Drive-by test fix

tests/test_litellm/llms/bedrock/test_anthropic_beta_support.py::test_messages_transformation_anthropic_beta asserted on output-128k-2025-02-19 passing through — a beta that's null in the Bedrock mapping and would 400 at runtime. The test was encoding the old buggy-pass-through as expected behavior. Rewrote it against context-1m-2025-08-07 (which IS in the Bedrock mapping) to preserve the actual intent.

Scope

Messages pass-through only. The same user-beta bypass exists in chat/invoke_transformations/ but that path is the OpenAI-format → Bedrock route where manual beta-header use is more common and filter behavior may need different trade-offs — intentionally left as follow-up.

Pre-Submission checklist

• Added tests in tests/test_litellm/llms/bedrock/messages/invoke_transformations/test_anthropic_claude3_transformation.py:
  • test_bedrock_invoke_allowlist_exact_contents — exact-set pin on the resolved allowlist
  • test_bedrock_messages_strips_context_management — reproduces the reported trace
  • test_bedrock_messages_allowlist_filters_anthropic_only_fields — allowlist vs 8 Anthropic-only/internal fields
  • test_bedrock_messages_filters_user_provided_unsupported_beta_header — unsupported user beta dropped, supported one passes
  • test_bedrock_messages_renames_user_provided_aliased_beta_header — user-provided alias rewritten to Bedrock-side spelling
• make test-unit — ran full tests/test_litellm/llms/bedrock/ suite, 485 tests pass
• Scope isolated to Bedrock Invoke's Anthropic Messages path
• Greptile review requested

Screenshots / Proof of Fix

Before: Claude Code → LiteLLM proxy → bedrock/us.anthropic.claude-opus-4-7 returns 400 "context_management: Extra inputs are not permitted" (trace 8fa3e31a-8027-46e7-a77a-276eef3ae500).

After: the context_management body field and any unsupported beta-header values are stripped before signing. Per-case regression tests green on this branch and red on main.

Type

🐛 Bug Fix

Changes

• litellm/types/llms/bedrock.py — new BedrockInvokeAnthropicMessagesRequest TypedDict
• litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py — allowlist derived from TypedDict, beta-header full-union filter
• tests/test_litellm/llms/bedrock/messages/invoke_transformations/test_anthropic_claude3_transformation.py — 5 new tests
• tests/test_litellm/llms/bedrock/test_anthropic_beta_support.py — drive-by: updated test to use a bedrock-supported beta

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR fixes a 400 \"Extra inputs are not permitted\" error on Bedrock Invoke by (1) adding a TypedDict-driven allowlist that strips any top-level body field Bedrock doesn't recognise (catching context_management, output_config, speed, mcp_servers, and future additions in one pass) and (2) applying the Bedrock beta-header mapping to the full union of auto-injected and user-provided anthropic-beta values instead of only the auto-injected subset.

The TypedDict design (BedrockInvokeAnthropicMessagesRequest) is a clean single-source-of-truth; four of the five promised regression tests are solid. The one missing test (test_bedrock_invoke_allowlist_exact_contents — the exact-set pin the PR description specifically called out as a forced-review guard) and the lack of a feature flag for the user-beta behavioral change are the only noteworthy gaps.

Confidence Score: 5/5

Safe to merge; all remaining findings are P2 style/coverage gaps that don't affect correctness on the happy path.

The core fix (allowlist + full-union beta filtering) is correct and well-tested for the reported failure mode. All open findings are P2: a missing test that was promised but not added, a backwards-compatibility note (the affected scenario — user-provided betas that previously 400'd at Bedrock — was already broken), and a minor redundant function call. No P0/P1 issues identified.

anthropic_claude3_transformation.py (backwards-compat note on user beta filtering) and the test file (missing exact-set allowlist pin test).

Important Files Changed

Filename	Overview
litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py	Core transformation logic: adds TypedDict-driven allowlist filtering (step 7) and moves full-union beta filtering to cover user-provided headers too; removes dedicated output_config pop (now handled by allowlist). Logic is sound but includes a redundant per-beta filter call for the warning log and a backwards-incompatible behavioral change for user-supplied betas with no feature flag.
litellm/types/llms/bedrock.py	Adds BedrockInvokeAnthropicMessagesRequest TypedDict with 13 allowlisted fields anchored to the AWS docs; clean single-source-of-truth design with a helpful docstring. No issues.
tests/test_litellm/llms/bedrock/messages/invoke_transformations/test_anthropic_claude3_transformation.py	Four of the five promised new tests are present and well-scoped. The exact-set allowlist pin test (test_bedrock_invoke_allowlist_exact_contents) mentioned as a critical guard in the PR description is absent.
tests/test_litellm/llms/bedrock/test_anthropic_beta_support.py	Drive-by fix: replaces output-128k-2025-02-19 (null/unsupported in Bedrock mapping, old test encoded buggy pass-through) with context-1m-2025-08-07 (properly supported). Change is correct and improves test validity.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Client Request
/v1/messages → Bedrock] --> B[transform_anthropic_messages_request]
    B --> C[Steps 1-5: build request,
pop output_format, remove custom tools]
    C --> D[Step 6: Build beta_set
user_beta_set + auto_betas]
    D --> E[filter_and_transform_beta_headers
full beta_set through Bedrock mapping]
    E --> F{filtered_betas
non-empty?}
    F -- Yes --> G[Set anthropic_beta
in request]
    F -- No --> H[Skip anthropic_beta]
    G --> I[Step 7: Allowlist filter
BedrockInvokeAnthropicMessagesRequest
.__annotations__.keys]
    H --> I
    I --> J{Field in
allowlist?}
    J -- Yes --> K[Keep field]
    J -- No --> L[Strip field
+ DEBUG log]
    K --> M[Signed Bedrock
InvokeModel request]
    L --> M

    style E fill:#d4edda
    style I fill:#d4edda
    style L fill:#fff3cd

Loading

_{Reviews (5): Last reviewed commit: "chore: make `uv` newer than 0.10 allowab..." | Re-trigger Greptile}

[ishaan-berri]

Why is this not just a type, Bedrock Invoke Request body ?

[mateo-berri]

Great call out -- it's a type now

[Rainson12]

is there any workaround available until this is merged? Seems like claude code is not working for me with litellm as its not just happening with opus 4.7 but also 4.6 and sonnet 4.6 when using aws bedrock?

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
29203053	Triggered	Generic Password	6da9ee9	.circleci/config.yml	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[mateo-berri]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id GitGuardian status Secret Commit Filename
29203053 Triggered Generic Password 6da9ee9 .circleci/config.yml View secret
🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Seems like this is a result of merging origin/litellm_internal_staging

[mateo-berri]

is there any workaround available until this is merged? Seems like claude code is not working for me with litellm as its not just happening with opus 4.7 but also 4.6 and sonnet 4.6 when using aws bedrock?

@Rainson12 For now, add this header to your settings file: CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS": "1"

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[mateo-berri]

Tested working on:

Claude Code v2.1.116
bedrock/us.anthropic.claude-opus-4-6-v1, bedrock/us.anthropic.claude-opus-4-7, and bedrock/us.anthropic.claude-sonnet-4-6 with max effort