bedrock-mantle.{region}.api.aws.
- APIs: Mantle speaks the OpenAI-compatible Responses and Chat Completions APIs plus the Messages API. Bedrock (
bedrock-runtime) speaks AWS-native InvokeModel / Converse. - Endpoint:
bedrock-mantle.{region}.api.awsvsbedrock-runtime.{region}.amazonaws.com, each with its own quotas. - Migration: Mantle is a drop-in for existing OpenAI SDK code — change only the base URL and API key.
- Best for: Mantle for OpenAI-style apps, stateful/agentic workflows (server-side tools,
previous_response_id), and the open-weight catalog. Bedrock forInvokeModel/Converse, non-text modalities (embeddings, images), and models not yet on Mantle.
Adding Models
This section explains the steps to add AWS Bedrock Mantle models and configure the required access controls.Navigate to AWS Bedrock Mantle Models in AI Gateway
AI Gateway > Models and select AWS Bedrock Mantle.
Add Account Name and Collaborators
@providername/@modelname. Add collaborators to your account — you can decide which users/teams have access to the models (User Role) and who can add/edit/remove models (Manager Role). Read more about access control here.Add Region and Authentication
bedrock-mantle endpoint is available (see the supported regions). Then provide the authentication details the gateway uses to reach Bedrock Mantle. Three methods are supported: AWS Access Key / Secret, Assumed Role (both use SigV4), and API Key.
Get AWS Authentication Details (IAM policies + credentials)
Get AWS Authentication Details (IAM policies + credentials)
bedrock-mantle (actions look like bedrock-mantle:CreateInference). You attach a policy to the IAM principal (user or role) the gateway uses.You can choose one of two approaches for the IAM policy.Option A — Quickstart (AWS managed policy)
The fastest path is to attach the AWS-managedAmazonBedrockMantleInferenceAccess policy to your principal. It is the narrowest managed policy sufficient for inference and covers both SigV4 and API key authentication, plus the AWS Marketplace subscription action needed for third-party models.AWS ships three managed policies for Bedrock Mantle:| Managed policy | Use it for |
|---|---|
AmazonBedrockMantleInferenceAccess | Running inference (recommended quickstart). Grants Get*/List*/CreateInference, CallWithBearerToken, and Marketplace subscribe. |
AmazonBedrockMantleFullAccess | Full access to all Bedrock Mantle operations. |
AmazonBedrockMantleReadOnly | Read-only visibility (no inference). |
Option B — Least-privilege (production hardening)
For production, attach a scoped policy granting only the actions the gateway uses. Bedrock Mantle resources are scoped to a Project, whose ARN follows this format:AmazonBedrockMantleInferenceAccess managed policy which already includes them:Once you have a policy, attach it to a principal and configure credentials in TrueFoundry using one of the methods below.Using AWS Access Key and Secret (SigV4)
- Create an IAM user (or choose an existing one) following these steps.
- Attach the IAM policy (Option A or B) to this user.
- Create an access key for this user as per this doc.
- Use this access key and secret while adding the provider account.
- Create an IAM role in your AWS account and attach the IAM policy (Option A or B) to it.
- Configure the trust policy so the gateway role can assume it. Use the appropriate role ARN based on your deployment:
- Gateway role ARN:
arn:aws:iam::416964291864:role/tfy-ctl-production-ai-gateway-deps
- Your gateway role ARN will look like:
arn:aws:iam::<your-aws-account-id>:role/<account-prefix>-truefoundry-deps
- Navigate to the AWS Management Console and open the Amazon Bedrock console at https://console.aws.amazon.com/bedrock.
- In the left navigation pane, select API keys.
- Choose Generate long-term API keys in the Long-term API keys tab and pick an expiry.
- Choose Generate and copy the API key value.
- Make sure the principal the key belongs to has
bedrock-mantle:CallWithBearerToken(see the warning under Option B). - Use this API key while adding the provider account.
Add Models
Select All to select all the models.+ Add Model at the end of the list and entering the model ID.| Model | Model ID |
|---|---|
| OpenAI GPT-5.5 | openai.gpt-5.5 |
| OpenAI GPT-5.4 | openai.gpt-5.4 |
| Anthropic Claude Opus 4.8 | anthropic.claude-opus-4-8 |
| Anthropic Claude Opus 4.7 | anthropic.claude-opus-4-7 |
| xAI Grok 4.3 | xai.grok-4.3 |
| Moonshot Kimi K2.5 | moonshotai.kimi-k2.5 |
| Google Gemma 3 27B | google.gemma-3-27b-it |
Inference
After adding the models, you can perform inference using an OpenAI-compatible API via the Playground or by integrating with your own application.
Supported APIs
Once your AWS Bedrock Mantle provider account is configured, the following API surfaces are available through the gateway. The table below summarizes each endpoint alongside platform feature support (tracing, cost tracking).- ✅ Supported by Provider and Truefoundry
- Supported by Provider, but not by Truefoundry
- Provider does not support this feature
| API | Endpoint | Tracing | Cost Tracking |
|---|---|---|---|
| Chat Completions | /chat/completions | ✅ | ✅ |
| Responses API | /responses | ✅ | ✅ |
| Messages API | /messages | ✅ | ✅ |
Chat Completions
Chat Completions
Streaming
Streaming
stream=True to start streaming responses and iterate over delta chunks. You may defensively check that chunk.choices is non-empty and delta.content is not None.Function calling / tools
Function calling / tools
tool_calls back as a tool role message, then request the final response. Use tool_choice to force the model to call a specific tool when you need deterministic behaviour.Structured outputs (JSON schema)
Structured outputs (JSON schema)
response_format={"type": "json_schema", ...} to force the model to return data matching a JSON schema.Reasoning
Reasoning
reasoning_effort parameter. The gateway returns the model’s reasoning as reasoning_content on the message.Responses API
Responses API
previous_response_id.
Full docs: Responses API.Streaming
Streaming
stream=True and iterate over the emitted events.Multi-turn with previous_response_id
Multi-turn with previous_response_id
store is true (the default), Bedrock Mantle retains the response for 30 days in the request’s source region, so you can chain follow-up turns by passing previous_response_id. Set store=False if you do not want AWS to retain conversation data.Messages API
Messages API
/messages), letting you use the official anthropic SDK directly.
Full docs: Messages API, Native SDK Support.api_key=TFY_API_KEY— SDK sends thex-api-keyheaderauth_token=TFY_API_KEY— SDK sends theAuthorization: Bearerheader
/messages/count_tokens) is also supported for sizing a request before sending it:Supported Regions
Thebedrock-mantle endpoint is available in the following AWS regions. The region you set on the provider account (or override per model) must be one of these.
| Region | Region code |
|---|---|
| US East (N. Virginia) | us-east-1 |
| US East (Ohio) | us-east-2 |
| US West (Oregon) | us-west-2 |
| Asia Pacific (Mumbai) | ap-south-1 |
| Asia Pacific (Jakarta) | ap-southeast-3 |
| Asia Pacific (Sydney) | ap-southeast-2 |
| Asia Pacific (Tokyo) | ap-northeast-1 |
| Europe (Frankfurt) | eu-central-1 |
| Europe (Ireland) | eu-west-1 |
| Europe (London) | eu-west-2 |
| Europe (Milan) | eu-south-1 |
| Europe (Stockholm) | eu-north-1 |
| South America (São Paulo) | sa-east-1 |
FAQ
When should I use Bedrock Mantle instead of Bedrock?
When should I use Bedrock Mantle instead of Bedrock?
My request fails with an 'Access Denied' error
My request fails with an 'Access Denied' error
bedrock-mantle:CreateInference on arn:aws:bedrock-mantle:*:<aws-account-id>:project/*. If you authenticate with an API key, also grant bedrock-mantle:CallWithBearerToken on "Resource": "*". For third-party (Marketplace) models, add the Marketplace subscribe actions, or attach the AmazonBedrockMantleInferenceAccess managed policy which covers all of these. See Option B.A model returns 'not supported' for the Responses API
A model returns 'not supported' for the Responses API
Request fails with 'Berm is not enabled for this account'
Request fails with 'Berm is not enabled for this account'
/openai-prefixed path — /openai/v1/responses and /openai/v1/chat/completions — instead of the standard /v1/responses and /v1/chat/completions paths. When such a model is routed to the unprefixed path, Bedrock Mantle rejects it with Berm is not enabled for this account; the same request to the /openai-prefixed path succeeds.To confirm whether a model needs the prefix, check its AWS model card for this note:This model is available on theThis routing can’t be derived from the model catalog, so the gateway reads it from an environment variable. Add the affected model ID to the comma-separatedopenai/v1/responsespath on the bedrock-mantle endpoint. This is different from thev1/responsespath used by other models on the responses endpoint.
AWS_BEDROCK_MANTLE_OPENAI_V1_PREFIX_MODELS env var on your gateway deployment and restart — the gateway then prepends /openai to both the Responses and Chat Completions paths for those models:Can I add models from different regions in a single integration?
Can I add models from different regions in a single integration?
How to override the default cost of models?
How to override the default cost of models?
Private Cost Metric option.
