This release focuses on the stdapi-ai Terraform module and its child modules — VPC, KMS, and ECS Fargate — adding detailed AWS Security Hub control documentation and closing several compliance gaps: default security group lockdown, ALB access logging, EFS POSIX user enforcement with native backups, and optional compliance/GuardDuty/DNS Firewall VPC integrations. All four modules now also accept a tags variable for custom resource tagging.
Documentation-first release
Every module README now includes a full Security Hub Foundational Security Best Practices (FSBP) control mapping. See Authentication & Security for a summary and links to each module.
Per-control (pass/fail/conditional/N-A) tables added to each module README
Default security group lockdown
VPC
New aws_default_security_group resource revokes all default ingress/egress rules (EC2.2 / CIS 5.4)
VPC Flow Logs retention
VPC
Default retention increased from 7 to 365 days (EC2.6)
Compliance VPC endpoints
VPC
New compliance_vpc_endpoints_enabled variable adds ECR, SSM, SSM Contacts, and SSM Incidents interface endpoints
GuardDuty VPC endpoint
VPC
New guardduty_vpc_endpoint_enabled variable adds the guardduty-data interface endpoint
Route 53 Resolver DNS Firewall
VPC
New dns_firewall_enabled variable blocks/alerts on DNS queries to known-malicious domains (AWS Managed Domain Lists, plus DGA/DNS-tunneling detection via dns_firewall_advanced_enabled); dedicated VPC only
ALB access logging
stdapi-ai
New alb_access_logging_enabled variable (default true) logs ALB access to a dedicated, encrypted S3 bucket
EFS POSIX user enforcement
ECS Fargate
mount_points now accepts an efs_posix_user object to enforce a POSIX identity on EFS access points (EFS.4)
EFS native backups
ECS Fargate
New mount_points_efs_backup_enable variable enables native EFS automatic backups, independent of the existing AWS Backup plan (EFS.7)
Resource tagging
VPC, KMS, ECS Fargate, stdapi-ai
New tags variable propagates custom tags to nearly all created resources (IAM.24 / EC2.48)
Requirement raised to >= 6.27.0 across all four modules
S3 object tag rename
Files API objects and the corresponding Terraform lifecycle rule now use the stdapi-ai.expires tag key instead of expires; a temporary backward-compatible rule still expires legacy-tagged objects
aws-apn-id resource tagging
AWS resources created at runtime (Bedrock async jobs, Transcribe jobs, S3 objects) are tagged with aws-apn-id, the standard AWS Marketplace attribution tag — an internal, vendor-side tag, not user-configurable
Significantly reduced the size of MCP tool descriptions across the API, lowering the token cost of every AI agent session connected to this server
No change in functionality: all parameter constraints and usage guidance remain intact
v1.12.0 – Completions API, Video Understanding & File References¶
This release adds the OpenAI-compatible /v1/completions endpoint for text-first coding agents and legacy completion clients, TwelveLabs Pegasus video understanding for analyzing video/* inputs in chat completions, and an input token counting endpoint for the Responses API. Files uploaded through the Files API can now be referenced anywhere a URL is accepted using the new file-id: URI scheme. The Anthropic Messages API now accepts system-role messages (merged into the system prompt for compatibility), reasoning can be explicitly enabled or disabled, and a new DEFAULT_MODEL_SERVICE_TIERS setting applies per-model service tiers automatically.
Reference Files API uploads via file-id:<file-id> anywhere a URL is accepted — embeddings, audio transcription/translation, chat, images, and messages
Default model service tiers (DEFAULT_MODEL_SERVICE_TIERS)
Automatically apply a per-model service tier (default, flex, priority, reserved) when none is provided in the request
Explicit reasoning enable/disable
Reasoning/thinking can now be explicitly enabled or disabled via request parameters
Service tier & guardrail support for Pegasus
TwelveLabs Pegasus requests honor service_tier and Bedrock Guardrail configuration
MCP speech streaming defaults to SSE
/v1/audio/speech defaults stream_format to sse when invoked as an MCP tool for broader client compatibility
Full regional S3 bucket handling
The Terraform module resolves regional S3 buckets via resource-level region (requires AWS provider >= 6.0.0)
Reliable cross-region model identifiers
Region routing no longer fails intermittently with "The provided model identifier is invalid": a region whose inference profile is missing or not yet propagated is skipped, and a geo-scoped profile is never sent to a different region
This release introduces a Model Context Protocol (MCP) server, making all stdapi.ai API endpoints directly accessible as MCP tools for AI agents and agentic workflows. A new /search_models endpoint enables precise discovery of models by route, MCP tool, region, streaming support, and legacy status. Agent-friendly discovery metadata is now exposed via RFC 8288 Link headers and an RFC 9727 machine-readable API catalog at /.well-known/api-catalog. Endpoints that previously required binary multipart/form-data uploads now also accept an application/json body for MCP and HTTP client compatibility. The Anthropic Messages API now accepts xhigh as a reasoning_effort value.
New official endpoint to filter models by route, MCP tool name, input/output modalities, region, streaming, and legacy status; returns richer metadata than /v1/models or Anthropic /v1/models, designed for LLM-driven model selection (replaces BETA and undocumented /available_models)
This release adds support for the OpenAI /v1/responses endpoint—OpenAI's next-generation API designed for building agents and multi-step AI workflows. Drop-in compatible with the OpenAI SDK, it works with all AWS Bedrock Converse-compatible models and supports streaming, function tools, built-in tools (web search, code interpreter, image generation), extended reasoning, and structured output.
This release introduces a Files API backed by Amazon S3, available through both the OpenAI-compatible and Anthropic-compatible interfaces. Files uploaded via either API share the same S3 storage and can be referenced across both interfaces. Large files can be uploaded incrementally using the OpenAI multipart uploads API. Stored files can be referenced by ID directly in image edit and variation requests (JSON body), as well as in chat completion messages as document or image inputs. The image edits endpoint now also accepts an application/json body as an alternative to multipart form-data, making it easier to chain pipeline steps without re-uploading files.
New Required Configuration
Files API requires AWS_S3_BUCKET to be configured (shared with the image URL response feature). The S3 prefix for stored files defaults to files/ and is configurable via AWS_S3_FILES_PREFIX. Ensure your IAM role includes read, write, delete, and list permissions on the files prefix in addition to the existing S3 permissions for presigned URLs.
Document inputs via S3 URLs are not supported as Bedrock Converse API inputs for some models (e.g., Claude) — now properly detected and handled
v1.8.0 – Broader Model Compatibility & Structured Output¶
This release focuses on improving reliability and compatibility across a wide variety of models. Structured response formats (JSON object and JSON schema) are now supported on OpenAI chat completions, and request metadata can be forwarded to Bedrock. Tool handling has been significantly improved—both for model-specific system tools and for Amazon Nova's grounding tool, including multi-turn support. Region routing is now more robust, correctly enforcing non-global inference profiles for region-restricted models and handling edge cases gracefully.
New Required IAM Permissions
v1.8.0 requires two new IAM permissions to attach request metadata tags to jobs:
bedrock:TagResource on arn:aws:bedrock:*:*:async-invoke/* — needed for Bedrock asynchronous invocation jobs (see IAM Permissions). The twelvelabs.marengo-embed-3-0-v1:0 and twelvelabs.marengo-embed-2-7-v1:0 models rely on asynchronous invocation and will fail with an access denied error if this permission is missing.
transcribe:TagResource on arn:aws:transcribe:*:*:transcription-job/* — needed for Amazon Transcribe transcription jobs (see IAM Permissions). The amazon.transcribe model will fail with an access denied error if this permission is missing.
Ensure your IAM role or user policy includes both statements before upgrading to v1.8.0.
Region-restricted models are now always assigned non-global inference profiles, preventing requests from bypassing configured region restrictions
Region routing edge case handling
Region routing gracefully handles cases where no usable regions are available
ECS-based server ID
When running on ECS, server_id in logs is set to task_id.container_name for precise instance identification across tasks and containers
Request metadata tagging
stdapi.ai request context (request_id, server_id, user_id) is automatically attached as tags to every Bedrock and Amazon Transcribe job, making it easy to trace API calls across AWS service logs
Fix systemTool_ prefix handling: removed broken auto-promotion logic; system tools require specific tool output handling not compatible with generic tool forwarding
AWS_BEDROCK_LEGACY default changed from true to false to prevent access denied errors on legacy models that have not been actively used recently
Bedrock read timeouts are now handled as standard model errors (503) instead of unhandled exceptions, and are properly retried across regions when multi-region routing is enabled
v1.7.0 – Automatic Region Routing, Deprecated Model Fallback & Resilience Improvements¶
The headline feature of v1.7 is automatic multi-region routing: stdapi.ai now intelligently distributes requests across your configured AWS regions, failing over automatically on quota limits or unavailability—and because each region carries its own independent quota, adding regions directly multiplies your effective tokens-per-minute and daily limits. Alongside this, deprecated model IDs are transparently redirected to their replacements so clients survive AWS model retirements without any code changes. This release also adds S3 URL support for file inputs across all relevant endpoints, a configurable AI response timeout, and memory efficiency improvements.
Automatic region routing with configurable strategies
Intelligently distributes Bedrock requests across configured AWS regions with automatic failover on quota limits or unavailability; supports ordered, lowest_latency, and round_robin strategies
Deprecated model fallback
Transparently reroute deprecated model IDs to their replacements; extend or override the built-in mapping; warns on legacy model usage
AI response timeout
Configurable timeout for AI model responses to prevent indefinitely hanging requests
Expanded file input support
File inputs (images, documents, audio) now support S3 URLs in addition to HTTP URLs, data URIs, and plain base64 across all relevant endpoints; improves memory efficiency by releasing file data as early as possible
Model lifecycle timestamps
Model created/updated timestamps now derived from lifecycle data (startOfLifeTime, endOfLifeTime)
Fix SSE stream error handling in monitoring to handle specific API and AWS client errors gracefully
Fix audio MIME type detection failure when libmagic's in-memory buffer path silently returns application/octet-stream; fall back to file-based detection to ensure correct format is sent to Bedrock
v1.6.0 – Anthropic API Compatibility & Advanced Claude Capabilities¶
Introduces a full Anthropic-compatible API layer, enabling direct use of the Anthropic SDK and Claude-native tools with AWS Bedrock. Adds Claude server tools support via OpenAI chat completions, token count estimation, automatic Anthropic beta flag filtering, and configurable route prefixes.
Introduces advanced reasoning capabilities with Amazon Nova 2 and Anthropic Claude 4.6+ adaptive reasoning, enhanced system prompt handling for broader model compatibility.
Add "/" route to avoid 404 errors on root endpoint
Fix empty system content block handling (improves AWS Bedrock Converse API compatibility)
v1.5.1
Fix Amazon Nova Canvas image editing to fall back to TEXT_IMAGE task type when no mask is provided
v1.4.0 – Audio Enhancements & Model Compatibility¶
Expands audio capabilities with Mistral Voxtral support, speaker diarization, audio formats for chat completions, and introduces prompt caching TTL and model aliasing for better OpenAI compatibility.
Adds support for OpenAI's image editing and variation endpoints, enabling image manipulation capabilities backed by Amazon Bedrock. Includes maintenance updates for content block handling, tool call validation, streaming fixes, and TTS optimization.
Refactor content block handling to skip empty entries in assistant responses
v1.3.4
Handle invalid tool call arguments with robust JSON content validation
Add deprecation mapping for amazon.titan-image-generator-v2:0 → amazon.nova-canvas-v1:0
v1.3.3
Remove premature stop condition for contentBlockStop in streaming chat completions
v1.3.2
Support image[] array-style notation for OpenAI image edits
Handle empty audio segments in transcription duration calculation
v1.3.1
Improve JSON parsing for tool arguments and results
Correct example → examples in OpenAPI model path parameter
v1.2.0 – Service Tiers, System Tools & Performance Enhancements¶
Introduces service tiers and latency headers for all Bedrock routes, Bedrock-specific system tools (Nova grounding), GPT5.2 API compatibility, configurable guardrail overrides, and Python 3.14 optimization.
OpenAI
Amazon Bedrock - foundation models
Anthropic
Twelve Labs
Amazon Polly
Amazon Nova models
Amazon S3
Claude models on Amazon Bedrock
Amazon Transcribe
Mistral
Deepseek
Qwen
Cohere
Amazon Titan
Stability AI
AWS SSM Parameter Store / 
Secrets Manager
AWS X-Ray + OpenTelemetry
Amazon CloudWatch (When running on ECS/EKS)