bug: API Gateway REST body validation applies the application/json model to unmatched content types

[AndreKurait]

Additional version check — 2026-10-08

Still reproduced: the two matching-content-type controls pass, while both unmatched content types incorrectly return HTTP 400.

The comparison used an unmodified localstack/localstack-pro:2026.8.1 Linux ARM64 image,
repository digest sha256:4aef81c531684570d7b3cfd2805afa02194c929d52bbeedabb7d4874798b1572.
Vendor packages were localstack-core 2026.8.1, moto-ext 5.1.48, and bundled
boto3/botocore 1.43.78. HTTP probes used a separate boto3/botocore 1.43.101
client; the process-local security-group probe used the bundled interpreter.
The same scripts were used, with no custom extensions or provider source changes.
Owned test containers and the disposable network were removed.
This is a second specifically tested version, not a claim to have tested the latest release.

---

Existing report search

I searched the LocalStack issue tracker and current organization Discussions for this operation and failure. I did not find an existing report for this exact reproduction.

Current behavior

A REST API POST method enables body validation and declares only {"application/json": "RequiredValue"} as its request-model mapping. That model requires a string property named value. There is no $default model.

Content-Type	Body	Expected status	Observed status
application/json	{}	400	400
application/json	{"value":"ok"}	200	200
application/x-amz-json-1.1	{}	200	400
text/plain	{}	200	400

The MOCK integration explicitly defines templates for all three tested content types, so integration passthrough/template selection does not account for the 400 responses.

All four results were reproduced through public APIs on a fresh, unmodified LocalStack container. The script deletes the API and verifies its absence.

Expected behavior

Skip body validation when no request model matches the content type and no $default model is configured. The exact-match model should still validate application/json requests. Request-parameter validation and integration-template selection are independent.

Reference: API Gateway request validation.

The comparison to AWS is based on this documented contract; an equivalent live AWS run has not been performed.

Environment

• Tested on 2026-10-07, Linux, using localstack/localstack-pro:2026.7.5.
• Repository digest: sha256:0d74e1d2d7ce13a3cb25fc64cf15eb225f1c95c762e56e057bc6a9ed0ed29306.
• Vendor-installed distributions: localstack-core 2026.7.5, moto-ext 5.1.46, moto.__version__ = 5.1.21.dev, boto3/botocore 1.43.51.
• Fresh disposable container, no application code, no custom extensions, no source patches.
• This is an affected-version report, not a claim that the latest LocalStack release or standalone Moto still has the defect.

Fresh confirmation on 2026-10-08: the same discrepancy reproduced on Linux ARM64 against the same unmodified image, using a separate boto3/botocore 1.43.101 client. The disposable container and network were removed after the run. The startup block below includes the run's disabled DNS listener/default EC2-image downloads and temporary state storage; no provider source or extension was changed.

Steps to reproduce

Start a disposable instance on a free loopback port:

# LOCALSTACK_AUTH_TOKEN is read from your environment, never embedded in this report.
set -eu
container=$(docker run --rm -d \
  -p 127.0.0.1:4567:4566 -e LOCALSTACK_AUTH_TOKEN \
  -e DNS_ADDRESS=0 -e EC2_DOWNLOAD_DEFAULT_IMAGES=0 \
  --tmpfs /var/lib/localstack \
  localstack/localstack-pro:2026.7.5)
trap 'docker stop "$container" >/dev/null' EXIT
ready=false
for attempt in $(seq 1 60); do
  if curl --fail --silent http://127.0.0.1:4567/_localstack/health >/dev/null; then
    ready=true
    break
  fi
  sleep 1
done
"$ready"
python apigateway_model_content_type.py --endpoint-url http://127.0.0.1:4567

Run the block in a disposable shell. Port 4567 must be free. The client needs boto3; it uses only dummy credentials and a loopback endpoint. It creates disposable resources and cleans them up in finally; the shell trap removes the container even when the script reports failure. A nonzero exit is expected while the reported discrepancy is present. No Docker socket mount or application services are required.

Complete standalone reproducer: apigateway_model_content_type.py

"""Check REST API request-model selection using a disposable local MOCK API."""
import argparse
import json
import urllib.error
import urllib.request
from urllib.parse import urlsplit

import boto3
from botocore.config import Config


def run(endpoint):
    if urlsplit(endpoint).hostname not in {"localhost", "127.0.0.1", "::1"}:
        raise ValueError("This reproducer accepts only a loopback endpoint")
    api = boto3.client(
        "apigateway", endpoint_url=endpoint, region_name="us-east-1",
        aws_access_key_id="test", aws_secret_access_key="test",
        config=Config(proxies={}, retries={"max_attempts": 0}),
    )
    identifier = api.create_rest_api(name="request-model-content-type-repro")["id"]
    try:
        root = next(
            row["id"] for row in api.get_resources(restApiId=identifier)["items"]
            if row["path"] == "/"
        )
        resource = api.create_resource(
            restApiId=identifier, parentId=root, pathPart="check",
        )["id"]
        api.create_model(
            restApiId=identifier, name="RequiredValue", contentType="application/json",
            schema=json.dumps({
                "$schema": "http://json-schema.org/draft-04/schema#",
                "type": "object", "required": ["value"],
                "properties": {"value": {"type": "string"}},
            }),
        )
        validator = api.create_request_validator(
            restApiId=identifier, name="body", validateRequestBody=True,
            validateRequestParameters=False,
        )["id"]
        method = dict(restApiId=identifier, resourceId=resource, httpMethod="POST")
        api.put_method(
            **method, authorizationType="NONE", requestValidatorId=validator,
            requestModels={"application/json": "RequiredValue"},
        )
        content_types = ["application/json", "application/x-amz-json-1.1", "text/plain"]
        api.put_integration(
            **method, type="MOCK", passthroughBehavior="WHEN_NO_MATCH",
            requestTemplates={kind: '{"statusCode":200}' for kind in content_types},
        )
        api.put_method_response(**method, statusCode="200")
        api.put_integration_response(
            **method, statusCode="200",
            responseTemplates={"application/json": '{"ok":true}'},
        )
        api.create_deployment(restApiId=identifier, stageName="repro")
        url = endpoint.rstrip("/") + f"/restapis/{identifier}/repro/_user_request_/check"
        opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))

        def request(kind, body):
            call = urllib.request.Request(
                url, data=json.dumps(body).encode(),
                headers={"Content-Type": kind}, method="POST",
            )
            try:
                with opener.open(call, timeout=10) as response:
                    response.read()
                    return response.status
            except urllib.error.HTTPError as error:
                error.read()
                return error.code

        cases = [
            ("application/json", {}, 400),
            ("application/json", {"value": "ok"}, 200),
            ("application/x-amz-json-1.1", {}, 200),
            ("text/plain", {}, 200),
        ]
        result = [
            {"content_type": kind, "body": body, "expected": expected, "actual": request(kind, body)}
            for kind, body, expected in cases
        ]
        print(json.dumps(result, indent=2), flush=True)
        assert all(row["actual"] == row["expected"] for row in result), result
    finally:
        api.delete_rest_api(restApiId=identifier)
        try:
            api.get_rest_api(restApiId=identifier)
        except api.exceptions.NotFoundException:
            print(json.dumps({"cleanup": "REST API deleted"}), flush=True)
        else:
            raise AssertionError("Reproducer API still exists after deletion")


if __name__ == "__main__":
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--endpoint-url", default="http://127.0.0.1:4566")
    run(parser.parse_args().endpoint_url)

[Anze1508]

Hi @AndreKurait. Thanks for the report. The issue was fixed in the localstack/localstack:dev image. Please update the image and try again. Let me know how it goes.