{"slug": "introducing-the-web-search-api-on-amazon-bedrock-agentcore", "title": "Introducing the Web Search API on Amazon Bedrock AgentCore", "summary": "Amazon Web Services announced the Web Search API on Amazon Bedrock AgentCore, letting developers call the InvokeWebSearch operation on the bedrock-agentcore data plane with a single API call instead of setting up an AgentCore Gateway and MCP client. The API returns ranked results from a web index Amazon operates, each with a text extract and, when available, page title, URL and publication time, and requests are signed with AWS Signature Version 4 using standard IAM credentials, so no API key or secret is needed. AWS said the API runs on the same search infrastructure that powers Alexa+, Kiro, Quick and other Amazon products, and targets custom orchestration frameworks such as LangChain and LlamaIndex, non-agent use cases like fact-checking pipelines and monitoring systems, and applications that want to manage retries and caching themselves.", "body_md": "## [Artificial Intelligence](https://aws.amazon.com/blogs/machine-learning/)\n\n# Introducing the Web Search API on Amazon Bedrock AgentCore\n\nAI agents and applications that answer questions about recent events, product releases, prices, or regulations need information newer than their model’s training data. Until now, [Web Search on Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-target-connector-web-search-tool.html) delivered that information to agents through [AgentCore Gateway](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html), a capability of Amazon Bedrock AgentCore. That means creating a gateway and a web search target and calling the tool from an MCP client. The setup fits platform teams that share one search policy across many agents, but it’s more than you need when your own code only requires search results.\n\nToday, we’re announcing the [Web Search API](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/web-search-api.html) on Amazon Bedrock AgentCore. With it, your own code can search the web with a single API call. It returns ranked results from a web index that Amazon operates, each with a text extract and, when available, the page title, URL, and publication time. You call it from the AWS SDKs or the AWS Command Line Interface (AWS CLI), signed with the same [AWS Identity and Access Management (IAM) credentials](https://aws.amazon.com/iam/) you use for your other AWS services. There are no resources to create first. Authenticate, call, and get results. Use it in an application, an agent loop you write yourself, or a data pipeline.\n\n## Why a standalone API?\n\nThe [AgentCore Gateway](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) is the recommended path for most agentic workloads. It gives agents one secure Model Context Protocol (MCP) endpoint that combines web search with your other tools. It also handles inbound and outbound authentication, semantic tool selection, and optional [MCP sessions](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-sessions.html). But developers told us they also need a lower-level integration point for scenarios where the gateway is not the right fit:\n\n- **Custom orchestration frameworks –** Developers building their own agent loops, or using frameworks like LangChain or LlamaIndex, want to call web search directly as a tool within their orchestration logic rather than routing through a gateway.\n- **Non-agent use cases –** Not every application that needs web grounding is an agent. Search-powered dashboards, fact-checking pipelines, content enrichment workflows, and monitoring systems all benefit from real-time web results without requiring agent infrastructure.\n- **Tighter control over the request lifecycle –** Some developers want to manage retries, caching, and error handling themselves rather than delegating to the gateway.\n- **Simpler integration for existing applications –** Applications that already have their own API layer can call the Web Search API directly, adding web grounding without adopting the full AgentCore Gateway stack.\n\nThe Web Search API complements the gateway. It runs on the same search infrastructure that powers Alexa+, Kiro, Quick, and other Amazon products, with the same quality and compliance posture, exposed as a direct API operation.\n\n## How it works\n\nThe Web Search API is the [InvokeWebSearch](https://docs.aws.amazon.com/bedrock-agentcore/latest/APIReference/API_InvokeWebSearch.html) operation on the `bedrock-agentcore` data plane, the same endpoint that other AgentCore tools such as [AgentCore Browser](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-tool.html), a capability of Amazon Bedrock AgentCore, use. Requests are signed with [AWS Signature Version 4 (SigV4)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html) from your standard AWS credentials, so there’s no API key or secret to manage.\n\nThe numbered steps are:\n\n1. Your application calls `InvokeWebSearch` with the AWS SDKs or the AWS CLI, which sign the request with SigV4 using its AWS credentials. From a virtual private cloud (VPC), the call can go through an interface VPC endpoint.\n2. The API checks with AWS Identity and Access Management (IAM) that the caller has `bedrock-agentcore:InvokeWebSearch` on the AWS managed web search tool.\n3. The API applies the filters in the request: the domains to include or exclude and the publication time range.\n4. The API searches a web index that Amazon operates. Queries are served inside AWS and aren’t sent to a third-party search engine.\n5. The API returns up to `maxResults` ranked results, each with a text extract and, when available, the page title, URL, and publication time.\n\nThe calling identity needs one [IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) permission on an AWS managed resource. It’s the same action and resource that a gateway’s service role uses for web search, so one policy covers both routes. For details, see [Grant permission to call the API](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/web-search-api.html#web-search-api-permissions).\n\n### A first search request\n\nThe following example searches two trusted domains for pages published in 2026, in the US West (Oregon) Region (us-west-2), with the [AWS SDK for Python (Boto3)](https://boto3.amazonaws.com/v1/documentation/api/latest/index.html):\n\nEvery result has a text extract. The title, URL, and publication date come back when the index has them, so read them with `get`. One result from a live call, shortened:\n\nThat’s the full integration. If your code runs on [AWS Lambda](https://aws.amazon.com/lambda/), [Amazon Elastic Container Service (Amazon ECS)](https://aws.amazon.com/ecs/), [Amazon Elastic Compute Cloud (Amazon EC2)](https://aws.amazon.com/ec2/), or [Amazon Elastic Kubernetes Service (Amazon EKS)](https://aws.amazon.com/eks/), the execution role provides credentials automatically. Add the permission to that role, and the same code runs unchanged.\n\n### Key API features\n\n- **Domain filtering –** Include or exclude specific domains to scope search results to trusted sources (for example, only aws.amazon.com and kubernetes.io for an assistant focused on AWS). Each list holds up to 100 domain names, and a root domain also matches its subdomains.\n- **Date filtering –** Restrict results to a publication time range with`publishedAfter` and`publishedBefore` , given as RFC 3339 date-times in UTC such as 2026-01-01T00:00:00Z. Both bounds are inclusive.\n- **Configurable result count –** Request between 1 and 25 results per query. If you don’t set`maxResults` , the API returns up to 25. The search text,`searchQuery` , can be up to 200 characters.\n- **Results with text extracts –** Each result includes a text extract and, when available, the page title, URL, and publication time, ready to feed into your model’s context window.\n\n## Getting started in under 5 minutes\n\nHere are two ways to get a first result:\n\n### Option 1: AWS CloudShell (no local setup)\n\n1. Open [AWS CloudShell](https://aws.amazon.com/cloudshell/) in your browser. It uses the credentials of your console session.\n2. Your role will have the `bedrock-agentcore:InvokeWebSearch` permission, from the preceding policy or from the broader AWS managed policy[BedrockAgentCoreFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/BedrockAgentCoreFullAccess.html) .\n3. Run:\n\n### Option 2: Local development\n\n1. Install the AWS CLI, or the AWS SDK for your language. For Python, use Boto3 1.43.127 or later.\n2. Create an IAM role with the preceding policy.\n3. Get credentials for that role: assume it from your application or an AWS CLI profile, or sign in with it through your identity provider.\n4. Run the preceding Python example, or call the API from any AWS SDK.\n\nThere’s no resource to create and no API key to manage. Authenticate, call, and get results.\n\n## Using the Web Search API with agent frameworks\n\nThe Web Search API fits naturally into popular agent frameworks. LangChain agents get it through the AgentCore web search tool in langchain-aws 1.9.3 and later:\n\nThe tool can also hold rules that the model can’t change, such as domains to exclude, a date floor, and a search budget. It returns its results as data that your code can check. For a complete example, see the [daily dependency watch sample](https://github.com/langchain-ai/langchain-aws/blob/main/samples/agents/agentcore_web_search_supply_chain_watch.ipynb). It researches three package ecosystems in parallel with [LangGraph](https://docs.langchain.com/oss/python/langgraph/overview), and checks every finding against its sources before it reports anything.\n\nIf you prefer to wrap the call yourself, a plain LangChain tool works too:\n\nWithout a framework, the WebSearchClient in the [AgentCore Python SDK](https://github.com/aws/bedrock-agentcore-sdk-python) wraps the same call and returns results with parsed dates. langchain-aws 1.9.3 and the AgentCore Python SDK 1.26.0 add Web Search API support, so install those versions or later.\n\n## Enterprise controls, built in\n\nBecause the Web Search API uses standard IAM authentication, you get enterprise controls from the first call:\n\n- IAM policies. Grant or deny `bedrock-agentcore:InvokeWebSearch` per user, group, or role. Use[service control policies (SCPs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) to enforce guardrails across accounts.\n- AWS CloudTrail logging. CloudTrail records `InvokeWebSearch` requests as data events. Data events aren’t logged by default, so add an event selector for the`AWS::BedrockAgentCore::WebSearch` resource type to a trail or event data store. Events record the web search tool and`maxResults` , not the search text or filters. For details, see[Log AgentCore Web Search API calls with AWS CloudTrail](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/web-search-api-cloudtrail.html) .\n- VPC support. Use [AWS PrivateLink](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/vpc-interface-endpoints.html) to route API calls over your private network rather than the public internet. For setup and endpoint policies, see Private connectivity with AWS PrivateLink later in this post.\n- Compliance. For a list of compliance programs that cover AgentCore, see [Compliance validation for Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/compliance-validation.html) .\n- Searches stay in AWS. Queries are served from a web index that Amazon operates and aren’t sent to a third-party search engine.\n- Acceptable use. The Web Search Tool terms also apply to API results, including the requirement to retain and display the source citations and links that come with each result. For details, see the [Web Search API Acceptable Use documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/web-search-api.html#web-search-api-acceptable-use) .\n\nQuotas apply per account. For the defaults and how to request an increase, see [Quotas for Amazon Bedrock AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html).\n\nBy default, each account can send up to 10 requests per second in each Region, and you can request an increase. For details, see [Age](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/bedrock-agentcore-limits.html#web-search-service-limits)", "url": "https://wpnews.pro/news/introducing-the-web-search-api-on-amazon-bedrock-agentcore", "canonical_source": "https://aws.amazon.com/blogs/machine-learning/introducing-the-web-search-api-on-amazon-bedrock-agentcore/", "published_at": "2026-11-11 23:13:16+00:00", "updated_at": "2026-11-11 23:21:24.923052+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-search", "agent-protocols", "artificial-intelligence"], "entities": ["Amazon Web Services", "Amazon Bedrock AgentCore", "Web Search API", "AgentCore Gateway", "InvokeWebSearch", "Alexa+", "Kiro", "LangChain"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/introducing-the-web-search-api-on-amazon-bedrock-agentcore", "markdown": "https://wpnews.pro/news/introducing-the-web-search-api-on-amazon-bedrock-agentcore.md", "text": "https://wpnews.pro/news/introducing-the-web-search-api-on-amazon-bedrock-agentcore.txt", "jsonld": "https://wpnews.pro/news/introducing-the-web-search-api-on-amazon-bedrock-agentcore.jsonld"}}