Azure API Management CLI Commands

Use hiddenlayer-apim to deploy policy fragments, apply them to APIs, inspect status, and remove them when needed.

Command Summary

Command	Description
`hiddenlayer-apim init`	Create a `.env` configuration template. Refuses to overwrite unless `--force` is used.
`hiddenlayer-apim packages`	List embedded fragment packages with their version, description, inbound fragments, and outbound fragments.
`hiddenlayer-apim deploy`	Create missing HiddenLayer named values and policy fragments in APIM. Prompts before overwriting existing HiddenLayer-managed resources when `--overwrite` is used.
`hiddenlayer-apim list`	List APIs in the APIM instance.
`hiddenlayer-apim apply <api-id>`	Inject HiddenLayer fragment references into an API policy. Prompts before updating the API policy unless `--yes` is used.
`hiddenlayer-apim status`	Check APIM connectivity, named values, fragments, and API policy status.
`hiddenlayer-apim remove <api-id>`	Remove the selected HiddenLayer package fragments from an API policy. Use `--all` to remove every detected HiddenLayer fragment. Prompts before updating the policy unless `--yes` is used.
`hiddenlayer-apim export bicep`	Export package fragments as a Bicep bundle for infrastructure-as-code deployment.

Packages

hiddenlayer-apim packages

Lists every fragment package built into the CLI binary, including its version, description, and the inbound/outbound fragment IDs it ships. Use this command before deploy or apply to confirm which package names are valid for --package and --packages.

Deploy

hiddenlayer-apim deploy --package v2-request-evals

Deploy creates missing HiddenLayer APIM named values and policy fragments. It does not overwrite different existing non-secret named values or policy fragments by default. Use --overwrite only when you intentionally want to update existing HiddenLayer-managed resources:

hiddenlayer-apim deploy --package v2-request-evals --overwrite

When --overwrite would change existing named values or replace existing policy fragment XML, the command lists the affected resources and prompts for confirmation. Type yes to proceed. Secret named values are listed by name only; their values are not displayed. Deploy multiple packages with --packages:

hiddenlayer-apim deploy --packages v2-request-evals,v2-response-evals

When the package flag is omitted and multiple packages are available, deploy shows the package menu, then prints a per-resource summary as it creates named values and policy fragments.

hiddenlayer-apim deploy terminal output showing interactive package selection, named-value creation, and fragment creation

After deploy completes, the new HiddenLayer fragments appear on the APIM service under APIs → Policy fragments. References stay at 0 until an API policy includes them.

List

hiddenlayer-apim list

list prints the API ID, display name, and path for every API in the APIM instance. Use it to find the <api-id> value to pass to apply, remove, or status.

hiddenlayer-apim list terminal output showing API ID, display name, and path columns

Apply

hiddenlayer-apim apply openai-proxy --package v2-request-evals

Before updating the API policy, the command lists the inbound and outbound HiddenLayer fragments it is about to inject and prompts for confirmation. Type yes to continue, or pass --yes to skip the prompt in automated workflows:

hiddenlayer-apim apply openai-proxy --package v2-request-evals --yes

If all of the requested fragments are already present in the policy, apply reports that and exits without changing the policy. Preview the API policy before applying it:

hiddenlayer-apim apply openai-proxy --package v2-request-evals --dry-run

Apply multiple packages:

hiddenlayer-apim apply openai-proxy --packages v2-request-evals,v2-response-evals

The terminal output below shows the full interactive flow: package selection, the fragment confirmation prompt, the injection step, and a generated curl test command for the affected API.

hiddenlayer-apim apply terminal output showing package selection, confirmation prompt, fragment injection, and a sample curl test command

After apply, the References column on the APIM Policy fragments page increases for every fragment included in the API policy. Shared fragments such as hl-oauth-token-management show one reference per API that uses them.

Azure portal Policy fragments page after apply showing increased Reference counts for the injected HiddenLayer fragments

Remove

hiddenlayer-apim remove openai-proxy --package v2-request-evals

Before updating the API policy, the command lists the fragment IDs it is about to remove and prompts for confirmation. Type yes to continue, or pass --yes to skip the prompt in automated workflows:

hiddenlayer-apim remove openai-proxy --package v2-request-evals --yes

Remove multiple packages in a single command with --packages:

hiddenlayer-apim remove openai-proxy --packages v2-request-evals,v2-response-evals

When multiple HiddenLayer packages are applied, remove preserves shared fragments (for example hl-oauth-token-management) that other installed packages still need. Use --all to remove every HiddenLayer fragment detected in the API policy, regardless of package:

hiddenlayer-apim remove openai-proxy --all

--all cannot be combined with --package or --packages. When you omit --package, --packages, and --all, the CLI selects a package from HL_PACKAGE or, when no default is set and multiple packages are available, prompts interactively. The terminal output below shows package selection, the per-fragment confirmation list, and the removal step.

hiddenlayer-apim remove terminal output showing package selection, the list of fragments to remove, and confirmation

In the Azure portal, the References count for the removed fragments drops back to 0, while shared fragments still referenced by other APIs (for example hl-oauth-token-management) retain a non-zero reference count — confirming that remove preserves cross-package dependencies.

Azure portal Policy fragments page after remove showing reduced References for the removed fragments while the shared oauth fragment still has references

Status

hiddenlayer-apim status --package v2-request-evals

Use status after deploy and apply to verify APIM resources and target API policy references.

Export Bicep

hiddenlayer-apim export bicep --package v2-request-evals --out ./hl-bicep

The generated bundle includes main.bicep, a starter main.bicepparam, and the package’s fragments/*.xml files. The only required Bicep parameter is apimServiceName. Deploy the exported template with:

az deployment group create \
  --resource-group <resource-group> \
  --template-file ./hl-bicep/main.bicep \
  --parameters apimServiceName=<apim-name>

You can also edit ./hl-bicep/main.bicepparam and pass --parameters ./hl-bicep/main.bicepparam instead. Export only inbound or outbound fragments:

hiddenlayer-apim export bicep --package v2-response-evals --group outbound --out ./hl-bicep-outbound

​Command Summary

​Packages

​Deploy

​List

​Apply

​Remove

​Status

​Export Bicep