> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiddenlayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the Azure API Management CLI

The `hiddenlayer-apim` CLI reads configuration from environment variables or a `.env` file.

## Create a Configuration File

Run:

```bash theme={null}
hiddenlayer-apim init
```

This creates `.env` in the current directory. If `.env` already exists, the command stops instead of overwriting it. Use `hiddenlayer-apim init --force` only when you intentionally want to replace the file.

## Required Settings

```bash theme={null}
# Azure
RG=your-resource-group
APIM_NAME=your-apim-instance

# HiddenLayer
HL_CLIENT=your-client-id
HL_SECRET=your-client-secret
HL_PROJECT_ID=your-project-id
HL_TENANT_ID=your-tenant-id
```

## Optional Settings

```bash theme={null}
# Azure subscription. If omitted, the CLI uses the active Azure CLI subscription.
AZURE_SUBSCRIPTION_ID=your-subscription-id

# HiddenLayer host suffix. Use hiddenlayer.ai for US SaaS.
HL_HOST=hiddenlayer.ai

# OAuth token cache duration for APIM policy fragments.
# HL_OAUTH_CACHE_SECONDS=5

# Default API ID used by apply, remove, and status commands.
HL_TARGET_API=your-api-id

# Default fragment package.
HL_PACKAGE=v2-request-evals
```

## Region Configuration

For US SaaS, use:

```bash theme={null}
HL_HOST=hiddenlayer.ai
```

For EU SaaS, use:

```bash theme={null}
HL_HOST=eu.hiddenlayer.ai
```

The APIM fragments build authentication and API URLs from this value:

* `https://auth.<HL_HOST>/oauth2/token`
* `https://api.<HL_HOST>/detection/...`

## HiddenLayer Metadata Headers

The v2 packages can consume these request headers from clients or upstream APIM policy and then remove them before calling the backend:

| Header                     | Purpose                                                                                                |
| -------------------------- | ------------------------------------------------------------------------------------------------------ |
| `HL-Requester-Id`          | Optional requester or end-user identifier. Runtime uses this as an override over provider body fields. |
| `HL-Provider-Id`           | Optional provider override when provider auto-detection needs help.                                    |
| `HL-Runtime-Session-Id`    | Optional application session ID used to group related interactions.                                    |
| `HL-Runtime-Edge-Provider` | Optional edge provider label. Defaults to `azure-apim`.                                                |

APIM also generates or forwards `HL-Roundtrip-Id` so request and response evaluations for the same LLM call can be linked.