Exception hierarchy
All API exceptions are importable directly from thehiddenlayer package and inherit from hiddenlayer.HiddenLayerError:
APIConnectionError: the SDK could not get a response from the API. Examples include DNS failures, refused connections, proxy errors, and timeouts.APIStatusError: the API responded, but with a 4xx or 5xx HTTP status code.
except hiddenlayer.APIStatusError catches NotFoundError, RateLimitError, and every other status error.
Status codes and exceptions
The SDK’s README error table does not list
ConflictError (409). The exception exists in the SDK source and is raised for HTTP 409 responses.Exception attributes
Use these attributes to log useful details or decide how to react:Order your except clauses from specific to general
Python checks except clauses from top to bottom and runs the first one that matches. Because subclasses also match their parent classes, put the most specific exceptions first:
APITimeoutErrorbeforeAPIConnectionError, because a timeout is a type of connection error.- Specific status errors, such as
AuthenticationErrororRateLimitError, beforeAPIStatusError. APIErrororHiddenLayerErrorlast, as a catch-all for anything else the SDK raises.
except hiddenlayer.APIStatusError first, the more specific clauses below it never run.
Complete example
This example analyzes a prompt with Interactions and handles every category of error. It reads credentials from theHIDDENLAYER_CLIENT_ID and HIDDENLAYER_CLIENT_SECRET environment variables. See Authentication and configuration for how to set them.
Automatic retries
The SDK retries some failed requests automatically before raising an exception. You do not need to write your own retry loop for transient errors. What is retried by default:- Connection errors, such as network problems
- Timeouts
- HTTP 408 Request Timeout
- HTTP 409 Conflict
- HTTP 429 Too Many Requests
- HTTP 500 and above
x-should-retry: true or x-should-retry: false response header.
When you authenticate with a client ID and client secret, the SDK also retries a 401 response once it detects that its cached access token has expired. It discards the old token and requests a new one.
How retries are spaced:
- The default is 2 retries, so up to 3 attempts in total.
- The delay grows exponentially, starting at 0.5 seconds and capped at 8 seconds, with a small random reduction (jitter) so many clients do not retry at the same moment.
- If the response includes a
retry-after-msorretry-afterheader with a value between 0 and 60 seconds, the SDK waits that long instead.
max_retries, either on the client or per request with with_options():
Timeouts
By default, a request times out after 60 seconds, with a 5-second limit for establishing the connection. When a request times out, the SDK raiseshiddenlayer.APITimeoutError. Timed-out requests are retried, so the total wait can be longer than one timeout period.
Set timeout to a number of seconds, or to an httpx.Timeout object for separate connect, read, and write limits:
The
timeout setting applies to each HTTP request. It does not limit how long the model scanning helpers wait for a scan to finish. With wait_for_results=True, the helpers poll until the scan reaches a final status, with no overall time limit. See Model scanning.Errors raised by helpers
The higher-level helpers, such asclient.model_scanner and client.evaluation_sessions.red_team, run several steps for you. In addition to the API exceptions above, they can raise standard Python exceptions:
scan_file creates the scan on the HiddenLayer API before it reads the local file. If the path does not exist, FileNotFoundError is raised from Path.stat() after the scan has been started. To avoid leaving an incomplete scan, check that the file exists with os.path.isfile() before calling scan_file. Whether the incomplete scan appears in the Console needs confirmation.ScanReport with status set to "failed". Always check report.status. See Model scanning.
Red team session errors
The AI Attack Simulation session helpers define their own exceptions inhiddenlayer.lib.red_team_exceptions. They do not inherit from HiddenLayerError:
The
poll_max_wait argument of start_session() and resume_session() raises a plain Exception with the message Polling timed out after ..., not PollTimeoutError.
Beta warnings are not exceptions
Some endpoints are in beta. When you call one, the SDK emits ahiddenlayer.BetaWarning using Python’s warnings module. A warning is a message printed to standard error. It does not stop your program and cannot be caught with try/except unless you turn it into an error.
The message looks like this:
BetaWarning is emitted by client.runtime.evaluate_request, evaluate_response, and evaluate_interaction, and by all client.evaluations.red_team methods, including calls made through client.evaluation_sessions.red_team.
To hide the warning once you have accepted the beta status:
BetaWarning as an exception. To learn what beta status means for compatibility, see Version compatibility and upgrades.
Response validation errors
APIResponseValidationError is raised only when strict response validation is enabled and the API returns data that does not match the expected schema. Strict validation is controlled by a private, unstable client option and is off by default, so you are unlikely to see this exception. By default, the SDK accepts unexpected fields and keeps them available on the response model.
Next steps
- Troubleshooting: fix specific errors step by step.
- Security and production guidance: configure retries, timeouts, and failure behavior for production.

