Skip to main content
In this quickstart, you install the SDK, set your credentials, and send one LLM interaction (a user prompt and a model response) to the HiddenLayer AI Runtime Security Interactions endpoint for analysis. This example uses client.interactions.analyze because it is a generally available (non-beta) endpoint and needs no model files or other setup. It is a quick way to confirm that your installation, credentials, and network access work.

Before you begin

You need:
  • Python 3.9 or later (3.11 or later recommended).
  • A HiddenLayer client ID and client secret with Interactions (Read, Write) permissions. See Create API Key.
  • Your region: prod-us (default) or prod-eu.
For details, see Prerequisites.

Make your first request

1

Create a project folder and virtual environment

A virtual environment keeps the SDK and its dependencies isolated from other Python projects.
2

Install the SDK

For more options, see Installation.
3

Set your credentials

The client reads your client ID and client secret from environment variables, so you never have to put them in code.
Replace the placeholders with your values. If your API key is in the EU region, change environment="prod-us" to environment="prod-eu" in the script in the next step.
These variables last only for the current terminal session. If you open a new terminal, set them again, or use a .env file as described in Authentication and configuration.
4

Create quickstart.py

Create a file named quickstart.py in your project folder with this content:
quickstart.py
The try block catches the most common errors and prints a hint for each. APIStatusError is listed last because it is the parent class of AuthenticationError and PermissionDeniedError, so it catches any other HTTP error status.
5

Run the script

Expected result

The script prints the overall evaluation, followed by one line per analysis. The output looks similar to this example. Analysis names, the number of analyses, and the results depend on your project’s policy and on the interaction you send, so your values will differ.
What the fields mean: The response also includes metadata (such as event_id and processing time), analyzed_data (the content that was analyzed), and modified_data (the input and output after any redaction). To see everything, print response.to_json(). For a description of the Interactions response, see Getting started with Interactions.

What just happened

  1. The client read its configuration. HiddenLayer() read HIDDENLAYER_CLIENT_ID and HIDDENLAYER_CLIENT_SECRET from the environment and set the base URL to https://api.us.hiddenlayer.ai for prod-us.
  2. The client obtained an access token. Before sending the request, the SDK exchanged your client ID and client secret for an OAuth2 access token at https://api.us.hiddenlayer.ai/oauth2/token. It caches this token and refreshes it automatically, so you do not manage tokens yourself.
  3. The client sent the request. It sent the metadata, input, and output to the Interactions endpoint with the token in the Authorization header. If the request had failed with a temporary error, such as a timeout or HTTP 429 or 5xx, the SDK would have retried up to two times.
  4. The SDK parsed the response. The JSON response was converted into an InteractionAnalyzeResponse Pydantic model, so you can read fields as attributes, such as response.evaluation.action.
To learn more about clients, resources, and response models, see Core concepts.
If your application uses asyncio, use AsyncHiddenLayer. It takes the same arguments and reads the same environment variables. Await each call.
quickstart_async.py

If it fails

The virtual environment is not active, or the SDK is installed in a different environment. Activate .venv and run python -m pip install hiddenlayer-sdk. See Installation.
The client could not get a valid token. Check that both environment variables are set in the same terminal where you run the script, that the values have no extra spaces or quotes, and that environment matches the region where the API key was created. See Troubleshooting.
Your API key is valid but lacks permission for the Interactions endpoint. Create a key with Interactions (Read, Write) permissions. See Create API Key.
The SDK could not connect after retrying. Check your network, firewall, and proxy settings, and confirm the base URL. To configure a proxy, see Authentication and configuration.
HIDDENLAYER_BASE_URL is set in your environment and the script also passes environment. Unset the variable, or see How the client resolves the base URL.
For more problems and fixes, see Troubleshooting and Error handling.

Next steps

Scan models

Scan model files for malicious code and vulnerabilities.

Runtime security

Protect LLM applications and agents with Interactions and the agentic evaluation endpoints.

Attack simulation

Run red team sessions against your AI application.

Core concepts

Understand clients, resources, and response models.