> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Self Hosted SDK Usage — Version 8

> Configure the Arize AX Python SDK version 8 for on-premise and self-hosted Arize AX with single or multiple endpoints.

This page covers **Arize AX Python SDK version 8** for on-premise and self-hosted Arize AX. For SDK v7, see [On-Premise SDK Usage — Version 7](/ax/selfhosting/on-premise-sdk-usage/version-7). For an overview of both versions, see [On-Premise SDK Usage](/ax/selfhosting/guides/sdk-usage).

***

# Single Endpoint

With single endpoints, all services are available through a common host address and port:

| Host                | Function                                                                                                                                                                    |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| arize-app.\<domain> | <ul><li>Arize AX UI</li><li>SDK pandas uploads and logs</li><li>OTEL traces with GRPC</li><li>OTEL traces with HTTP</li><li>Flightserver import/export, datasets.</li></ul> |

## Example with Arize AX Python SDK v8

Use `ArizeClient` with `single_host` so that all SDK endpoints (API, OTLP, and Flight) use the same host. You can omit `single_port` (default 443). Pass `space_id` and `project_name` on each operation (for example, when logging spans or listing datasets).

```python theme={null}
from arize import ArizeClient

client = ArizeClient(
    api_key=API_KEY,
    single_host="arize-app.<domain>",
    single_port=443,  # optional; default 443
)

# Pass space_id and project_name per operation
client.spans.log(space_id=SPACE_ID, project_name=PROJECT_NAME, dataframe=spans_df)
client.datasets.list(space_id=SPACE_ID)
```

For single-host deployments you can also set `SINGLE_HOST` in the environment and construct the client with only `single_host`.

## Example with OTEL traces and GRPC

```python theme={null}
# gRPC
from arize.otel import register, Transport
tracer_provider = register(
    space_id=SPACE_ID,
    api_key=API_KEY,
    endpoint="https://arize-app.<domain>/v1",
    # transport=Transport.GRPC,  # default
    ...
)
```

## Example with OTEL traces and HTTP

```python theme={null}
from arize.otel import register, Transport
tracer_provider = register(
    space_id=SPACE_ID,
    api_key=API_KEY,
    endpoint="https://arize-app.<domain>/v1/traces",
    transport=Transport.HTTP,
    ...
)
```

## Example: ML inference logging (same client)

The same `ArizeClient` is used for ML inference logging. Call `client.ml.log()` with `space_id`, `model_name`, `model_type`, `dataframe`, `schema`, and `environment`.

```python theme={null}
from arize import ArizeClient
from arize.ml.types import Schema, ModelTypes, Environments

client = ArizeClient(
    api_key=API_KEY,
    single_host="arize-app.<domain>",
    single_port=443,
)

schema = Schema(
    prediction_id_column_name="prediction_id",
    prediction_label_column_name="predicted_label",
    actual_label_column_name="actual_label",
    feature_column_names=["feature_1", "feature_2"],
)

client.ml.log(
    space_id=SPACE_ID,
    model_name="my-model",
    model_type=ModelTypes.BINARY_CLASSIFICATION,
    dataframe=predictions_df,
    schema=schema,
    environment=Environments.PRODUCTION,
)
```

## Example: Exporting spans (same client)

In SDK v8, export and dataset operations use the same `ArizeClient` instance. With a single endpoint, no extra configuration is needed.

```python theme={null}
from arize import ArizeClient
from datetime import datetime

client = ArizeClient(
    api_key=API_KEY,
    single_host="arize-app.<domain>",
    single_port=443,
)

df = client.spans.export_to_df(
    space_id=SPACE_ID,
    project_name=PROJECT_NAME,
    start_time=datetime(2024, 1, 1),
    end_time=datetime(2026, 1, 1),
)
```

## Example: Datasets and experiments (same client)

The same client is used for datasets and experiments. Create a dataset with `name`, `space_id`, and `examples` (a DataFrame); retrieve it with `datasets.get(dataset_id=...)`.

```python theme={null}
from arize import ArizeClient
import pandas as pd

client = ArizeClient(
    api_key=API_KEY,
    single_host="arize-app.<domain>",
    single_port=443,
)

# Datasets: create and get
created = client.datasets.create(
    name="my-dataset",
    space_id=SPACE_ID,
    examples=examples_df,
)
dataset = client.datasets.get(dataset_id=created.id)

# List and experiments
client.datasets.list(space_id=SPACE_ID)
client.experiments.run(name="my-experiment", dataset_id=DATASET_ID, task=my_task)
```

***

# Four Endpoints

If your deployment is configured with four endpoints, it requires different ingress configurations and host addresses:

| Host                   | Function                                                   |
| ---------------------- | ---------------------------------------------------------- |
| arize-app.\<domain>    | <ul><li>Arize AX UI</li><li>Auth</li><li>Copilot</li></ul> |
| arize-api.\<domain>    | <ul><li>SDK pandas uploads and logs</li></ul>              |
| arize-otlp.\<domain>   | <ul><li>OTEL traces (GRPC/HTTP)</li></ul>                  |
| arize-flight.\<domain> | <ul><li>Flightserver import/export, datasets.</li></ul>    |

## Example with Arize AX Python SDK v8

Use `ArizeClient` with separate hosts for API, OTLP, and Flight when your deployment uses four endpoints. Pass `space_id` on each operation. You can also use environment variables `ARIZE_API_HOST`, `ARIZE_OTLP_HOST`, `ARIZE_FLIGHT_HOST`, `ARIZE_FLIGHT_PORT`, and `ARIZE_FLIGHT_SCHEME` and construct the client with `ArizeClient(api_key=API_KEY)`.

```python theme={null}
from arize import ArizeClient

client = ArizeClient(
    api_key=API_KEY,
    api_host="arize-api.<domain>",
    api_scheme="https",
    otlp_host="arize-otlp.<domain>",
    otlp_scheme="https",
    flight_host="arize-flight.<domain>",
    flight_port=443,
    flight_scheme="grpc+tls",
)

client.spans.log(space_id=SPACE_ID, project_name=PROJECT_NAME, dataframe=spans_df)
client.spans.export_to_df(space_id=SPACE_ID, project_name=PROJECT_NAME, start_time=..., end_time=...)
client.datasets.list(space_id=SPACE_ID)
client.experiments.run(name="my-experiment", dataset_id=DATASET_ID, task=my_task)
```

## Example with OTEL traces and GRPC

```python theme={null}
from arize.otel import register, Transport
tracer_provider = register(
    space_id=SPACE_ID,
    api_key=API_KEY,
    endpoint="https://arize-otlp.<domain>/v1",
    # transport=Transport.GRPC,  # default
    ...
)
```

## Example with OTEL traces and HTTP

```python theme={null}
from arize.otel import register, Transport
tracer_provider = register(
    space_id=SPACE_ID,
    api_key=API_KEY,
    endpoint="https://arize-otlp.<domain>/v1/traces",
    transport=Transport.HTTP,
    ...
)
```

***

# Using an Enterprise-Issued Certificate

If your deployment uses a certificate signed by your own enterprise private CA or a self-signed certificate, follow the relevant instructions below for your deployment type and use case. You can set `ARIZE_SSL_CA_CERT` to a certificate path (or colon/semicolon-separated list of paths) and, in your code, set `REQUESTS_CA_BUNDLE` and `SSL_CERT_FILE` to that bundle **before** importing `arize`. To disable verification in development only: `ARIZE_REQUEST_VERIFY=false`.

## Obtaining the Root CA Certificate

First, obtain the **root CA certificate** that was used to sign your endpoint's certificate. This root certificate is typically managed by the security team and is common across environments.

## Extracting the Certificate (if root CA is not available)

If providing the root certificate doesn't resolve the issue or is not an option, extract the certificate directly from the endpoint:

```bash theme={null}
echo | openssl s_client -showcerts -state -connect <host>:443 -prexit > cert.pem
```

## Environment-based CA bundle and certificate options

**Environment-based CA bundle** — Set `ARIZE_SSL_CA_CERT` to the path to your `.crt` or `.pem` file. For multiple certs, use a colon-separated list (Unix) or semicolon-separated (Windows), e.g. `ARIZE_SSL_CA_CERT="/path/cert1.crt:/path/cert2.crt"`. In your code, **before** importing `arize`, set `REQUESTS_CA_BUNDLE` and `SSL_CERT_FILE` to that path (or to a single merged bundle file). You can merge multiple certs into one bundle and set these env vars so the SDK and OTLP exporter use your CA(s).

* **Temporarily disable certificate validation (not recommended for production):**

  Set `ARIZE_REQUEST_VERIFY=false` in the environment, or:

  ```python theme={null}
  from arize import ArizeClient
  client = ArizeClient(api_key=API_KEY, single_host="arize-app.<domain>", single_port=443, request_verify=False)
  ```
* **Provide the root certificate file via client:**

  ```python theme={null}
  from arize import ArizeClient
  client = ArizeClient(api_key=API_KEY, single_host="arize-app.<domain>", single_port=443, request_verify="cert.pem")
  ```

  Or use your system CA bundle:

  ```python theme={null}
  import certifi
  from arize import ArizeClient
  client = ArizeClient(api_key=API_KEY, single_host="arize-app.<domain>", single_port=443, request_verify=certifi.where())
  ```

  For four-endpoint deployments, pass the same `request_verify` value with `api_host`, `otlp_host`, and `flight_host` instead of `single_host`.

## OTEL Traces (GRPC/HTTP)

* **Set the `OTEL_EXPORTER_OTLP_CERTIFICATE` environment variable to your root certificate:**

  ```python theme={null}
  os.environ["OTEL_EXPORTER_OTLP_CERTIFICATE"] = "cert.pem"
  ```

  Or

  ```python theme={null}
  # if root cert has already been added to your system CA bundle
  import certifi
  os.environ['OTEL_EXPORTER_OTLP_CERTIFICATE'] = certifi.where()
  ```

## Flight (gRPC) connections

When using `ArizeClient` for export, datasets, or experiments, bulk data may be sent over Arrow Flight (gRPC). If you use a custom or enterprise certificate, set `GRPC_DEFAULT_SSL_ROOTS_FILE_PATH` so the gRPC layer can verify the server:

* **Set the `GRPC_DEFAULT_SSL_ROOTS_FILE_PATH` environment variable to your root certificate:**

  ```python theme={null}
  import os
  os.environ["GRPC_DEFAULT_SSL_ROOTS_FILE_PATH"] = "cert.pem"
  ```

  Or use your system CA bundle:

  ```python theme={null}
  import os
  import certifi
  os.environ["GRPC_DEFAULT_SSL_ROOTS_FILE_PATH"] = certifi.where()
  ```

***