arize-ai-provider-integration

Arize AI Integration Skill

SPACE — Most --space flags and the ARIZE_SPACE env var accept a space name (e.g., my-workspace) or a base64 space ID (e.g., U3BhY2U6...). Find yours with ax spaces list. Note: ai-integrations create does not accept --space — AI integrations are account-scoped. Use --space only with list, get, update, and delete.

Concepts

• AI Integration = stored LLM provider credentials registered in Arize; used by evaluators to call a judge model and by other Arize features that need to invoke an LLM on your behalf
• Provider = the LLM service backing the integration (e.g., openAI, anthropic, awsBedrock)
• Integration ID = a base64-encoded global identifier for an integration (e.g., TGxtSW50ZWdyYXRpb246MTI6YUJjRA==); required for evaluator creation and other downstream operations
• Scoping = visibility rules controlling which spaces or users can use an integration
• Auth type = how Arize authenticates with the provider: default (provider API key), proxy_with_headers (proxy via custom headers), or bearer_token (bearer token auth)

Prerequisites

Proceed directly with the task — run the ax command you need. Do NOT check versions, env vars, or profiles upfront.

If an ax command fails, troubleshoot based on the error:

• command not found or version error → The ax CLI is not installed or not in the PATH. Install it using the correct package name from Arize documentation. Use a pinned, verified version (e.g., pip install arize-ax==<version>) and confirm the package name against official Arize docs before installing. If ax is installed but outdated, upgrade it.
• 401 Unauthorized / missing API key → run ax profiles show to inspect the current profile. If the profile is missing or the API key is wrong, follow the instructions in references/ax-profiles.md to create/update it. (Warning: This may involve modifying shell profile files like ~/.bashrc to persist credentials.) If the user doesn't have their key, direct them to https://app.arize.com/admin > API Keys.
• Space unknown → run ax spaces list to pick by name, or ask the user
• LLM provider call fails (missing OPENAI_API_KEY / ANTHROPIC_API_KEY) → run ax ai-integrations list --space SPACE to check for platform-managed credentials. If none exist, ask the user to provide the key or create an integration via the arize-ai-provider-integration skill
• Security: Never read .env files or search the filesystem for credentials. Use ax profiles for Arize credentials and ax ai-integrations for LLM provider keys. If credentials are not available through these channels, ask the user.
• Setting provider API keys securely: Do not run export KEY=literal_value in a terminal session — the literal value will persist in shell history. Prefer a secrets manager (e.g., 1Password CLI op run, AWS Secrets Manager, HashiCorp Vault) to inject variables at execution time.

List AI Integrations

List all integrations accessible in a space:

ax ai-integrations list --space SPACE

Filter by name (case-insensitive substring match):

ax ai-integrations list --space SPACE --name "openai"

Paginate large result sets:

# Get first page
ax ai-integrations list --space SPACE --limit 20 -o json

# Get next page using cursor from previous response
ax ai-integrations list --space SPACE --limit 20 --cursor CURSOR_TOKEN -o json

Key flags:

Response fields:

Get a Specific Integration

ax ai-integrations get NAME_OR_ID
ax ai-integrations get NAME_OR_ID -o json
ax ai-integrations get NAME_OR_ID --space SPACE   # required when using name instead of ID

Use this to inspect an integration's full configuration or to confirm its ID after creation.

Create an AI Integration

Before creating, always list integrations first — the user may already have a suitable one:

ax ai-integrations list --space SPACE

If no suitable integration exists, create one. The required flags depend on the provider.

Security note — process-list exposure: When --api-key is passed on the command line, the shell substitutes the variable before execution, making the plaintext secret visible in the OS process list (ps aux, /proc/*/cmdline, system audit logs) to any process running as the same user. For production environments, verify whether ax reads the key from the environment variable implicitly (allowing you to omit --api-key entirely); if not, ensure this is acceptable in your environment and that keys are injected via a secrets manager rather than exported in a terminal session.

OpenAI

ax ai-integrations create \
  --name "My OpenAI Integration" \
  --provider openAI \
  --api-key $OPENAI_API_KEY

Anthropic

ax ai-integrations create \
  --name "My Anthropic Integration" \
  --provider anthropic \
  --api-key $ANTHROPIC_API_KEY

Azure OpenAI

ax ai-integrations create \
  --name "My Azure OpenAI Integration" \
  --provider azureOpenAI \
  --api-key $AZURE_OPENAI_API_KEY \
  --base-url "https://my-resource.openai.azure.com/"

AWS Bedrock

AWS Bedrock uses IAM role-based auth. Provide the ARN of the role Arize should assume via --provider-metadata:

ax ai-integrations create \
  --name "My Bedrock Integration" \
  --provider awsBedrock \
  --provider-metadata '{"role_arn": "arn:aws:iam::123456789012:role/ArizeBedrockRole"}'

Vertex AI

Vertex AI uses GCP service account credentials. Provide the GCP project and region via --provider-metadata:

ax ai-integrations create \
  --name "My Vertex AI Integration" \
  --provider vertexAI \
  --provider-metadata '{"project_id": "my-gcp-project", "location": "us-central1"}'

Gemini

ax ai-integrations create \
  --name "My Gemini Integration" \
  --provider gemini \
  --api-key $GEMINI_API_KEY

NVIDIA NIM

ax ai-integrations create \
  --name "My NVIDIA NIM Integration" \
  --provider nvidiaNim \
  --api-key $NVIDIA_API_KEY \
  --base-url "https://integrate.api.nvidia.com/v1"

Custom (OpenAI-compatible endpoint)

ax ai-integrations create \
  --name "My Custom Integration" \
  --provider custom \
  --base-url "https://my-llm-proxy.example.com/v1" \
  --api-key $CUSTOM_LLM_API_KEY

Supported Providers

Optional flags for any provider

After creation

Capture the returned integration ID (e.g., TGxtSW50ZWdyYXRpb246MTI6YUJjRA==) — it is needed for evaluator creation and other downstream commands. If you missed it, retrieve it:

ax ai-integrations list --space SPACE -o json
# or by name/ID directly:
ax ai-integrations get NAME_OR_ID

Update an AI Integration

update is a partial update — only the flags you provide are changed. Omitted fields stay as-is. (Note: using --api-key here carries the same process-list exposure risk described in the Create section above.)

# Rename
ax ai-integrations update NAME_OR_ID --name "New Name"

# Rotate the API key (see process-list exposure note above)
ax ai-integrations update NAME_OR_ID --api-key $OPENAI_API_KEY

# Change the model list (replaces all existing model names)
ax ai-integrations update NAME_OR_ID --model-name gpt-4o --model-name gpt-4o-mini

# Update base URL (for Azure, custom, or NIM)
ax ai-integrations update NAME_OR_ID --base-url "https://new-endpoint.example.com/v1"

Add --space SPACE when using a name instead of ID. Any flag accepted by create can be passed to update.

Delete an AI Integration

Warning: Deletion is permanent. Evaluators that reference this integration will no longer be able to run.

# Recommended: prompts for confirmation before deleting
ax ai-integrations delete NAME_OR_ID
ax ai-integrations delete NAME_OR_ID --space SPACE   # required when using name instead of ID

# For non-interactive automation only (skips confirmation, cannot be undone):
ax ai-integrations delete NAME_OR_ID --force
ax ai-integrations delete NAME_OR_ID --space SPACE --force

Troubleshooting

Related Skills

• arize-evaluator: Create LLM-as-judge evaluators that use an AI integration → use arize-evaluator
• arize-experiment: Run experiments that use evaluators backed by an AI integration → use arize-experiment

Save Credentials for Future Use

To persist Arize credentials between sessions, a user may update their shell profile manually. Do not modify shell profiles (~/.zshrc, ~/.bashrc, etc.) autonomously. If the user requests persistent credential setup, show them the instructions from references/ax-profiles.md and ask them to apply the changes themselves, or confirm explicit permission before proceeding.