Access the MLflow API

Overview

This guide explains how to enable and use the external MLflow API endpoint for production workloads.

It uses the mcaip-kflw product and the mcaip-kflw namespace as the only concrete example. The same flow applies to other production namespaces where MLflow API access is enabled.

This guide covers API access only and does not change the existing MLflow UI endpoint.

Prerequisites

• You have access to the namespace-scoped caip-developer role.
• MLflow is already enabled for your namespace.
• mlflow-api-auth is enabled for your namespace.
• You know which username and password you want to use for BasicAuth.

Step 1: Create the AWS Secrets Manager secret

Create the secret with your namespace caip-developer role.

The runtime expects the following secret name format:

/${var.product_name}/${namespace}/${var.env}/${var.region}/mlflow/api-traefik-basicauth

For the production example in this guide, the values are:

• product_name: mcaip-kflw
• namespace: mcaip-kflw
• env: prod
• region: eu-central-1

This produces the following secret name:

/mcaip-kflw/mcaip-kflw/prod/eu-central-1/mlflow/api-traefik-basicauth

For CN production, use product_name=mcaip-cn, env=prod, region=cn-north-1, and your China namespace for the namespace segment.

The secret value must contain exactly these two keys:

• username
• password

The values are customer-defined.

Example secret payload:

{
  "username": "<your-username>",
  "password": "<your-password>"
}

Example command:

aws secretsmanager create-secret \
  --name "/mcaip-kflw/mcaip-kflw/prod/eu-central-1/mlflow/api-traefik-basicauth" \
  --secret-string '{"username":"<your-username>","password":"<your-password>"}'

If the secret already exists, update it instead of creating a second secret with a different name.

Step 2: Enable mlflow-api-auth in product.yaml

Update your namespace configuration in product.yaml.

The flag must be enabled in products/mcaip-kflw/product.yaml under kubeflow_profiles.mcaip-kflw.

kubeflow_profiles:
  mcaip-kflw:
    mlflow:
      enabled: true
    mlflow-api-auth:
      enabled: true

The external API resources are created only when both of these conditions are true for the namespace:

• mlflow.enabled: true
• mlflow-api-auth.enabled: true

Step 3: Wait for the rollout to finish

After the secret is in AWS Secrets Manager and the product.yaml change is applied, wait for the rollout to complete.

Once the rollout is finished, the BasicAuth-protected MLflow API endpoint is available for the namespace.

Step 4: Call the MLflow API

For the mcaip-kflw ROW production namespace, use the production API host:

https://api.mlflow.caip.bmw.cloud

For CN production, use https://api.mlflow.caip.bmwchina.cloud and keep the same /<namespace>/api/... path structure.

The request path must include the namespace prefix:

/mcaip-kflw

For API requests, use the /api/... path. This path is routed to the MLflow API for the namespace.

Example: get an experiment by name with a read-only request. Replace default with your own experiment name.

export MLFLOW_API_USERNAME="<your-username>"
export MLFLOW_API_PASSWORD="<your-password>"

curl \
  -u "${MLFLOW_API_USERNAME}:${MLFLOW_API_PASSWORD}" \
  -X GET \
  "https://api.mlflow.caip.bmw.cloud/mcaip-kflw/api/2.0/mlflow/experiments/get-by-name?experiment_name=default"

Example response with sensitive values hidden:

{
  "experiment": {
    "experiment_id": "0",
    "name": "Default",
    "artifact_location": "s3://<redacted-bucket>/<redacted-prefix>/0",
    "lifecycle_stage": "active",
    "last_update_time": 1756718466584,
    "creation_time": 1754958578636,
    "tags": [
      {
        "key": "mlflow.experimentKind",
        "value": "custom_model_development"
      }
    ]
  }
}

If the credentials and rollout are correct, MLflow returns a JSON response for the requested experiment.

Notes

• This guide documents the production flow only.
• The external API host is shared, but routing is namespace-specific through the URL path prefix.
• If the request fails with 401 Unauthorized, verify the username and password values in AWS Secrets Manager.
• If the request fails after authentication, verify that the rollout has completed and that mlflow-api-auth is enabled for the namespace.