On-Prem & Custom CA Bundles

#Private-network endpoints

The SDK sends your API key to whatever base URL it is given, so it refuses a private-network or loopback endpoint unless you opt in: an RFC 1918 address (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), an IPv6 unique-local address, a name under .internal, or localhost. That keeps a base URL which reaches your program from somewhere else — a setting, a request — from aiming the key at a service inside your network.

• Opt in for your own deployment with allow_private_base_url=True, or, when the code does not pass that argument, with RADMAH_ALLOW_PRIVATE_BASE_URL=1 in the environment. An explicit argument always wins: allow_private_base_url=False refuses whatever the environment says, which is what an application that accepts base URLs from its own users should pass.
• Give your deployment an https:// URL (with your CA's bundle, below). Plain http:// is still accepted, so a deployment that serves it keeps working, but the key and every response then cross your network unencrypted: for any http:// host other than this machine the SDK issues a radmah_sdk.InsecureBaseURLWarning.
• Cloud instance-metadata endpoints — 169.254.169.254 and the rest of the link-local range, metadata.google.internal, metadata.goog, AWS's instance-data names and the other clouds' metadata addresses — are always refused, in every spelling the transport accepts (Unicode full stops, a trailing dot, numeric and IPv6 forms). The opt-in does not change that.
• The host is judged as the connection will reach it: localhost, every name starting with it (localhost4, localhost6.localdomain6, …), names under .localhost, ip6-localhost and ip6-loopback are this machine and need the opt-in, whatever their spelling.
• A server's region redirect (HTTP 421) never moves the key from a public host into your network or from https:// to http://, and reaches another private host only from an opted-in https:// base URL. A refused redirect fails the call with REGION_REDIRECT_FAILED.
• A refused base URL raises radmah_sdk.BaseURLError, a ValueError whose reason is "private", "metadata", "invalid", "redirect" or "setting", before any request is sent.

#Why you need a CA bundle

Enterprise customers running the platform inside a closed network typically issue the API server's TLS certificate from an internal root CA that isn't trusted by the default system store bundled with certifi. Without re-rooting trust, every outbound call fails with ssl.SSLCertVerificationError: unable to get local issuer certificate. The SDK accepts a PEM bundle at construction time so operators can ship a consistent, reproducible trust store with their deployment.

#Using ca_bundle_path=

from radmah_sdk import RadMahClient

client = RadMahClient(
    api_key="sl_live_…",
    base_url="https://radmah.internal",       # private DNS name
    ca_bundle_path="/etc/radmah/internal-root-ca.pem",
    allow_private_base_url=True,                # opt-in to private hosts
)

# httpx is instructed to verify against your PEM — certificate
# verification is NOT disabled.
client.health()

#Deploy-time injection via environment variable

When you can't change the application code, set the endpoint, the private-endpoint opt-in and the trust store at the process level. The SDK reads each variable only when the matching argument (base_url=, allow_private_base_url=, ca_bundle_path=) is omitted — explicit caller arguments always win.

export RADMAH_CA_BUNDLE=/etc/radmah/internal-root-ca.pem
export RADMAH_API_URL=https://radmah.internal
export RADMAH_ALLOW_PRIVATE_BASE_URL=1
python -m your_app

#The rady CLI

rady reads the same three variables, so one exported configuration serves your applications and your shell — every command, rady ics techniques and rady jobs error included. For a single command, pass --allow-private-base-url before the command instead of exporting the opt-in. http://localhost:8000 (local development on this machine) needs neither. An http:// URL to any other host is refused, because the key would cross the network unencrypted, unless you opt in by name: rady --allow-insecure-http for one command or RADMAH_ALLOW_INSECURE_HTTP=1 (also read by the SDK, whose argument is allow_insecure_http=True; SDK and CLI 1.4.0). The flag also accepts that typed URL as a private endpoint; the variable lifts only the cleartext refusal, so a private http:// endpoint also needs RADMAH_ALLOW_PRIVATE_BASE_URL=1. Even then rady prints a one-line warning on stderr, and a region redirect never carries the key from it to another host on your network. RADMAH_ALLOW_PRIVATE_BASE_URL=0 refuses private endpoints outright.

export RADMAH_CA_BUNDLE=/etc/radmah/internal-root-ca.pem
export RADMAH_API_URL=https://radmah.internal
export RADMAH_ALLOW_PRIVATE_BASE_URL=1
rady auth login
rady jobs list

# Or opt in for one command; the flag goes before the command:
rady --allow-private-base-url auth whoami --base-url https://radmah.internal

#Validation rules

The SDK validates the bundle at construction time — you get a loud ValueError instead of a surprise SSLError deep inside a worker on its first request. A bundle is accepted when all of the following are true:

• The path exists and points to a regular file (directory-hash trust stores are not supported — concatenate the CA and every intermediate into a single PEM).
• The file is readable by the current process user.
• The first 8 KB contains a -----BEGIN CERTIFICATE----- marker (PEM format check).
• ~ expansions are resolved to the caller's home.

#Can I turn off verification?

#Async client

AsyncRadMah shares the same validators and accepts the same allow_private_base_url= and ca_bundle_path= arguments and environment variables:

from radmah_sdk import AsyncRadMah

async with AsyncRadMah(
    api_key="sl_live_…",
    base_url="https://radmah.internal",
    ca_bundle_path="/etc/radmah/internal-root-ca.pem",
    allow_private_base_url=True,
) as client:
    await client.health()