# Experiments

Ingests MLflow experiment metadata, tracking names, lifecycle stage, tags, and timestamps from your MLflow tracking server.

**Sync Type: Incremental**

## Prerequisites

Before configuring this input, you need:

1. **A running MLflow tracking server** — the server must be reachable over HTTPS from Monad. Self-hosted and managed deployments (e.g. Databricks MLflow) are both supported.

2. **Credentials for your deployment** (if authentication is enabled):
   - **None** — for OSS MLflow deployments started without the `mlflow.server.auth` plugin.
   - **Basic (username + password)** — if the `mlflow.server.auth` plugin is active on your server.
   - **Bearer token** — if an OIDC/oauth2-proxy reverse-proxy sits in front of MLflow.

## Authentication

MLflow supports three authentication modes. Select the one that matches your deployment:

### None

No credentials are required. This is the default for OSS MLflow deployments that were started without the `mlflow.server.auth` plugin. All API requests are made without an `Authorization` header.

### Basic (username + password)

Used when the `mlflow.server.auth` plugin is enabled on your MLflow server. Monad sends an HTTP Basic `Authorization` header with every request.

To create a user (if you administer the server):

```bash
mlflow server --app-name basic-auth
# then use the REST admin API or the mlflow CLI to create users
```

See the [MLflow authentication documentation](https://mlflow.org/docs/latest/auth/index.html) for details.

### Bearer token

Used when an OIDC provider or oauth2-proxy reverse-proxy is in front of MLflow and issues short-lived tokens. Provide the token value; Monad sends it as `Authorization: Bearer <token>` on every request. Rotate the token in Monad when it expires.

## Configuration

### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Base URL | string (URL) | Yes | The base URL of the MLflow tracking server. Must use HTTPS. Example: `https://mlflow.example.com` |
| Authentication | one of | Yes | Authentication mode and credentials. Choose **None**, **Basic (username + password)**, or **Bearer token** — see [Authentication](#authentication) above. |
| Backfill Start Time | string (date-time) | No | ISO 8601 / RFC 3339 date from which to start fetching data on the first run. If omitted, only experiments updated since the connector was created are ingested. |
| Use Synthetic Data | boolean | No | Generate synthetic demo data instead of connecting to the real MLflow server. Useful for pipeline testing. |

#### Authentication sub-fields

**Basic (username + password)**

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| Username | string | Yes | HTTP Basic auth username. |
| Password | secret | Yes | HTTP Basic auth password. |

**Bearer token**

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| Bearer Token | secret | Yes | Bearer token issued by an OIDC/oauth2-proxy in front of MLflow. |

## Setup Walk-through

1. In Monad, create a new **MLflow Experiments** input.

2. Enter the **Base URL** of your MLflow tracking server (must start with `https://`).

3. Select the **Authentication** mode that matches your MLflow deployment:
   - Choose **None** for an unauthenticated OSS server.
   - Choose **Basic** and supply the username and password if `mlflow.server.auth` is enabled.
   - Choose **Bearer token** and paste the token if a reverse-proxy handles auth.

4. Optionally set a **Backfill Start Time** to ingest historical experiments from a specific date.

5. Save the input and attach it to a pipeline. On the first run Monad will page through all experiments updated since the backfill start time (or connector creation) and continue incrementally on subsequent runs.

## Troubleshooting

### Common Issues

1. **Connection refused or SSL errors**
   - Confirm the Base URL uses `https://` and that the server's TLS certificate is valid. Self-signed certificates are not supported.
   - Check that the MLflow server is reachable from Monad's egress IPs.

2. **401 Unauthorized**
   - The authentication mode or credentials are incorrect.
   - For **Basic** auth, verify the username and password against the `mlflow.server.auth` user store.
   - For **Bearer** auth, confirm the token has not expired. Rotate the **Bearer Token** secret in Monad with a fresh token if needed.

3. **403 Forbidden**
   - The user or token has insufficient permissions to call `POST /api/2.0/mlflow/experiments/search`. Grant the user `READ` access on experiments in the MLflow auth admin UI.

4. **No experiments appearing**
   - If **Backfill Start Time** is set, ensure at least one experiment has a `last_update_time` on or after that date.
   - Verify the MLflow server has experiments by running `mlflow experiments search` directly against the server.

## Related Articles

- [MLflow Tracking documentation](https://mlflow.org/docs/latest/tracking.html)
- [MLflow authentication](https://mlflow.org/docs/latest/auth/index.html)
- [MLflow REST API — Search Experiments](https://mlflow.org/docs/latest/rest-api.html#search-experiments)