How to Configure Oracle AI Database 26ai ACLs and test access to the Oracle Private AI Services Container

Background

In Getting started with the Oracle Private AI Services Container I shared how to install and configure the Oracle Private AI Services container for secure access.

The post How to configure and test secure access to the Oracle Private AI Services Container detailed how to configure an Oracle Linux server for secure https access. and test connectivity and usage with curl.

Introduction

In this post I show how the we can configure and test Oracle AI Database 26ai connectivity to the Oracle Private AI Services Container.

Oracle Private AI Services Container Access

The Oracle database utl_http package can be used to make HTTP callouts from within the database using SQL and PL/SQL.

Let’s use the utl_http package to test connectivity and database access privileges to Private AI Services Container. Providing the end-point and token, for example:

set serveroutput on;

declare
  l_url      varchar2(100) := 'https://z-re-ora1.uklab.purestorage:8443/v1/models';
  l_token    varchar2(100) := 'Bearer 216c5e9c6242881ded41479688a9bbbe3bb22d771a356d28659e3d726fa1a285';
  l_request  utl_http.req;
  l_response utl_http.resp;
  l_buffer   varchar2(32766);
  l_name     varchar2(256);
  l_value    varchar2(1024);

begin
  l_request  := utl_http.begin_request(l_url);

  -- set Headers
  utl_http.set_header(l_request,'Content-Type', 'application/json');
  utl_http.set_header(l_request,'Authorization', l_token);

  -- get Response
  l_response := utl_http.get_response(l_request);

  dbms_output.put_line('List privateAI models using ' || l_url);
  dbms_output.put_line('Response status code: ' || l_response.status_code);

  -- Loop through the response.
  begin
    loop
      utl_http.read_text(l_response, l_buffer, 32766);
      dbms_output.put_line ('Response: ' || l_buffer);
    end loop;
  exception
    when utl_http.end_of_body then
      utl_http.end_response(l_response);
    end;
  end privateAI;
/
exit;

If the user does the correct database Access Control Lists (ACLs) configured you will hit an ORA-24247 error, for example:

ERROR at line 1:
ORA-29273: HTTP request failed
ORA-24247: network access denied by access control list (ACL)
ORA-06512: at "SYS.UTL_HTTP", line 380
ORA-06512: at "SYS.UTL_HTTP", line 1189
ORA-06512: at line 11
Help: https://docs.oracle.com/error-help/db/ora-29273/

Set-up Access Control Rules

To correct the ORA-2427 error. We need to grant the database user access to the Private AI Services Container URL and port.

For example, vector_user access to z-re-ora1.uklab.purestorage.com on port 8443.

BEGIN
  DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(
    host => 'z-re-ora1.uklab.purestorage.com',
    lower_port => 8443,
    upper_port => 8443,
    ace  => xs$ace_type(
             privilege_list => xs$name_list('http'),
             principal_name => 'vector_user',
             principal_type => xs_acl.ptype_db));
END;
/

Check ACL Grants

Using the dba_host_aces view:

COLUMN host FORMAT A35

SELECT host,
       lower_port,
       upper_port,
       ace_order,
       grant_type,
       inverted_principal,
       principal,
       principal_type,
       privilege
FROM   dba_host_aces
WHERE host='z-re-ora1.uklab.purestorage.com'
ORDER BY host, ace_order;

HOST				    LOWER_PORT UPPER_PORT  ACE_ORDER GRANT INV PRINCIPAL         PRINCIPAL_T PRIVILEGE
----------------------------------- ---------- ---------- ---------- ----- --- ----------------- ----------- --------
z-re-ora1.uklab.purestorage.com 	  8443	     8443	   1 GRANT NO  VECTOR_USER	 DATABASE    HTTP

Repeat Test

Repeating the previous Oracle Private AI Services Container access test. This time with the ACLs correctly configured, provides the expected results:

List privateAI models using
https://z-re-ora1.uklab.purestorage.com:8443/v1/models
Response status code: 200
Response:
{"data":[{"id":"clip-vit-base-patch32-img","modelDeployedTime":"2026-05-19T14:33
:57.46690696Z","modelSize":"335.38M","modelCapabilities":["IMAGE_EMBEDDINGS"]},{
"id":"clip-vit-base-patch32-txt","modelDeployedTime":"2026-05-19T14:33:57.469096
749Z","modelSize":"243.57M","modelCapabilities":["TEXT_EMBEDDINGS"]},{"id":"mult
ilingual-e5-large","modelDeployedTime":"2026-05-19T14:33:57.474053409Z","modelSi
ze":"2.09G","modelCapabilities":["TEXT_EMBEDDINGS"]},{"id":"all-minilm-l12-v2","
modelDeployedTime":"2026-05-19T14:33:57.458951647Z","modelSize":"127.13M","model
Capabilities":["TEXT_EMBEDDINGS"]},{"id":"multilingual-e5-base","modelDeployedTi
me":"2026-05-19T14:33:57.471588518Z","modelSize":"1.04G","modelCapabilities":["T
EXT_EMBEDDINGS"]},{"id":"all-mpnet-base-v2","modelDeployedTime":"2026-05-19T14:3
3:57.46432751Z","modelSize":"415.82M","modelCapabilities":["TEXT_EMBEDDINGS"]}]}

PL/SQL procedure successfully completed.

Summary

In this post I have shared how to configure Oracle AI Database 26ai ACLs and test secure access to the Oracle Private AI Services Container using the utl_http database package.

In my next blog post, I will introduce the new Oracle AI Database 26ai DBMS_VECTOR package, and demonstrate how this can be used to create Vector embeddings without any dependancy on the public cloud or internet.