Lesson 6	Oracle 26ai Tools for Internet Applications
Objective	Identify the database features, application tools, and OCI services used to build secure, scalable internet applications with Oracle AI Database 26ai.

Oracle 26ai Tools for Internet Applications

Oracle AI Database 26ai supports internet applications through SQL, JSON documents, graph queries, and vector similarity search. Application tools such as Oracle REST Data Services (ORDS) and Oracle APEX make these capabilities accessible to web clients. Oracle Cloud Infrastructure (OCI) adds hosting, identity, networking, and object storage services.

These components operate at different layers and have separate configuration requirements. A database feature does not automatically publish a secure web endpoint, and an OCI service is not necessarily installed with the database. Many of the same application patterns also work on premises.

Oracle REST Data Services: Publish Database APIs

ORDS is a Java middle-tier service that exposes configured database resources through HTTP APIs. Applications can use it to retrieve data, submit changes, and invoke SQL or PL/SQL operations. Production endpoints should use HTTPS with appropriate authentication and authorization.

AutoREST can expose supported database objects with less custom code. Developers can also define REST modules and handlers when they need a controlled API contract, business validation, or specific transaction behavior. Available operations depend on the resource type, configuration, privileges, and update capabilities; enabling a view does not make every underlying operation valid.

Autonomous AI Database provides managed ORDS access, reducing the work required to operate the middle tier. Developers and administrators still configure REST-enabled schemas, resources, and access controls. On a self-managed deployment, the team also manages ORDS installation, network exposure, updates, and capacity.

ORDS provides an API layer. It does not replace LDAP directory services, and publishing a resource does not automatically make that resource appropriate for anonymous internet access.

JSON-Relational Duality Views: Work with Documents and Tables

JSON-relational duality views present related relational data as JSON documents. Applications can work with a document representation while the underlying tables retain their relational structure and constraints. SQL applications can continue to access those tables.

The view definition determines its document structure and which inserts, updates, or deletes are permitted. An application can retrieve a supported document and submit an allowed change, which Oracle applies to the underlying tables according to the view's rules.

ETAG values support optimistic concurrency control. When the application uses the supported ETAG-checking update mechanism, a stale document version can be rejected. The application then decides whether to retrieve the latest version, retry, or ask the user to resolve the conflict. ETAGs do not automatically merge competing edits, and fields excluded from the ETAG calculation are not protected by that comparison.

Duality views can reduce custom document-to-table mapping code. They do not remove the need for data modeling, validation, access controls, or application transaction design. REST access also requires the appropriate API configuration.

Oracle APEX: Build Database-Backed Web Applications

Oracle APEX is a low-code platform for applications such as reporting portals, data-entry systems, approval workflows, and administrative interfaces. Developers define application pages and behavior using database-backed metadata, SQL, PL/SQL, and the platform's components.

Its architecture includes a browser, a web tier commonly provided by ORDS, and the APEX engine in Oracle Database. A managed service can operate parts of this infrastructure for you, but the HTTP tier still exists. APEX reduces the amount of custom application infrastructure developers must build; it does not eliminate that layer.

Configure authentication schemes, authorization rules, session protection, and database privileges for the application. A generated page is not automatically ready for unrestricted public deployment. APEX can consume REST services and integrate with other systems where the application requires them.

Identity and Authorization: Protect Each Layer

OCI IAM identity domains provide identity capabilities for applications, including federation and support for OpenID Connect and OAuth 2.0. Oracle incorporated Identity Cloud Service capabilities into OCI IAM. Existing LDAP directories can still participate in enterprise identity designs; token-based application access does not universally replace them.

OpenID Connect supports sign-in, while OAuth 2.0 provides an authorization framework for access to protected resources. For a JWT-based ORDS integration, configure the trusted token issuer, audience, signature validation, token lifetime checks, and the applicable authorization mapping.

Keep three permission systems distinct: OCI policies govern cloud resources, application or ORDS rules govern API operations, and database privileges govern SQL access. They can be integrated through supported configurations, but an OCI policy does not automatically become an ORDS privilege. HTTPS protects transport and must be combined with these access controls.

Additional Capabilities for Internet Workloads

Application Drivers and Connection Pools

Custom application servers can connect directly with a language-appropriate driver, such as Oracle JDBC Thin for Java. Application connection pools reuse database connections and control concurrency. ORDS is therefore one integration choice, not a requirement for every application. Size connection pools across all application instances against the database's available capacity.

AI Vector Search

AI Vector Search stores and compares embeddings using the VECTOR data type and vector-distance operations. Applications can combine similarity retrieval with relational filters for tasks such as product discovery or retrieval-augmented generation.

Embeddings require a compatible model and a processing pipeline. They can be generated through supported in-database models, application code, or external services. Storing a document or image does not automatically create its embedding, and vector search alone does not generate a language-model answer.

Document and Graph Access

The Oracle AI Database API for MongoDB supports MongoDB-compatible access to JSON document collections in supported deployments. Check the documented command, driver, and feature compatibility before adopting it for an existing application. It is not a guarantee that every MongoDB application runs unchanged.

SQL property graphs describe vertices and edges over database data. The GRAPH_TABLE operator supports graph-pattern queries, useful for relationship-oriented tasks. An application or REST handler can expose selected results, while a separate interface provides any required visualization.

Content Storage and Delivery

Store binary content in SecureFiles BLOB columns or an external repository such as OCI Object Storage, according to transaction, recovery, and delivery requirements. Keep metadata and object references in relational tables when useful. These are storage choices rather than a requirement to duplicate every file in both locations.

Deliver content through authorized application endpoints, configured ORDS media handlers, or appropriate object-storage access mechanisms. Database backup does not automatically protect externally stored objects, and a database permission does not automatically grant access to an object-storage bucket.

Scaling Specialized Workloads

Oracle True Cache can offload suitable read workloads through a separately configured cache architecture. Distributed database designs can address requirements such as partitioning data across locations. These are architectural decisions, not automatic benefits of using 26ai. Evaluate consistency, routing, availability, operational complexity, and supported deployment options against measured requirements.

Choose Tools by the Application Task

Tools and features for common internet application requirements
Application requirement	Relevant tool or feature
Expose selected database operations over HTTPS	ORDS with configured handlers and access controls.
Build forms, reports, and workflows	Oracle APEX with an appropriate web tier and application security.
Represent relational data as JSON documents	JSON-relational duality views.
Run custom application logic outside the database	Application framework, database driver, and connection pool.
Support federated application sign-in	OCI IAM identity domains or another supported identity provider.
Store and deliver images or documents	SecureFiles BLOBs or object storage, with controlled delivery.
Retrieve semantically similar content	Compatible embedding models and AI Vector Search.
Query relationships as graph patterns	SQL property graphs and `GRAPH_TABLE`.

Start with the interface the application needs, then choose the data model, identity integration, and deployment components that support it. Oracle 26ai provides database capabilities; a working internet application also depends on deliberate API design, security configuration, and operational planning.

Oracle Documentation