Manage Users for Oracle VecDB

Prepare a database user with the privileges, REST access, quota, and credentials required by the Oracle VecDB Python SDK.

User Requirements

The SDK connects through an ORDS REST endpoint. The user that owns or accesses vector tables must have:

Privileges required to create and manage vector tables, models, records, and indexes.
An ORDS-enabled schema and a REST endpoint exposing the /vecdb/ service.
A quota on the tablespace where vector tables are created.
Credentials or an access token accepted by the ORDS endpoint.

The exact privileges depend on the database deployment and security policy. A database administrator should grant only the privileges required by the intended API operations.

On-Premises

For ORDS on premises, grant the DB_DEVELOPER_ROLE role and the CREATE MINING MODEL privilege.

ADB-S

For ORDS on ADB-S, grant the DB_DEVELOPER_ROLE and OML_DEVELOPER roles, and enable the OCI$RESOURCE_PRINCIPAL privilege.

Create a New Vector Database User Using SQL

Complete the following steps to create a new Vector Database user using SQL.

In the Database Actions dropdown list, select SQL to use a SQL Worksheet.
Run the following SQL statements for your deployment:

On-Premises

For ORDS on premises, create the user and grant the required role and privilege:

-- USER SQL
CREATE USER <VECTOR_USER> IDENTIFIED BY "<PASSWORD>";

-- ADD ROLE AND PRIVILEGE
GRANT DB_DEVELOPER_ROLE, CREATE MINING MODEL TO <VECTOR_USER>;

-- REST ENABLE
BEGIN
  ORDS_ADMIN.ENABLE_SCHEMA(p_schema => '<VECTOR_USER>');
END;
/

-- QUOTA
ALTER USER <VECTOR_USER> QUOTA UNLIMITED ON DATA;

ADB-S

For ORDS on ADB-S, create the user, grant the required roles, and enable its resource principal:

-- USER SQL
CREATE USER <VECTOR_USER> IDENTIFIED BY "<PASSWORD>";

-- ADD ROLES
GRANT DB_DEVELOPER_ROLE, OML_DEVELOPER TO <VECTOR_USER>;

-- REST ENABLE
BEGIN
  ORDS_ADMIN.ENABLE_SCHEMA(p_schema => '<VECTOR_USER>');
END;
/

-- QUOTA
ALTER USER <VECTOR_USER> QUOTA UNLIMITED ON DATA;

-- OCI$RESOURCE_PRINCIPAL
BEGIN
  DBMS_CLOUD_ADMIN.ENABLE_RESOURCE_PRINCIPAL(username => '<VECTOR_USER>');
END;
/

The SQL examples enable the new schema for ORDS. The ADB-S example also enables the resource principal for OCI resources such as Object Storage. Store credentials according to your organization’s secret-management policy; do not place them in source code.

Grant Privileges to an Existing User

Complete the following steps to grant the required access to an existing Vector Database user.

In the Database Actions dropdown list, select SQL to use a SQL Worksheet.
Run the following SQL statements for your deployment:

On-Premises

For ORDS on premises, grant the required role and privilege:

-- ADD ROLE AND PRIVILEGE
GRANT DB_DEVELOPER_ROLE, CREATE MINING MODEL TO <VECTOR_USER>;

-- REST ENABLE
BEGIN
  ORDS_ADMIN.ENABLE_SCHEMA(p_schema => '<VECTOR_USER>');
END;
/

-- QUOTA
ALTER USER <VECTOR_USER> QUOTA UNLIMITED ON DATA;

ADB-S

For ORDS on ADB-S, grant the required roles and enable the user’s resource principal:

-- ADD ROLES
GRANT DB_DEVELOPER_ROLE, OML_DEVELOPER TO <VECTOR_USER>;

-- REST ENABLE
BEGIN
  ORDS_ADMIN.ENABLE_SCHEMA(p_schema => '<VECTOR_USER>');
END;
/

-- QUOTA
ALTER USER <VECTOR_USER> QUOTA UNLIMITED ON DATA;

-- OCI$RESOURCE_PRINCIPAL
BEGIN
  DBMS_CLOUD_ADMIN.ENABLE_RESOURCE_PRINCIPAL(username => '<VECTOR_USER>');
END;
/

Configure ORDS so the user can access /vecdb/. Supply the resulting URL to Configuration(rest_url=...); see Configuration.

Connect with the SDK

from oracle_vecdb import Configuration, OracleVecDB

client = OracleVecDB(
    Configuration(
        rest_url="https://<host>/ords/<schema>/_/db-api/stable/vecdb/",
        access_token="<bearer-token>",
        # Or use basic authentication: username="<user>", password="<pass>",
    )
)

After connecting, verify access with describe_vector_database().