OCI Object Storage Data Source

Connect an OCI Object Storage bucket to a Knowledge Agent so it can retrieve and ground answers in approved bucket content.

OCI Object Storage data sources let Agent Factory use OCI API-key authentication to enumerate eligible objects, download supported documents, and ingest their content for Knowledge Agent retrieval.

Note:

OCI Object Storage data sources support OCI API-key authentication only. Instance principals, resource principals, and Swift API or protocol access are not supported.

Although Agent Factory can parse a Swift-shaped URL to identify a namespace and bucket, it still crawls the bucket by using native OCI API-key authentication.

Prerequisites

Before you create the data source, create or select an OCI user for the integration and generate or upload an API signing key for that user. Collect the user OCID, tenancy OCID, bucket name, region, namespace, API private key, and API key fingerprint.

Grant the OCI user or group only the Object Storage permissions needed for the target bucket: list objects, read objects, and create object-read pre-authenticated requests. Confirm the required policy syntax for your tenancy, compartment, and bucket policy model.

Configure an OCI Object Storage Data Source

  1. Select Data Sources in the navigation menu.

  2. Select Create new data source.

  3. Select OCI Source as the source type.

  4. Enter a Source name and Description.

  5. Enter the OCI bucket and identity details:

    • User OCID: The OCID of the OCI user that Agent Factory uses to access the bucket.
    • Tenancy: The OCID of the OCI tenancy that owns the user and bucket.
    • Bucket name: The name of the OCI Object Storage bucket that contains the content to ingest.
    • Region: The OCI region where the bucket is hosted.
    • Namespace: The Object Storage namespace for the bucket’s tenancy.

  6. Provide the API signing key details for the OCI user:

    • API Private Key: Upload the PEM-formatted private key that is associated with the OCI user.
    • Fingerprint: Enter the fingerprint of the API signing key registered for the OCI user.

  7. To limit the crawl scope, select Add filter, then configure include or exclude URL filters. You can also exclude supported file extensions from ingestion.

  8. Set Crawl depth and Crawl frequency to control the crawl scope and how often Agent Factory revisits the bucket. Crawl frequency is measured in hours and also determines the expiration window for generated pre-authenticated request (PAR) URLs. If you do not set a crawl frequency, PAR URLs expire after seven days.

  9. Enter a Proxy URL if access to OCI Object Storage requires a network proxy. Agent Factory uses this URL for OCI Object Storage client requests. See Configure Proxy to verify whether the administrator has enabled proxy usage.

  10. Select Test connection and confirm that Agent Factory can reach the bucket.

    Note: If the connection test fails, verify the OCI user and tenancy OCIDs, bucket name, region, namespace, private key, fingerprint, permissions, and proxy configuration.

  11. Select Create data source.

After the data source is created, monitor the ingestion status on the Data Sources page. When the status is ingested, you can select the OCI Object Storage data source while creating or editing a Knowledge Agent. See Create Knowledge Agent.

See Data Sources Troubleshooting for information about data source-related statuses and errors.

Security Note:

Keep the OCI API private key confidential. Do not include it in source names, descriptions, filters, screenshots, logs, or support requests. Treat pre-authenticated request (PAR) URLs and other object-access metadata as sensitive.

Grant the OCI principal only the permissions needed to ingest the selected bucket content. Use only trusted and approved proxy endpoints because bucket content can transit through the proxy.

Review the content before ingestion to make sure it meets your organization’s privacy, security, and data-governance requirements. Administrators must protect downloaded content in local storage and apply appropriate retention and cleanup practices.

Control Access to Ingested Content

OCI IAM permissions control Agent Factory’s access while it crawls the bucket. After Agent Factory ingests the content, Knowledge Agent access controls determine which users can access it. A user who can access a Knowledge Agent can access content from its OCI Object Storage data sources even when that user does not have direct permission to the source bucket.

PAR URLs can provide temporary direct access to an object to anyone who obtains the URL. Before you add a data source, confirm that its content is appropriate for all intended Knowledge Agent users. Administrators must review and limit Knowledge Agent access to authorized users and groups. See Manage Identity and Access.