Oracle Cloud Infrastructure Documentation

API-Level Permissions for OCI IAM Applications

This page provides access and authorization information for the OCI Generative AI service application resource type for applications that use the OCI IAM application type.

The OCI IAM application type uses OCI IAM authentication.

For specific permissions for this resource type, review this page. For a list of all resource types available in OCI Generative AI, see User Access to Individual Resources.

Resource Type

Resource Type for IAM Permissions Documentation Reference API Reference
generative-ai-hosted-application-iam Applications HostedApplicationIam

Inspect Permission

Grant user groups inspect permission to run the following commands:

  • GET ListHostedApplicationsIam

Read Permission

Grant user groups read permission to run the following commands:

  • GET ListHostedApplicationsIam
  • GET GetHostedApplicationIam

Use Permission

Grant user groups use permission to run the following commands:

  • GET ListHostedApplicationsIam
  • GET GetHostedApplicationIam
  • PUT UpdateHostedApplicationIam

Manage Permission

Grant user groups manage permission to run the following commands:

  • GET ListHostedApplicationsIam
  • GET GetHostedApplicationIam
  • PUT UpdateHostedApplicationIam
  • POST CreateHostedApplicationIam
  • POST ChangeHostedApplicationIamCompartment
  • DELETE DeleteHostedApplicationIam
Note

  • The manage permission includes all actions allowed by use, read, and inspect.
  • The use permission includes all actions allowed by read and inspect.
  • The read permission includes all actions allowed by inspect.
Tip

The generative-ai-hosted-application-iam resource-type is part of the generative-ai-family.
If you have permission to the family, you have the same permission for this resource type. For example:
allow group <your-group-name> to manage generative-ai-family 
in compartment <your-compartment-name>

1-1 Permissions for APIs

Note

We recommend using the higher-level IAM verbs, manage, use, read, and inspect, for a better user experience. For example, you might grant a user group permission to delete a resource, but if you don't also grant permission to list that resource, users might not find it.

If a use case requires access to only a specific API operation, you can use the individual permissions listed here. For example, if users need permission to create a resource but not delete it, grant manage for that resource type and exclude the delete permission.

generative-ai-hosted-application-iam

Permission API Operation Operation Type Verb
GENERATIVE_AI_HOSTED_APPLICATION_IAM_INSPECT ListHostedApplicationsIam GET inspect
GENERATIVE_AI_HOSTED_APPLICATION_IAM_READ GetHostedApplicationIam GET read
GENERATIVE_AI_HOSTED_APPLICATION_IAM_UPDATE UpdateHostedApplicationIam PUT use
GENERATIVE_AI_HOSTED_APPLICATION_IAM_MOVE ChangeHostedApplicationIamCompartment POST manage
GENERATIVE_AI_HOSTED_APPLICATION_IAM_CREATE CreateHostedApplicationIam POST manage
GENERATIVE_AI_HOSTED_APPLICATION_IAM_DELETE DeleteHostedApplicationIam DELETE manage

For example, the following two policies are the same:

allow group <your-user-group> to 
manage generative-ai-hosted-application-iam 
in compartment <your-compartment-name>
Allow group <your-user-group> to 
{GENERATIVE_AI_HOSTED_APPLICATION_IAM_CREATE, GENERATIVE_AI_HOSTED_APPLICATION_IAM_READ, 
GENERATIVE_AI_HOSTED_APPLICATION_IAM_UPDATE, GENERATIVE_AI_HOSTED_APPLICATION_IAM_DELETE, 
GENERATIVE_AI_HOSTED_APPLICATION_IAM_MOVE, GENERATIVE_AI_HOSTED_APPLICATION_IAM_INSPECT} 
in compartment <your-compartment-name>