![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/06\/architecture-slide-official-service-names-1024x590.png\")
Figure 1: Package the LangGraph agent as a FastAPI container, then deploy it as an OCI Generative AI hosted application.<\/p>\n
From prototype to managed service<\/p>\n
LangGraph is useful because it makes agent workflow explicit: nodes hold work, edges hold flow, and state moves through the graph. That is valuable for support triage, document processing, human-review routing, tool orchestration, or any workflow where the model is only one step in a larger process.<\/p>\n
But enterprise teams need more than graph logic. They need a managed HTTP endpoint, identity controls, scaling settings, environment variables, versioned releases, and a clear way to connect to other OCI resources. OCI Generative AI hosted applications give that operational layer while letting teams keep their agent code in a standard container. The result is a cleaner ownership split: developers own the Python graph and API contract; OCI manages the hosted runtime concerns.<\/p>\n
How OCI organizes the hosted agent<\/p>\n
OCI Generative AI turns that operational wrapper into three concrete resources: a project, an application, and a deployment.<\/p>\n
The project comes first. It organizes agent-specific artifacts such as responses, conversations, files, and containers. At runtime, the app uses the project OCID to send OCI OpenAI-compatible API calls in the right project context. Projects also help isolate artifacts for lifecycle and compliance boundaries.<\/p>\n
The application defines the managed runtime for the workload, including scaling, managed storage, networking, authentication, and runtime environment variables. This is where platform teams make deployment-time decisions such as public or private endpoint access, replica limits, and which environment variables the container receives.<\/p>\n
The deployment is the versioned release of that application, based on a container image and tag. Within a hosted application, one active deployment serves the application endpoint at a time. This is the part that lets teams roll forward to a new image without changing the application identity that clients call.<\/p>\n
Turn LangGraph into a hosted service<\/p>\n
The key engineering step is to give the graph a small HTTP contract. In this implementation, FastAPI provides that wrapper. The application code in\u00a0code\/oci-langgraph-hosted-agent\/src\/sample_langgraph_fastapi_agent.py<\/a>\u00a0uses:<\/p>\n GET \/health\u00a0for a basic liveness response<\/p>\n GET \/ready\u00a0to confirm required runtime configuration is present<\/p>\n POST \/invoke\u00a0to run the LangGraph workflow<\/p>\n The app listens on\u00a00.0.0.0:8080, which gives the hosted runtime a predictable container port for HTTP traffic. The graph has three nodes: classify a support ticket, route the state, then either draft a customer reply or create an urgent handoff. The model node calls the OCI Responses API through OCI\u2019s OpenAI-compatible endpoint using IAM-based authentication:<\/p>\n import httpx client = OpenAI( response = client.responses.create( The\u00a0api_key=”not-used”\u00a0value is only a placeholder required by the OpenAI client constructor. The request is signed by the\u00a0http_client\u00a0through\u00a0OciResourcePrincipalAuth, so the container does not carry a long-lived model credential.<\/p>\n OCI Responses API is the primary OpenAI-compatible API for interacting with supported models and agentic workflows. It supports structured outputs, supported tools, and project-scoped calls through the\u00a0\/responses\u00a0endpoint. The OpenAI-compatible base URL is\u00a0https:\/\/inference.generativeai.${region}.oci.oraclecloud.com\/openai\/v1. See the\u00a0OCI Responses API<\/a>\u00a0and\u00a0OCI OpenAI-compatible endpoints<\/a>\u00a0documentation.<\/p>\n For local development, the application can run with\u00a0stub\u00a0mode for offline testing or\u00a0session\u00a0mode, where\u00a0OciSessionAuth\u00a0signs OCI requests through an OCI CLI profile. In the hosted deployment, set\u00a0OCI_GENAI_AUTH_MODE=resource_principal\u00a0so\u00a0OciResourcePrincipalAuth\u00a0signs requests with the resource principal provided by OCI. The deployment flow includes the dynamic group and policies for that runtime identity. See\u00a0Generative AI IAM-based authentication<\/a>.<\/p>\n Deployment flow<\/p>\n The operational flow is:<\/p>\n 1. Create or reuse an OCI Generative AI project.<\/p>\n 2. Build the FastAPI + LangGraph application in\u00a0code\/oci-langgraph-hosted-agent\u00a0into a Linux container image.<\/p>\n 3. Push the image to OCIR.<\/p>\n 4. Configure IAM for deployment automation and for the hosted runtime identity.<\/p>\n 5. Create an OCI Generative AI hosted application with scaling, networking, authentication, storage, and environment variables.<\/p>\n 6. Create a hosted deployment that points to the container image and tag.<\/p>\n 7. Invoke\u00a0\/health,\u00a0\/ready, and then the agent endpoint.<\/p>\n The OCI CLI exposes this flow directly. The following shell variables keep environment-specific values reusable across commands:<\/p>\n > export OCI_COMPARTMENT_OCID=”ocid1.compartment.oc1..exampleuniqueID” This article uses\u00a0google.gemini-2.5-pro\u00a0as the example model ID. For other environments, confirm the target model and region in the current OCI documentation for\u00a0offered pretrained foundational models<\/a>\u00a0and\u00a0Generative AI models by region<\/a>.<\/p>\n Create the project:<\/p>\n > export ENTERPRISE_AI_PROJECT_OCID=”$(oci generative-ai generative-ai-project create \\ The create command stores the project OCID in\u00a0ENTERPRISE_AI_PROJECT_OCID. Print the value and fetch the resource to confirm its lifecycle state:<\/p>\n > printf ‘Project OCID: %s\\n’ “$ENTERPRISE_AI_PROJECT_OCID” To verify the project in the OCI Console, open the navigation menu, select Analytics & AI, then Generative AI, and open Projects. Select the target compartment to view the project and its lifecycle state.<\/p>\n The example application is available in the\u00a0oci-langgraph-hosted-agent GitHub repository<\/a>. Clone the repo, then build the application image from the repo folder:<\/p>\n The build command requires Docker to be installed and running on the local machine. On macOS or Windows, start Docker Desktop before running the command. Build the image for the Linux platform expected by the hosted runtime:<\/p>\n > git clone https:\/\/github.com\/srikanth311\/oci-langgraph-hosted-agent.git The relevant FastAPI routes are small.\u00a0\/ready\u00a0checks runtime configuration before traffic reaches the agent, and\u00a0\/invoke\u00a0passes request state into the compiled LangGraph graph:<\/p>\n @app.get(“\/health”) @app.get(“\/ready”) @app.post(“\/invoke”, response_model=InvokeResponse) Existing LangGraph applications can use the same hosted-service contract: expose\u00a0GET \/health,\u00a0GET \/ready, and\u00a0POST \/invoke, read runtime settings from environment variables, and make the container listen on\u00a00.0.0.0:8080.<\/p>\n Tag and push the image to OCIR:<\/p>\n > docker tag oci-langgraph-hosted-agent:latest \\ Confirm that the exact repository name and tag are visible in OCIR before creating the hosted deployment. An empty result here means the deployment will not be able to pull the image:<\/p>\n > oci artifacts container image list \\ To verify the pushed image in the OCI Console, open Developer Services, then Containers & Artifacts, then Container Registry. Select the same region and compartment, open the repository named in\u00a0ENTERPRISE_AI_DOCKER_IMAGE_URI, and inspect the image tag. The repository list shows aggregate repository details; the image tag and digest are visible inside the repository. See\u00a0Viewing image details<\/a>.<\/p>\n IAM and runtime access<\/p>\n Before creating the hosted application and deployment, configure IAM for two paths: the deployment automation that creates OCI Generative AI resources, and the hosted runtime that pulls the image and calls OCI services after the container is running. OCI IAM does not require a role embedded in the container. Instead, use policies for the deployment group and a dynamic group for hosted applications and deployments so the running workload can act as a resource principal.<\/p>\n The IAM commands use sample values for the tenancy OCID, group name, dynamic group name, policy name, and compartment names. Replace them with tenancy-specific values before running the commands:<\/p>\n OCI_TENANCY_OCID: Use the tenancy OCID from the Console Tenancy Details page. OCI documents where to find it in\u00a0Resource Identifiers<\/a>.<\/p>\n PLATFORM_ENGINEERS_GROUP_NAME: Use the IAM group that should create and manage the OCI Generative AI project, hosted application, and hosted deployment. Create or review groups with\u00a0Managing Groups<\/a>.<\/p>\n PLATFORM_ENGINEERS_POLICY_NAME\u00a0and\u00a0HOSTED_AGENT_POLICY_NAME: Use policy names approved by the tenancy IAM naming standard. Policies are created and updated with\u00a0Managing Policies<\/a>.<\/p>\n HOSTED_AGENT_DYNAMIC_GROUP_NAME: Use an approved runtime dynamic group when one already covers OCI Generative AI hosted applications and deployments. Otherwise, create the dynamic group shown below. Dynamic groups and matching rules are described in\u00a0Managing Dynamic Groups<\/a>.<\/p>\n APP_COMPARTMENT_NAME,\u00a0IMAGE_COMPARTMENT_NAME, and\u00a0DATA_COMPARTMENT_NAME: Use the compartments that contain the hosted application resources, the OCIR repository, and any data resources the agent reads. Policy statements can use compartment names, or\u00a0id \u00a0when automation should avoid name ambiguity. See\u00a0Managing Compartments<\/a>.<\/p>\n > export OCI_TENANCY_OCID=”ocid1.tenancy.oc1..exampleuniqueID” For deployment automation that creates projects, applications, and deployments, grant the required Generative AI permissions in the target compartment. A broad sandbox policy can use\u00a0manage generative-ai-family; production policies should usually narrow access to the specific resource types and operations:<\/p>\n > allow group ai-platform-engineers to manage generative-ai-project in compartment AIApplications Create that policy in the tenancy:<\/p>\n > oci iam policy create \\ For the running hosted agent, use a dynamic group that includes OCI Generative AI hosted applications and deployments. Dynamic groups let OCI resources act as principal actors, and matching rules determine group membership. OCI documents a tenancy maximum of 50 dynamic groups, so governed tenancies often reuse approved runtime dynamic groups instead of creating a new group for every test. See\u00a0Managing Dynamic Groups<\/a>.<\/p>\n any {resource.type=”generativeaihostedapplication”, List existing dynamic groups before creating another tenancy-level identity object:<\/p>\n oci iam dynamic-group list \\ Inspect the matching rule for a candidate group:<\/p>\n > oci iam dynamic-group get \\ If a dedicated runtime dynamic group already includes hosted applications and deployments, set\u00a0HOSTED_AGENT_DYNAMIC_GROUP_NAME\u00a0to that group name and continue with the policy statement. Create a new dynamic group only when no approved reusable group exists:<\/p>\n > oci iam dynamic-group create \\ If creation returns\u00a0You have reached the object limit of DynamicResourceGroups, the tenancy has reached its dynamic-group quota. Reuse an approved existing dynamic group, or have an IAM administrator retire unused groups or request the needed limit change before retrying.<\/p>\n Then grant that dynamic group only the access the container needs. At minimum, deployments need image access through OCIR and access to vulnerability scan results so OCI can validate the image before deployment. If the agent calls OCI Generative AI with\u00a0OciResourcePrincipalAuth, grant access to the Generative AI resources used for inference. If the agent reads Object Storage, add Object Storage read access:<\/p>\n > allow dynamic-group hosted-agent-runtime-dg to read repos in compartment ContainerImages Create the policy with the same statements only when the selected policy name does not already exist:<\/p>\n > oci iam policy create \\ If the policy already exists, inspect its statements and add only the missing permissions through the standard IAM change process instead of creating a duplicate policy:<\/p>\n > oci iam policy list \\ See\u00a0permissions for deploying applications<\/a>\u00a0and\u00a0IAM policies for OCI Generative AI<\/a>.<\/p>\n For outbound access from the hosted agent to OCI services, authorize the deployed agent application with IAM policies as a resource principal. The platform injects a Resource Principal Session Token into the container runtime, avoiding long-lived credentials in the container. See\u00a0Authentication for hosted agents<\/a>.<\/p>\n Create the hosted application and deployment<\/p>\n The hosted application command accepts a compartment, display name, environment variables, scaling config, networking config, inbound auth config, and storage config. The\u00a0file:\/\/\u00a0values in the command point to local JSON payload files. Create those files in the same directory where the OCI CLI command runs.<\/p>\n Inbound authentication uses an OCI Identity Domain confidential application configured for OAuth client credentials. In the Console, open Identity & Security, then Domains, select the identity domain, open Integrated applications, and create or select a confidential application. Use its domain URL, primary audience, and scope in the\u00a0ENTERPRISE_AI_HOSTED_IDENTITY_DOMAIN_*\u00a0variables. See\u00a0Adding a confidential application<\/a>.<\/p>\n One prerequisite in the inbound authentication setup is access to the identity-domain signing certificate\/JWKS endpoint. Enterprise AI uses this endpoint to validate OAuth bearer-token signatures before forwarding a request to the hosted container. If client access is disabled, the request can fail at the platform layer before the FastAPI app receives it. Enable this access up front and verify it with\u00a0curl\u00a0before creating or invoking the hosted application.<\/p>\n In OCI Console, use this path:<\/p>\n Open Identity & Security, then Domains.<\/p>\n Select the identity domain used for the hosted application\u2019s inbound authentication.<\/p>\n Open Settings.<\/p>\n Open Access signing certificate.<\/p>\n Enable client access to the signing certificate\/JWKS endpoint.<\/p>\n Save the change and allow it to propagate.<\/p>\n Then verify that the endpoint returns HTTP 200:<\/p>\n > curl -k -I “${ENTERPRISE_AI_HOSTED_IDENTITY_DOMAIN_URL%:443}\/admin\/v1\/SigningCert\/jwk”<\/p>\n The expected result is HTTP 200. If the endpoint returns HTTP 401, client access is still disabled or the URL points to a different identity domain than the one used by\u00a0inbound_auth.json.<\/p>\n env.json\u00a0injects runtime settings into the container. For this sample, those settings tell the app which OCI region, project, model, and authentication mode to use:<\/p>\n > cat > env.json < [ scaling.json\u00a0sets the initial replica limits and autoscaling metric for the hosted application:<\/p>\n > cat > scaling.json < { networking.json\u00a0selects a public inbound endpoint and OCI-managed outbound networking for the hosted application:<\/p>\n > cat > networking.json < { inbound_auth.json\u00a0binds the hosted application endpoint to the identity-domain OAuth settings used by client applications:<\/p>\n cat > inbound_auth.json <<\/p>\n > export ENTERPRISE_AI_HOSTED_APPLICATION_OCID=”$(oci generative-ai hosted-application create \\ The create command stores the hosted application OCID in\u00a0ENTERPRISE_AI_HOSTED_APPLICATION_OCID. Print the value and fetch the resource to confirm its lifecycle state:<\/p>\n > printf ‘Hosted application OCID: %s\\n’ “$ENTERPRISE_AI_HOSTED_APPLICATION_OCID” If the application already exists, query the hosted application collection by display name:<\/p>\n > export ENTERPRISE_AI_HOSTED_APPLICATION_OCID=”$(oci generative-ai hosted-application-collection list-hosted-applications \\ Then create a hosted deployment with the application OCID and container image:<\/p>\n > export ENTERPRISE_AI_HOSTED_DEPLOYMENT_OCID=”$(oci generative-ai hosted-deployment create-hosted-deployment-single-docker-artifact \\ The create response can show the deployment in\u00a0CREATING\u00a0while OCI prepares the artifact. Print the deployment OCID and check the lifecycle state:<\/p>\n > printf ‘Hosted deployment OCID: %s\\n’ “$ENTERPRISE_AI_HOSTED_DEPLOYMENT_OCID” If the deployment artifact shows\u00a0Failed\u00a0with an image-pull error, first verify that the pushed OCIR tag exists and that the hosted runtime dynamic group has\u00a0read repos\u00a0and\u00a0read container-scan-results\u00a0access in the image compartment. After correcting the image tag or IAM policy, push a new tag and add it as a new artifact on the same hosted deployment:<\/p>\n > export ENTERPRISE_AI_DOCKER_IMAGE_TAG=”$(date +%Y%m%d%H%M%S)” For complete CLI parameter details, see the OCI CLI references for\u00a0creating hosted applications<\/a>\u00a0and\u00a0creating single-Docker-artifact hosted deployments<\/a>.<\/p>\n Validate the hosted agent<\/p>\n After the deployment becomes active, run two checks before handing the endpoint to client applications. The first check confirms the container is reachable and the runtime configuration is complete.<\/p>\n The OAuth flow has two separate responsibilities. During application setup,\u00a0inbound_auth.json\u00a0passes the identity domain URL plus the OAuth audience and scope for the hosted application. Oracle defines the audience as the service or API that the access token is intended for, and the token is accepted only when its audience claim matches the target resource server. Oracle defines scope as the permissions or actions the access token allows. During invocation, a client application requests an access token from that same identity domain by using the confidential application\u2019s client ID, client secret,\u00a0grant_type=client_credentials, and scope, then sends the returned token to the hosted application endpoint in the HTTP\u00a0Authorization: Bearer …\u00a0header. This inbound OAuth step is separate from outbound resource-principal authentication, which the container uses later when it calls OCI services.<\/p>\n The following OAuth inputs are needed only by the client or deployment automation that invokes the hosted application. They are not container runtime settings and should not be baked into the image. In the OCI IAM identity domain used by the hosted application, open the integrated confidential application configured for the hosted application, confirm that OAuth client credentials are enabled, activate the application, and open OAuth configuration:<\/p>\n ENTERPRISE_AI_HOSTED_OAUTH_CLIENT_ID: Copy the confidential application\u2019s client ID.<\/p>\n ENTERPRISE_AI_HOSTED_OAUTH_CLIENT_SECRET: Copy the client secret and store it in deployment automation or a secret store, not in source control.<\/p>\n ENTERPRISE_AI_HOSTED_OAUTH_TOKEN_SCOPE: Use the exact scope value accepted by the confidential application, typically the primary audience plus the configured scope name.<\/p>\n ENTERPRISE_AI_HOSTED_TOKEN_URL: Append\u00a0\/oauth2\/v1\/token\u00a0to the identity domain URL associated with the hosted application.<\/p>\n See\u00a0Setting up Authentication for Agentic Support<\/a>,\u00a0Creating an Application<\/a>, and\u00a0Invoking Applications<\/a>.<\/p>\n > export ENTERPRISE_AI_HOSTED_INVOKE_BASE=”https:\/\/application.generativeai.${OCI_REGION}.oci.oraclecloud.com\/20251112\/hostedApplications\/${ENTERPRISE_AI_HOSTED_APPLICATION_OCID}\/actions\/invoke” The second check sends a representative support ticket through the LangGraph workflow and verifies that the application route returns the expected response shape. The sample application in this post exposes\u00a0POST \/invoke. For an existing container image, keep\u00a0ENTERPRISE_AI_HOSTED_INVOKE_BASE\u00a0as the hosted application invoke base and set\u00a0ENTERPRISE_AI_HOSTED_APP_ROUTE\u00a0to the HTTP route exposed by that container. The\u00a0OCI HTTP invocation guide<\/a>\u00a0shows the same pattern by appending a container-defined route, such as\u00a0\/chat, to the hosted application URL.<\/p>\n > export ENTERPRISE_AI_HOSTED_APP_ROUTE=”\/invoke” Successful responses from\u00a0\/health\u00a0and\u00a0\/ready\u00a0validate the service contract. A successful response from the application route validates the deployed image, environment variables, resource-principal authentication, model access, and the LangGraph path used by the sample request.<\/p>\n Conclusion<\/p>\n With this pattern, a LangGraph proof of concept can become a managed, governed, versioned service while preserving the agent logic that developers already built. The HTTP wrapper gives the graph a service contract; FastAPI keeps that wrapper small in this implementation. OCI Generative AI projects give model and agent calls an organizational boundary. Hosted applications and deployments give platform teams a managed runtime for scaling, networking, authentication, environment variables, and release control.<\/p>\n The FastAPI + LangGraph application under\u00a0code\/oci-langgraph-hosted-agent\u00a0gives teams a concrete starting point: configure OCI Responses API settings, build the container, and deploy it as a hosted application. From there, extend the graph one node at a time: add tools, add review routing, connect Object Storage or a system of record, and measure the workflow before making it more complex.<\/p>\n","protected":false},"excerpt":{"rendered":"Agentic workflows become enterprise systems when they begin serving real workflows. A LangGraph proof of concept can validate…\n","protected":false},"author":2,"featured_media":82407,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[405,11052,7537,11053,7342,7343,7344],"class_list":["post-82406","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-ai-agents","tag-ai-in-business","tag-artificial-intelligence-agents","tag-best-practices","tag-oracle-ai","tag-oracle-cloud-infrastructure-oci","tag-technical-solutions"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/82406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=82406"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/82406\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/82407"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=82406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=82406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=82406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nfrom openai import OpenAI
\nfrom oci_openai import OciResourcePrincipalAuth<\/p>\n
\n base_url=f”https:\/\/inference.generativeai.{region}.oci.oraclecloud.com\/openai\/v1″,
\n api_key=”not-used”,
\n project=os.environ[“OCI_GENAI_PROJECT_OCID”],
\n http_client=httpx.Client(auth=OciResourcePrincipalAuth(), timeout=30.0),
\n)<\/p>\n
\n model=model,
\n store=False,
\n input=prompt,
\n)
\nreturn response.output_text.strip()<\/p>\n
\n> export OCI_REGION=”us-ashburn-1″
\n> export OCI_REGION_KEY=”iad”
\n> export OCI_TENANCY_NAMESPACE=”exampletenancy”
\n> export OCI_GENAI_MODEL=”google.gemini-2.5-pro”
\n> export ENTERPRISE_AI_PROJECT_NAME=”langgraph-agent-project”
\n> export ENTERPRISE_AI_HOSTED_APPLICATION_NAME=”langgraph-agent-app”
\n> export ENTERPRISE_AI_HOSTED_DEPLOYMENT_NAME=”langgraph-agent-v1″
\n> export ENTERPRISE_AI_HOSTED_IDENTITY_DOMAIN_URL=”https:\/\/idcs-.identity.oraclecloud.com:443″
\n> export ENTERPRISE_AI_HOSTED_IDENTITY_DOMAIN_AUDIENCE=”https:\/\/langgraph-agent-app”
\n> export ENTERPRISE_AI_HOSTED_IDENTITY_DOMAIN_SCOPE=”invoke”
\n> export ENTERPRISE_AI_OCIR_REPOSITORY_NAME=”oci-langgraph-hosted-agent”
\n> export ENTERPRISE_AI_DOCKER_IMAGE_URI=”${OCI_REGION_KEY}.ocir.io\/${OCI_TENANCY_NAMESPACE}\/${ENTERPRISE_AI_OCIR_REPOSITORY_NAME}”
\n> export ENTERPRISE_AI_DOCKER_IMAGE_TAG=”0.1.0″
\n> export ENTERPRISE_AI_DOCKER_BUILD_PLATFORM=”linux\/amd64″<\/p>\n
\n –compartment-id “$OCI_COMPARTMENT_OCID” \\
\n –display-name “$ENTERPRISE_AI_PROJECT_NAME” \\
\n –region “$OCI_REGION” \\
\n –query ‘data.id’ \\
\n –raw-output)”<\/p>\n
\n> oci generative-ai generative-ai-project get \\
\n> –generative-ai-project-id “$ENTERPRISE_AI_PROJECT_OCID” \\
\n> –region “$OCI_REGION” \\
\n> –query ‘data.{id:id,displayName:”display-name”,lifecycleState:”lifecycle-state”}’<\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/06\/oci-generative-ai-project-created-redacted-1024x411.png\")
Figure 2: The project appears in the OCI Generative AI Projects list after creation.<\/p>\n
\n> cd oci-langgraph-hosted-agent
\n> docker build –platform “$ENTERPRISE_AI_DOCKER_BUILD_PLATFORM” \\
\n> -t oci-langgraph-hosted-agent:latest .<\/p>\n
\ndef health() -> dict[str, str]:
\n return {“status”: “ok”}<\/p>\n
\ndef ready():
\n missing = _missing_ready_values()
\n if missing:
\n return JSONResponse(
\n status_code=503,
\n content={“status”: “not_ready”, “missing”: missing},
\n )
\n return {“status”: “ready”, “auth_mode”: _auth_mode()}<\/p>\n
\ndef invoke(payload: InvokeRequest) -> InvokeResponse:
\n run_id = str(uuid4())
\n final_state = agent_graph.invoke(
\n {
\n “run_id”: run_id,
\n “customer_id”: payload.customer_id,
\n “ticket”: payload.ticket,
\n “trace”: [],
\n }
\n )
\n return InvokeResponse(
\n run_id=run_id,
\n category=final_state[“category”],
\n severity=final_state[“severity”],
\n routed_to=final_state[“routed_to”],
\n response=final_state[“response”],
\n trace=final_state[“trace”],
\n )<\/p>\n
\n> “$ENTERPRISE_AI_DOCKER_IMAGE_URI:$ENTERPRISE_AI_DOCKER_IMAGE_TAG”
\n> docker push “$ENTERPRISE_AI_DOCKER_IMAGE_URI:$ENTERPRISE_AI_DOCKER_IMAGE_TAG”<\/p>\n
\n> –compartment-id “$OCI_COMPARTMENT_OCID” \\
\n> –repository-name “$ENTERPRISE_AI_OCIR_REPOSITORY_NAME” \\
\n> –image-version “$ENTERPRISE_AI_DOCKER_IMAGE_TAG” \\
\n> –region “$OCI_REGION” \\
\n> –query ‘data.items[].{displayName:”display-name”,version:version,digest:digest,lifecycleState:”lifecycle-state”}’<\/p>\n
\n> export PLATFORM_ENGINEERS_GROUP_NAME=”ai-platform-engineers”
\n> export PLATFORM_ENGINEERS_POLICY_NAME=”ai-platform-engineers-genai-policy”
\n> export HOSTED_AGENT_DYNAMIC_GROUP_NAME=”hosted-agent-runtime-dg”
\n> export HOSTED_AGENT_POLICY_NAME=”hosted-agent-runtime-policy”
\n> export APP_COMPARTMENT_NAME=”AIApplications”
\n> export IMAGE_COMPARTMENT_NAME=”ContainerImages”
\n> export DATA_COMPARTMENT_NAME=”AgentData”<\/p>\n
\n> allow group ai-platform-engineers to manage generative-ai-hosted-application in compartment AIApplications
\n> allow group ai-platform-engineers to manage generative-ai-hosted-deployment in compartment AIApplications<\/p>\n
\n> –compartment-id “$OCI_TENANCY_OCID” \\
\n> –name “$PLATFORM_ENGINEERS_POLICY_NAME” \\
\n> –description “Allow platform engineers to manage OCI Generative AI hosted agent resources” \\
\n> –statements “[
\n> \\”allow group ${PLATFORM_ENGINEERS_GROUP_NAME} to manage generative-ai-project in compartment ${APP_COMPARTMENT_NAME}\\”,
\n> \\”allow group ${PLATFORM_ENGINEERS_GROUP_NAME} to manage generative-ai-hosted-application in compartment ${APP_COMPARTMENT_NAME}\\”,
\n> \\”allow group ${PLATFORM_ENGINEERS_GROUP_NAME} to manage generative-ai-hosted-deployment in compartment ${APP_COMPARTMENT_NAME}\\”
\n> ]”<\/p>\n
\n resource.type=”generativeaihosteddeployment”}<\/p>\n
\n –compartment-id “$OCI_TENANCY_OCID” \\
\n –all \\
\n –query “data[].{name:name,id:id,state:\\”lifecycle-state\\”}” \\
\n –output table<\/p>\n
\n> –dynamic-group-id “” \\
\n> –query “data.{name:name,rule:\\”matching-rule\\”,state:\\”lifecycle-state\\”}” \\
\n> –output table<\/p>\n
\n> –compartment-id “$OCI_TENANCY_OCID” \\
\n> –name “$HOSTED_AGENT_DYNAMIC_GROUP_NAME” \\
\n> –description “OCI Generative AI hosted agent runtime identities” \\
\n> –matching-rule “any {resource.type=”generativeaihostedapplication”, resource.type=”generativeaihosteddeployment”}”<\/p>\n
\n> allow dynamic-group hosted-agent-runtime-dg to read container-scan-results in compartment ContainerImages
\n> allow dynamic-group hosted-agent-runtime-dg to use generative-ai-family in compartment AIApplications
\n> allow dynamic-group hosted-agent-runtime-dg to read object-family in compartment AgentData<\/p>\n
\n> –compartment-id “$OCI_TENANCY_OCID” \\
\n> –name “$HOSTED_AGENT_POLICY_NAME” \\
\n> –description “Allow hosted agent deployments to pull images and call OCI services” \\
\n> –statements “[
\n> \\”allow dynamic-group ${HOSTED_AGENT_DYNAMIC_GROUP_NAME} to read repos in compartment ${IMAGE_COMPARTMENT_NAME}\\”,
\n> \\”allow dynamic-group ${HOSTED_AGENT_DYNAMIC_GROUP_NAME} to read container-scan-results in compartment ${IMAGE_COMPARTMENT_NAME}\\”,
\n> \\”allow dynamic-group ${HOSTED_AGENT_DYNAMIC_GROUP_NAME} to use generative-ai-family in compartment ${APP_COMPARTMENT_NAME}\\”,
\n> \\”allow dynamic-group ${HOSTED_AGENT_DYNAMIC_GROUP_NAME} to read object-family in compartment ${DATA_COMPARTMENT_NAME}\\”
\n> ]”<\/p>\n
\n> –compartment-id “$OCI_TENANCY_OCID” \\
\n> –all \\
\n> –query “data[?name==’${HOSTED_AGENT_POLICY_NAME}’].{name:name,id:id,state:\\”lifecycle-state\\”}” \\
\n> –output table<\/p>\n
\n> {“name”: “OCI_GENAI_REGION”, “type”: “PLAINTEXT”, “value”: “$OCI_REGION”},
\n> {“name”: “OCI_GENAI_PROJECT_OCID”, “type”: “PLAINTEXT”, “value”: “$ENTERPRISE_AI_PROJECT_OCID”},
\n> {“name”: “OCI_GENAI_MODEL”, “type”: “PLAINTEXT”, “value”: “$OCI_GENAI_MODEL”},
\n> {“name”: “OCI_GENAI_AUTH_MODE”, “type”: “PLAINTEXT”, “value”: “resource_principal”}
\n> ]
\n> EOF<\/p>\n
\n> “minReplica”: 1,
\n> “maxReplica”: 2,
\n> “scalingType”: “CONCURRENCY”,
\n> “targetConcurrencyThreshold”: 4
\n> }
\n> EOF<\/p>\n
\n> “inboundNetworkingConfig”: {
\n> “endpointMode”: “PUBLIC”
\n> },
\n> “outboundNetworkingConfig”: {
\n> “networkMode”: “MANAGED”
\n> }
\n> }
\n> EOF<\/p>\n
\n> –compartment-id “$OCI_COMPARTMENT_OCID” \\
\n> –display-name “$ENTERPRISE_AI_HOSTED_APPLICATION_NAME” \\
\n> –environment-variables file:\/\/env.json \\
\n> –scaling-config file:\/\/scaling.json \\
\n> –networking-config file:\/\/networking.json \\
\n> –inbound-auth-config file:\/\/inbound_auth.json \\
\n> –region “$OCI_REGION” \\
\n> –query ‘data.id’ \\
\n> –raw-output)”<\/p>\n
\n> oci generative-ai hosted-application get \\
\n> –hosted-application-id “$ENTERPRISE_AI_HOSTED_APPLICATION_OCID” \\
\n> –region “$OCI_REGION” \\
\n> –query ‘data.{id:id,displayName:”display-name”,lifecycleState:”lifecycle-state”}’<\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/06\/oci-hosted-application-active-deployment-1024x465.png\")
Figure 3: The hosted application appears in OCI Generative AI Applications after creation.<\/p>\n
\n> –compartment-id “$OCI_COMPARTMENT_OCID” \\
\n> –display-name “$ENTERPRISE_AI_HOSTED_APPLICATION_NAME” \\
\n> –sort-by timeCreated \\
\n> –sort-order DESC \\
\n> –region “$OCI_REGION” \\
\n> –query ‘data.items[0].id’ \\
\n> –raw-output)”<\/p>\n
\n> –hosted-application-id “$ENTERPRISE_AI_HOSTED_APPLICATION_OCID” \\
\n> –compartment-id “$OCI_COMPARTMENT_OCID” \\
\n> –display-name “$ENTERPRISE_AI_HOSTED_DEPLOYMENT_NAME” \\
\n> –active-artifact-container-uri “$ENTERPRISE_AI_DOCKER_IMAGE_URI” \\
\n> –active-artifact-tag “$ENTERPRISE_AI_DOCKER_IMAGE_TAG” \\
\n> –region “$OCI_REGION” \\
\n> –query ‘data.id’ \\
\n> –raw-output)”<\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/06\/img5-1024x476.png\")
Figure 4: The hosted application Deployment tab lists the container artifact after the deployment is created.<\/p>\n
\n> oci generative-ai hosted-deployment get \\
\n> –hosted-deployment-id “$ENTERPRISE_AI_HOSTED_DEPLOYMENT_OCID” \\
\n> –region “$OCI_REGION” \\
\n> –query ‘data.{id:id,displayName:”display-name”,lifecycleState:”lifecycle-state”,artifactStatus:”active-artifact”.status,tag:”active-artifact”.tag}’<\/p>\n
\n> docker build –platform “$ENTERPRISE_AI_DOCKER_BUILD_PLATFORM” \\
\n> -t oci-langgraph-hosted-agent:latest .
\n> docker tag oci-langgraph-hosted-agent:latest \\
\n> “$ENTERPRISE_AI_DOCKER_IMAGE_URI:$ENTERPRISE_AI_DOCKER_IMAGE_TAG”
\n> docker push “$ENTERPRISE_AI_DOCKER_IMAGE_URI:$ENTERPRISE_AI_DOCKER_IMAGE_TAG”
\n> oci generative-ai hosted-deployment add-artifact-create-single-docker-artifact-details \\
\n> –hosted-deployment-id “$ENTERPRISE_AI_HOSTED_DEPLOYMENT_OCID” \\
\n> –artifact-container-uri “$ENTERPRISE_AI_DOCKER_IMAGE_URI” \\
\n> –artifact-tag “$ENTERPRISE_AI_DOCKER_IMAGE_TAG” \\
\n> –region “$OCI_REGION”<\/p>\n
\n> export ENTERPRISE_AI_HOSTED_OAUTH_CLIENT_ID=””
\n> export ENTERPRISE_AI_HOSTED_OAUTH_CLIENT_SECRET=””
\n> export ENTERPRISE_AI_HOSTED_OAUTH_TOKEN_SCOPE=””
\n> export ENTERPRISE_AI_HOSTED_TOKEN_URL=”${ENTERPRISE_AI_HOSTED_IDENTITY_DOMAIN_URL%:443}\/oauth2\/v1\/token”
\n> export ENTERPRISE_AI_HOSTED_ACCESS_TOKEN=”$(
\n> curl -sS -X POST “$ENTERPRISE_AI_HOSTED_TOKEN_URL” \\
\n> -H “Content-Type: application\/x-www-form-urlencoded” \\
\n> –data-urlencode “client_id=${ENTERPRISE_AI_HOSTED_OAUTH_CLIENT_ID}” \\
\n> –data-urlencode “client_secret=${ENTERPRISE_AI_HOSTED_OAUTH_CLIENT_SECRET}” \\
\n> –data-urlencode “grant_type=client_credentials” \\
\n> –data-urlencode “scope=${ENTERPRISE_AI_HOSTED_OAUTH_TOKEN_SCOPE}” \\
\n | python3 -c ‘import json,sys; print(json.load(sys.stdin)[“access_token”])’
\n)”
\n> curl -fsS \\
\n> -H “Authorization: Bearer ${ENTERPRISE_AI_HOSTED_ACCESS_TOKEN}” \\
\n> “${ENTERPRISE_AI_HOSTED_INVOKE_BASE}\/health”
\n> curl -fsS \\
\n> -H “Authorization: Bearer ${ENTERPRISE_AI_HOSTED_ACCESS_TOKEN}” \\
\n> “${ENTERPRISE_AI_HOSTED_INVOKE_BASE}\/ready”<\/p>\n
\n> curl -fsS \\
\n> -X POST \\
\n> -H “Authorization: Bearer ${ENTERPRISE_AI_HOSTED_ACCESS_TOKEN}” \\
\n> -H “Content-Type: application\/json” \\
\n> -H “Accept: application\/json” \\
\n> “${ENTERPRISE_AI_HOSTED_INVOKE_BASE}${ENTERPRISE_AI_HOSTED_APP_ROUTE}” \\
\n> -d ‘{
\n> “ticket_id”: “TICKET-1001”,
\n> “customer_tier”: “enterprise”,
\n> “message”: “Production checkout is failing after the latest release.”
\n> }’<\/p>\n