Oracle Cloud Infrastructure Documentation

Order the Service and Provision an Instance

To get your team set up with Oracle Digital Assistant, you order the service, give users appropriate permissions, and then provision the instance.

Digital Assistant Product Types

Oracle Digital Assistant is available through a variety of pricing and subscription models. How you set up your instance depends on which of these models you select when you order the service.

The pricing models break down into the following general types:

  • Individual service. When you order Digital Assistant as an individual service, you typically provision such instances yourself. See Set Up Digital Assistant as an Individual Service.
  • Paired with Fusion-based Cloud applications. You can get Digital Assistant in this way when you have Fusion-based Oracle Applications Cloud services (such as Sales Cloud or HCM Cloud) and purchase one of the out-of-the-box skills (chatbots).

    When you get ODA in this form, it is automatically provisioned for you. You give team members access to the instance in the IDCS application for the instance. See Fusion-Based Oracle Cloud Applications and Digital Assistant.

    Note

    This type of Digital Assistant order is specifically designed for you to be able to extend those out-of-the-box skills for your business. If you also want to create custom skills or integrate with backends other than the service that the out-of-the-box skills are tied to, you need to get a separate individual subscription to Digital Assistant.

Place an Order for Oracle Digital Assistant

You can place an order in one of these ways:

After you place an order for Oracle Digital Assistant as in individual service, you receive an email with instructions on accessing your Cloud account with a temporary password. Once you log in with that password, you are prompted to enter a new password. After that, you can go ahead and set up your users and provision your instance.

Set Up Digital Assistant as an Individual Service

To set up a an individual instance of Oracle Digital Assistant (in other words, an instance that is not paired with an order of Oracle Cloud Applications and provisioned automatically for you), you need to go into the Oracle Cloud Infrastructure Console and do the following:

  1. Set up a compartment for the Digital Assistant in your tenancy.
  2. Set up users and groups for the users.
  3. Set up policies that govern the permissions for the user groups.
  4. Provision the instance.

Users, Groups, and Policies

Oracle Digital Assistant uses Oracle Cloud Infrastructure Identity and Access Management (IAM) as its base service for authentication and authorization. (Through IAM, you can also set up federation to other identity providers, such as Oracle Identity Cloud Service (IDCS).)

IAM is a policy-based identity service. The tenancy administrator for your organization needs to set up compartments, groups, and policies that control which users can access which resources and how. For an overview of this process, see Setting Up Your Tenancy.

In Digital Assistant, policies control who can develop skills and digital assistants, access Insights data, and call the service's APIs. For details on how policies work, see Getting Started with Policies. For specific details about writing policies, see Policy Reference.

Digital Assistant Policies

Before you start organizing your users into groups, you should learn the basics on how policies work and decide on what policies you want to apply to which groups of users.

Policies are created with statements that specify resource-types, verbs (which describe the level of access to those resource types), and locations (typically the names of compartments).

For example, you could create a policy statement that enables a group named ServiceDevelopers to be able to use the resource type oda-design in a compartment named MyDigitalAssistantTest.

Resource-Types

This table shows the resource types that are available for Oracle Digital Assistant.

Resource-type Description
oda-instance-resource Enables use of Oracle Digital Assistant APIs. There are three permissions levels (verbs) that you can apply. For details on which endpoints are covered in each permission level (inspect, read, and use), see REST API for Oracle Digital Assistant on Oracle Cloud Infrastructure and click Permissions in the left navigation of the page.
oda-design Enables access to the user interface for skills, digital assistants, and channels. At the read permission level, users can see the artifacts that have been created. At the use level, users can actively develop, test, and deploy these artifacts.
oda-insights Enables access to the user interface for skill and digital assistant Insights.
oda-instances Enables access to the console for Oracle Digital Assistant instances. At the manage permission level, you can create and delete instances.
oda-family This resource type is a superset of the Oracle Digital Assistant resource types. For each verb (inspect, read, use, and manage) that you use with this resource-type in a policy definition, all operations covered by that verb are included. For example, if you have a policy using this resource type and the manage verb, the user(s) that are covered by this policy will have all possible Oracle Digital Assistant permissions.
Verbs

You use verbs in policy definitions to set the permission levels that given user groups have for given resource-types. For example, you would use the read verb to allow read-only access.

Here are the verbs have been defined for the set of Oracle Digital Assistant resource-types.

Verb Description
inspect Generally covers operations that list contents of a resource. This is the verb that provides the most limited access.
read In user interface terms, this generally means read-only access. In API terms, it generally applies to GET operations.
use When applied to resources in the service's user interface, this generally allows developing, testing, and deploying of these resources. At the API level, it generally allows GET, PUT, POST, PATCH, and DELETE operations, with the exception of more high-impact operations (such as creating instances and purging data).
manage Generally allows the user to perform the whole set of a resource type's operations, including high-impact operations such as creating instances and purging data.
Example Set of Policies

The following table illustrates the patterns for IAM policies and provides typical examples for Oracle Digital Assistant.

IAM Policy Pattern for Policy Statement
Policy for Service Administrators
  • Allow group <name_of_your_Service_Administrators_Group> to manage oda-family in compartment <your_digital_assistant_compartment>
Policy for Service Developers
  • Allow group <name_of_your_Service_Developers_Group> to use oda-design in compartment <your_digital_assistant_compartment>
  • Allow group <name_of_your_Service_Developers_Group> to use oda-insights in compartment <your_digital_assistant_compartment>
Policy for Service Business Users
  • Allow group <name_of_your_Service_Business_Users_Group> to read oda-design in compartment <your_digital_assistant_compartment>
  • Allow group <name_of_your_Service_Business_Users_Group> to use oda-insights in compartment <your_digital_assistant_compartment>
Policy for Digital Assistant API Users
  • Allow group <name_of_your_Digital_Assistant_API_Users_Group> to use oda-instance-resource in compartment <your_digital_assistant_compartment>
Note

This statement provides access to all of the Oracle Digital Assistant endpoints. You can also create policies using the inspect and read verbs for more limited access. To see which endpoints are covered by which verbs, see REST API for Oracle Digital Assistant on Oracle Cloud Infrastructure.
Create a Compartment

Compartments enable you to partition resources in Oracle Cloud Service so that you can better control access to those resources. When you write policies to give users access to a Digital Assistant instance, the compartment name is one of the parts of the policy statement.

Note

You can also write policies that give users access to the resources in the entire tenant, but that is best for very simple setups (such as if you never intend to have more than one Digital Assistant instance.

To create a compartment:

  1. In the Infrastructure Console, click Navigation menu icon on the top left to open the navigation menu, click Identity, then click Compartments.

    You might need to use the scroll bar on the left to scroll down to see the menu option.

  2. Click Create Compartment.
  3. Fill in the required values and click Create Compartment.
Create New IAM Users

If any of your users don't have user accounts yet, create them in IAM.

  1. Open the navigation menu. Under Governance and Administration, go to Identity and click Users.

  2. Click Create User.

  3. In the Create User dialog, fill in the necessary details, with special attention to the following:

    • The Name value can be an email address or a unique name. This will be the name that the user uses to log in to the instance.
    • The Email value, which is used for password recovery.
  4. Click Create.

  5. Once the user is created, select the user and click Create/Reset Password.

  6. Click Copy.

  7. Paste the password in a secure place, and then provide it to the user.

    The user will need to log in with that password and then immediately change it.

Create Groups

Groups are collections of users that can be referenced in policies. You create groups to help manage which users get access to what.

Here is an example set of user groups that you could set up.

User Group Description and Purpose
Service Administrators Has complete unfettered access to manage, administer, and develop with the Oracle Digital Assistant service instance.
Service Developer Has privileges to develop and train digital assistants. However, can't delete published digital assistants or skills nor purge data. These privileges are a subset of service administrator privileges.
Service Business Users Mostly read-only access. Can use the skill and digital assistant tester, view Insights reports, and also enhance the training corpus by adding sample utterances (retraining). These privileges are a subset of service developer privileges. Intended for line-of-business users and analysts.
External Service Users Has permissions to call Oracle Digital Assistant REST APIs. There are three different permission levels (the inspect, read, and use verbs) for Oracle Digital Assistant APIs. As such, you may want to create a separate group for two or three of those permission levels.

To create a group:

  1. In the Infrastructure Console, click Navigation menu icon on the top left to open the navigation menu, select Identity, and then select Groups.

    You might need to use the scroll bar on the left to scroll down to see the menu option.

    A list of the groups in your tenancy is displayed.

  2. Click Create Group.

  3. Enter the following:

    • Name: A unique name for the group. The name must be unique across all groups in your tenancy. You cannot change this later.
    • Description: A friendly description. You can change this later if you want to.
    • Tags: Optionally, you can apply tags. If you have permissions to create a resource, you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags. If you are not sure if you should apply tags, skip this option (you can apply tags later) or ask your administrator.
  4. Click Create Group.

Add IAM Users to a Group

You'll need to add each user to a group in order to give them access to the service.

  1. Open the navigation menu. Under Governance and Administration, go to Identity and click Groups.

    A list of the groups in your tenancy is displayed.

  2. Locate the group in the list.

  3. Click the group.

  4. Click Add User to Group.

  5. Select the user from the drop-down list, and then click Add User.

Map IDCS Users to an IAM Group

If the user accounts for the team members that need to access Digital Assistant have been set up in Oracle Identity Cloud Service (IDCS), you can map those users to an IAM group.

  1. In the Infrastructure Console, click Navigation menu icon on the top left to open the navigation menu, click Identity, then click Federation.

    You might need to use the scroll bar on the left to scroll down to see the menu option.

  2. Click the OracleIdentityCloudService link.

  3. In the left navigation, click Group Mappings.

  4. Click Edit Mapping.

  5. Click Add Mapping.

  6. In the Identity Provider Group field, select the IDCS group for the users that you want to give access to Digital Assistant.

  7. In the OCI Group field, select the IAM group that corresponds with the access that you want to provide for those users.

  8. Click Submit.

Create Policies

You define IAM policies to apply to your user groups.

To create a policy:

  1. Open the navigation menu. Under Governance and Administration, go to Identity and click Policies.

    A list of the policies in the compartment you're viewing is displayed.

  2. If you want to attach the policy to a compartment other than the one you're viewing, select the desired compartment from the list on the left. Where the policy is attached controls who can later modify or delete it (see Policy Attachment).

  3. Click Create Policy.

  4. Enter the following:

    • Name: A unique name for the policy. The name must be unique across all policies in your tenancy. You cannot change this later.
    • Description: A friendly description. You can change this later if you want to.
    • Policy Versioning: Select Keep Policy Current if you'd like the policy to stay current with any future changes to the service's definitions of verbs and resources. Or if you'd prefer to limit access according to the definitions that were current on a specific date, select Use Version Date and enter that date in format YYYY-MM-DD format. For more information, see Policy Language Version.
    • Statement: A policy statement. For the correct format to use, see Policy Basics and also Policy Syntax. If you want to add more than one statement, click +.
    • Tags: Optionally, you can apply tags. If you have permissions to create a resource, you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags. If you are not sure if you should apply tags, skip this option (you can apply tags later) or ask your administrator.
  5. Click Create.

The new policy will go into effect typically within 10 seconds.

For an example of how you might define your Oracle Digital Assistant policies, see Example Set of Policies.

For more background on IAM policies, see How Policies Work.

Create an Oracle Digital Assistant Service Instance

  1. Sign in to your Oracle Cloud account.
  2. From the Infrastructure Console, click the navigation menu Navigation menu icon in the top left corner, scroll down to and expand Data and AI, and select Digital Assistant.
  3. From the Compartments panel, select a compartment.

    If you haven't yet created a compartment, see Understanding Compartments and Managing Compartments.

  4. Click Create Instance.
  5. On the Create Instance page, fill in the following details:
    • Compartment.
    • Name. Enter a name that reflects usage of the instance. For example, for a development environment, you might use oda-dev1.

    • Instance shape.

    • Tag Namespace. (Optional) To learn how this works, see Managing Tags and Tag Namespaces.

  6. Click Create.

    After a few minutes, your instance will go from the status of Creating to Active, meaning that your instance is ready to use.

Access the Service Instance from the Infrastructure Console

Once you have provisioned an instance, you can access it from the Infrastructure Console by following these steps:

  1. In the console page for the instance, click the Service Console button.

    You will be redirected to another login page.

  2. Click the Change tenant link.

  3. In the Cloud Tenant field, enter value of the Cloud Account field from the Access Details section of your welcome email.

  4. Sign in to the instance.

    As the tenant administrator, you can always log in with your single-sign on credentials (on the left side of the page). Similarly, any users that have been federated through IDCS can log in with these credentials.

    Any users that have been provisioned with IAM user accounts can log in on the right side.

    Once you have signed in, you should be directed to your Oracle Digital Assistant service instance.

    Note

    If your new password doesn't work, it may be because it hasn't taken effect yet. If that is the case, try entering the temporary password you received from your welcome email.

Get the Service Instance URL

You can retrieve the URL for your service instance on the console page for the instance. You will then need to share that URL with your team, since they will not be otherwise notified, even when they are granted permissions for Digital Assistant.

  1. In the Instance Information tab, click the Copy link that appears to the right of the Base Web URL field.

    This will copy the URL to your system's clipboard.

  2. Paste the URL to a convenient location.

  3. Share this URL with members of your team.

Sign-In Options

When you enter the URL for your Oracle Digital Assistant instance in your browser, you are presented with two login options:

  • Oracle Cloud Infrastructure (IAM): IAM is the native identity service for Oracle Cloud Infrastructure. If all of your Oracle Cloud services fall under Oracle Cloud Infrastructure (Gen 2), you should set up your user accounts in IAM and use this as your primary sign-in option.
  • Single Sign-On (SSO): With this option, you can log in if you have a user account with an identity provider that is federated with IAM. For example, Oracle Identity Cloud Service (IDCS) is a service used by many Oracle Cloud services, including ones that are not part of the Oracle Cloud Infrastructure (Gen 2) architecture. Once such a user account is federated and assigned to groups with appropriate permissions, that user account can be used as a single sign-on option for all of that user's Oracle Cloud services.
    Note

    If you are the Cloud account administrator, you can log in to Digital Assistant with your IDCS account, even if you haven't explicitly added that account to a group with permissions for accessing Digital Assistant.

For more on these options, how they relate to each other, and what it looks like when you sign in with each, see Understanding the Sign-In Options.

Service Limits

Oracle Digital Assistant has a limit of instances that you can create. Whenever you create an Oracle Digital Assistant instance or scale up, the system ensures that your request is within the bounds of your limit.

Resource Limit Limit Short Name Limit Description
Oracle Digital Assistant instance-count 20 Maximum number of instances of Oracle Digital Assistant.
Oracle Digital Assistant Platform for Oracle SaaS instance-count 3 Maximum number of instances of Oracle Digital Assistant Platform for Oracle SaaS.

Fusion-Based Oracle Cloud Applications and Digital Assistant

If you have a Digital Assistant instance that is paired with a subscription to a Fusion-based Oracle Applications Cloud service, such as HCM Cloud or Sales Cloud, the setup steps are different than if you have ordered Digital Assistant independently.

In this case, Digital Assistant is provided so that you can customize out-of-the-box skills that come with your Applications Cloud service.

The following topics explain how to set up users to be able to use Digital Assistant and get started with the out-of-the-box skills.

Assign Users the ServiceDeveloper Role

For Digital Assistant instances that are linked with Fusion-based Oracle Cloud services, you use an Oracle Identity Cloud Service (IDCS) application to manage access to Digital Assistant.

To access Digital Assistant, your team members need the ServiceDeveloper role. The Cloud Account Administrator on your team (typically, the person who signed up for the service) can grant other team members this role.

To set up users with the ServiceDeveloper role:

  1. As the Cloud Account Administrator, log in to IDCS.

    The URL for your IDCS instance is provided in the welcome email you receive when you sign up for the service (or if and when the service was upgraded to include out-of-the-box skills).

  2. Click the Applications tile.

  3. Navigate to the IDCS application for your Digital Assistant instance.

    This application probably has idcs-oda at the beginning of its name.

  4. In the IDCS application, click the Application Roles tab.

  5. In the tile for the ServiceDeveloper role, click role menu icon) and select Assign Users or Assign Group.

  6. Select the users or groups that you want to assign the role to and click Assign.

    Note

    If you want to be able to access the Digital Assistant user interface, be sure to assign yourself that role as well.

Get the Digital Assistant Instance URL

For instances of Digital Assistant that come with a Fusion-based Cloud Applications service, here's how you get the URL for the service:

  1. In the IDCS application for Digital Assistant, click the Configuration tab, and find the Primary Audience field.

  2. Copy the value of the Primary Audience field and paste it to a text file.

  3. Append /botsui to the URL that you copied.

    This is the URL for the instance's user interface. Distribute this URL to team members that you want to have access to Digital Assistant.

Get the Out-of-the-Box Skills

Out-of-the-box skills that are provided for Fusion-based Cloud Applications services are available in Digital Assistant's Skill Store.

To get a skill from the Digital Assistant Skill Store:

  1. Log in to Digital Assistant.
  2. Click icon to open the side menu to open the side menu and select Development > Store.

  3. In the tile for the skill that you want to add, click icon to open the Options menu and select Pull.

    The skill appears in Skills Catalog in your instance. The next step is to train the skill.

Train the Out-of-the-Box Skills

Before you can use a skill or test its behavior, you need to train it.

To train a skill:

  1. Log in to Digital Assistant.

  2. In Digital Assistant, click icon to open the side menu to open the side menu and select Development > Skills.

  3. Click the tile for the skill that you want to train to open it.

  4. Click the Train button in the upper right corner of the page and then click Submit.

Test the Out-of-the-Box Skills

You can test the behavior of a skill directly within Digital Assistant. See The Skill Tester.

Learn About Extending Out-of-the-Box Skills

Once you have pulled out-of-the-box skills, you can evaluate them, deploy them as is, or extend (customize) them and then deploy them.

Explore these topics to learn what you can do and how to do it:

Learn About Personalizing Digital Assistants

If you deploy your out-of-the-box skills as part of a single digital assistant, here are some things you can do with the digital assistant.