OCI Credential Configuration for AI Features Locked to Existing Customers

What changed

The AI Preferences page (Setup > Company > AI > AI Preferences) now restricts OCI credential configuration to accounts that already have an Oracle Cloud Infrastructure configuration saved. If your account has never stored OCI credentials in NetSuite, you cannot add them through this page. Oracle has not documented an alternative onboarding path, so it is unclear whether this is a permanent lockout or a transitional restriction. Verify with Oracle support if you need new OCI access.

For accounts with existing OCI configurations, the setup now requires storing the OCI fingerprint and private key as NetSuite API Secrets (record prefix custsecret), rather than entering them as plain-text fields. This is a security improvement that leverages the platform's secret management infrastructure.

Technical details

OCI services consumed

• OCI Generative AI — used by Text Enhance, Prompt Studio, and the N/llm SuiteScript module.
• OCI Document Understanding — used by the N/documentCapture SuiteScript module for document parsing (OCR, classification, key-value extraction).

Required OCI identifiers

• User OCID
• Compartment OCID
• Tenancy OCID
• Fingerprint (stored as API Secret)
• Private key PEM file (stored as API Secret)
• Endpoint ID (only for dedicated AI clusters)

Additional fields for async N/documentCapture

• OCI Object Storage Namespace
• OCI Input Bucket
• OCI Output Bucket

These fields are optional if you only use synchronous N/documentCapture calls, or if you pass an ociConfig object directly in your SuiteScript. A script-level ociConfig object overrides the stored configuration on this page.

API Secret configuration

When creating the API Secrets for fingerprint and private key:

• The secret ID must start with an underscore (e.g., _oci_config_fingerprint). NetSuite prepends custsecret on save, resulting in custsecret_oci_config_fingerprint.
• On the Restrictions tab, check Allow for All Scripts and set Restrict to Domains to _none_. This allows all AI features managed from AI Preferences to access the secrets.
• For the private key, upload the PEM file rather than pasting into the Password field.

Per-feature OCI toggle

Each AI feature (Text Enhance, Prompt Studio, SuiteScript AI) has its own subtab with a Use OCI Credentials checkbox. When enabled for a feature, NetSuite stops using its managed AI infrastructure and routes requests through your OCI account. This switches from metered/limited usage to paid unlimited usage billed through OCI.

Disabling OCI on the Settings subtab (Use OCI Configuration to Get Unlimited Usage unchecked) overrides all per-feature OCI toggles and reverts the entire account to NetSuite-managed AI infrastructure with monthly usage limits.

What to do

1. Check eligibility: Navigate to Setup > Company > AI > AI Preferences > Settings. If the OCI configuration fields are not available, your account is locked out from adding new OCI credentials.
2. Migrate credentials to API Secrets: If you have existing OCI configuration, ensure the fingerprint and private key are stored as API Secrets with the correct restrictions (Allow for All Scripts = checked, Restrict to Domains = _none_).
3. Validate: Click Validate credentials on the Settings subtab. Note that each successful validation counts as one OCI Generative AI service call (billed to your OCI account).
4. Review SuiteScript usage: If your scripts use N/documentCapture with asynchronous processing, populate the Object Storage Namespace, Input Bucket, and Output Bucket fields — or continue passing an ociConfig object in your scripts (which takes precedence).
5. Audit per-feature toggles: After saving the Settings subtab, visit each feature subtab (Text Enhance, Prompt Studio, SuiteScript) and explicitly enable or disable OCI credentials. Enabling removes NetSuite usage caps; disabling returns to metered limits.
6. Test each feature: After enabling OCI for a feature, exercise it (e.g., trigger a Text Enhance action). A Task Unavailable error indicates misconfigured OCI credentials or IAM policies.

Common troubleshooting

• Verify OCID values (user, compartment, tenancy) match your Oracle Cloud account exactly.
• Confirm the API Secret IDs (not names) are entered on the AI Preferences Settings subtab.
• Ensure OCI IAM policies grant the user access to generative-ai-text-embedding and generative-ai-chat resources in the correct compartment.
• For Document Understanding, confirm policies for API access, Object Storage input bucket (tenancy-level), and output bucket (compartment-level) are all in place.