Launching python-oracledb 4.0: Oracle Deep Data Security, Enhanced Message Queuing and Cloud Native Authentication support

Another great release of python-oracledb supports your use of Python and Oracle AI Database by improving application security for AI workloads, having better cloud native authentication, and enhancing message queueing and Continuous Query Notification support.

Unveiling python-oracledb 4.0 — a major step forward for developers building modern, secure, AI-powered Python applications on Oracle AI Database.

This release continues the strong momentum of recent versions — bringing secure data access for AI-driven workloads, more Thin mode capabilities and expanded cloud-based authentication options— all while continuing to simplify deployment with the lightweight Thin mode architecture.

Key Takeaways

The headline feature of this release is:

• Oracle Deep Data Security support to enable secure, identity-aware database access for AI agents and end users

Other major enhancements in this release include:

• CQN & AQ Notifications in Thin mode to simplify event-driven applications
• More Cloud Native Authentication options for stronger cloud native development
• SQL Sanitization APIs for safer database interactions
• More APIs for security and data frame interoperability for better efficiency

In short: Python-oracledb 4.0 enables secure-by-default, event-driven, and cloud-ready Python applications — without added complexity.

Oracle Deep Data Security support

As organizations deploy agentic AI, ensuring safe, auditable access to enterprise data is critical. AI agents can make errors or be exploited (e.g., via prompt injection) to run malicious SQL, risking data exposure, unauthorized changes, and compliance issues — especially when using highly privileged database accounts.

Traditional application-layer access control becomes difficult to enforce when agents dynamically generate SQL, making query safety and authorization harder to validate. This challenge is amplified by AI-generated code (“vibe coding”) and Retrieval Augmented Generation (RAG) workflows, which can bypass conventional security assumptions and controls.

To address this, Oracle AI Database 26ai recently introduced Oracle Deep Data Security, a next-generation access control system.

This version of python-oracledb brings support for the Deep Data Security feature via a new plugin, which comes bundled with the driver.

Here is a simple python-oracledb code snippet to use the Oracle Deep Data Security plugin to run a simple SQL query:

# Example: Using Deep Data Security with python-oracledb
import oracledb
import oracledb.plugins.end_user_sec_provider as deep_data_sec_provider
import json
import requests

def myfun():
    # ...
    BASE_URL = "https://your-base-url.com"
    url = f"{BASE_URL}/api/v1/listEmployees"
    # ...
    # It is assumed that you have got the user access token in the 'result' object
    # used below
    access_token = result["access_token"] # e.g., from MSAL
    headers = {
        "Authorization": f"Bearer {access_token}"
    }
    response = requests.get(url, headers=headers)
    # the `response` object will contain the result from the REST call

    # get token from response object in the authorization headers
    # or get token from MSAL if frontend is not there
    auth_header = response.request.headers.get['Authorization'];
    # Add more validation code
    # ...
    token = auth_header.split(" ", 1)[1]

    deep_data_sec_provider.set_end_user_identity(token)

    conn = oracledb.connect(
        user="<hr_app_user>", # user to provide
        password="<database password>", # user to provide
        dsn="<your connect string>", # user to provide
        wallet_location="path to wallet file",
        wallet_password="<wallet password>",
        # The client_id, secret, tenant_id and scope values are to be
        # provided by the user. 
        extra_auth_params={
            "end_user_sec_params": {
                "spi_type": "azure_tokens",
                "auth_flow": "client_credentials",
                "client_id": "<client_id>",
                "client_credential": "<secret>",
                "authority": "https://login.microsoftonline.com/<tenant_id>", 
                "scopes": "<scope>",
                "data_roles": ["employee_role"], # optional
                "attributes": {"hr.hcm_context": {
                                   "emp_id": 3, "service_center_id": 5}
                              } # optional
            }
        }
      )

    data = mygetdata(conn)
    return json.dumps(data), 200

def mygetdata(conn):
    sql="select 'hello' from dual"
    with conn.cursor() as cursor:
        cursor.execute(sql)
        row = cursor.fetchone()
        return row

Check out the blog on Using Oracle AI Database Deep Data Security in Python applications for more details.

CQN and AQ notifications in Thin Mode

Python applications can now receive Continuous Query Notifications (CQN) and Advanced Queuing (AQ) notifications in Thin mode.

CQN enables event-trigger notifications to be sent to applications from the database. AQ is a scalable messaging backbone supporting multiple payload types and integration patterns.

With CQN and AQ Notifications Thin mode support, Python developers can unlock true event-driven database programming and move towards cloud-native, lightweight messaging architectures without Thick mode dependencies.

Stronger Cloud Native Authentication Support

This release has added Oracle Cloud Infrastructure (OCI) authentication support for:

• **Resource Principals**
• **Session Tokens**

These mechanisms provide multiple options for applications to authenticate securely and dynamically against Oracle Database, without embedding credentials in code or configuration.

The **OCI Token-Based Authentication **summary blog from my colleague Vignan. V provides a great overview of all the cloud-based native authentication methods supported by python-oracledb.

This makes python-oracledb a natural fit for cloud-first architectures.

What other improvements are included in 4.0?

In addition, python-oracledb 4.0 has also added new APIs that help developers protect sensitive data and mitigate SQL injection risks.

The following new APIs help avoid SQL injection risks and promote safe query patterns by sanitizing user SQL input:

• [**enquote_literal()](https://python-oracledb.readthedocs.io/en/latest/api_manual/module.html#oracledb.enquote_literal)**
• [**enquote_name()](https://python-oracledb.readthedocs.io/en/latest/api_manual/module.html#oracledb.enquote_name)**
• [**is_simple_sql_name()](https://python-oracledb.readthedocs.io/en/latest/api_manual/module.html#oracledb.is_simple_sql_name)**
• [**is_qualified_sql_name()](https://python-oracledb.readthedocs.io/en/latest/api_manual/module.html#oracledb.is_qualified_sql_name)**

You can now also handle secure secrets via:

• [**save_secret()](https://python-oracledb.readthedocs.io/en/latest/api_manual/module.html#oracledb.save_secret)**
• [**get_secret()](https://python-oracledb.readthedocs.io/en/latest/api_manual/module.html#oracledb.get_secret)**

This release also brings improved data frame efficiency with support for binary views (“vb”) and string views (“vu”), enabling better interoperability with Python AI libraries using the Arrow data interface.

In the previous python-oracledb release, we had provided deprecation warnings about removing support for older Oracle Database and Oracle Client versions in the python-oracledb documentation. In this release, we have dropped support for older Oracle Client versions (<19c). Any python-oracledb users needing connections to older Oracle Database versions not supported by Oracle Client versions 19 and later can use older versions of python-oracledb.

For all the other improvements, changes and bug fixes in python-oracledb 4.0, see the Release Notes.

Thank you for using python-oracledb !

Python-oracledb Resources

Python-oracledb is an open source package for the Python Database API specification with many additions to support advanced Oracle Database features. By default, it is a ‘Thin’ driver that is immediately usable without needing any additional install e.g. no Instant Client is required. Python-oracledb is used by frameworks, ORMs, SQL generation libraries, and other projects.

• Installation instructions
• Documentation
• Discussions
• Source code on GitHub
• PyPI

FAQs

1. What is python-oracledb?

python-oracledb is Oracle’s open source Python Database API driver for Oracle Database. It supports both lightweight Thin mode connections and Thick mode connections for advanced Oracle Database capabilities.

2. Do I need Oracle Client libraries to use python-oracledb?

No. By default, python-oracledb runs in Thin mode, which does not require Oracle Client libraries. However for advanced Oracle Database capabilities like High Availability features (TAC/AC) and Sharding, python-oracledb Thick mode must be enabled which requires Oracle Client libraries.

3. What is the headline feature in python-oracledb 4.0?

The headline feature of this release is support for Oracle Deep Data Security, which enables secure, identity-aware database access for AI agents and end users. Oracle Deep Data Security is available from Oracle AI Database 26ai, 23.26.2 RU onwards.

This helps organizations build safer AI-powered applications by enforcing fine-grained access control directly at the database layer.

4. Why is Oracle Deep Data Security important for AI applications?

AI agents can dynamically generate SQL queries and may be vulnerable to prompt injection or unsafe query generation.

Oracle Deep Data Security helps:

• Prevent unauthorized data access
• Enforce identity-aware access control
• Reduce risks from over-privileged database users
• Secure RAG and agentic AI workflows

5. What are CQN and AQ notifications?

• Continuous Query Notification (CQN) allows applications to receive notifications when query results change.
• Advanced Queuing (AQ) provides scalable messaging and event-driven communication capabilities.

Together, they enable reactive and event-driven Python applications.

6. What is new about CQN and AQ in python-oracledb 4.0?

Python-oracledb 4.0 adds support for:

• CQN notifications in Thin mode
• AQ notifications in Thin mode

This allows developers to build lightweight, cloud-native event-driven applications without requiring Thick mode dependencies.

7. What cloud-native authentication methods are now supported?

Python-oracledb 4.0 brings the following Oracle Cloud Infrastructure (OCI) authentication support options:

• API Key-based Authentication
• Instance Principal Authentication
• Resource Principal Authentication
• Session Token Authentication

This enables secure authentication without embedding credentials in application code.

8. Which Oracle Client versions are supported in python-oracledb 4.0?

Python-oracledb 4.0 has dropped support for Oracle Client versions older than 19c.

Applications needing older Oracle Database compatibility can continue using older python-oracledb releases.