Oracle APEX 24.x New Features: GenAI Assistants, Native Enterprise Workflows & App Security Hardening

Introduction: Low-Code Meets Enterprise AI & Automation

Oracle Application Express (APEX) has evolved from a simple RAD (Rapid Application Development) tool into Oracle’s flagship low-code platform for building complex, secure enterprise web applications directly inside the Oracle Database engine.

With the release of Oracle APEX 24.x, Oracle delivers major architectural enhancements designed to accelerate developer productivity, eliminate custom PL/SQL approval code, and seamlessly integrate Generative AI directly into business workflows.

For database administrators and developers managing Oracle Database 19c or 23ai, APEX 24.x provides a modern web interface layer without requiring external node.js or Java application servers.

---

🚀 Top New Features in Oracle APEX 24.x

1. Native Generative AI & AI Assistant Integration

APEX 24.x embeds GenAI capability into both the Application Builder and runtime user applications:

• APEX AI Assistant in Builder: Developers can generate SQL queries, PL/SQL code blocks, and dynamic page layouts using natural language prompts inside Component Application Builder.
• App-Facing GenAI Components: Easily connect APEX pages to OCI Generative AI Services or OpenAI/Azure OpenAI via native REST Data Sources.
• Retrieval-Augmented Generation (RAG): Combine Oracle Database 23ai Vector Search with APEX page components to let end users chat with enterprise documents (PDFs, contracts, diagnostic logs) directly within the APEX UI.

-- Example: Querying Vector Embeddings in APEX via SQL
SELECT 
    document_title,
    VECTOR_DISTANCE(doc_vector, :P10_USER_EMBEDDING, COSINE) AS distance_score,
    document_text
FROM enterprise_knowledge_base
ORDER BY distance_score ASC
FETCH FIRST 5 ROWS ONLY;

2. Built-In Enterprise Workflow Engine

Prior to APEX 24.x, multi-stage approval processes required complex custom database triggers, package tables, and scheduled batch jobs.

APEX 24.x enhances the native BPMN-Style Workflow Engine (introduced in APEX 23.1):

• Visual Workflow Designer: Drag-and-drop human tasks, automated email notifications, conditional decision branch nodes, and timeout escalations.
• Task Console Components: Pre-built unified inbox components for managers to approve, reject, or request information on pending workflows across HR, procurement, or IT ticketing apps.
• State Management: Fully managed by Oracle APEX engine tables (APEX_WORKFLOW_INSTANCES, APEX_TASKS), ensuring transactional consistency across database sessions.

-- Example: Programmatically Initiating an APEX Workflow in PL/SQL
BEGIN
    apex_workflow.start_workflow(
        p_workflow_static_id => 'PURCHASE_REQUISITION_APPROVAL',
        p_business_ref       => :P15_REQ_ID,
        p_initiator          => :APP_USER
    );
END;
/

3. Modernized Template Components & Dynamic Actions

• Client-Side Expressions: Execute conditional UI logic in JavaScript without forcing an AJAX round-trip to the database host.
• Enhanced Interactive Grids: Native support for bulk JSON column editing, quick column filtering, and exported PDF formatting with corporate branding.

---

🔒 Security Hardening Best Practices for APEX 24.x

While APEX provides robust built-in protection against SQL injection and Cross-Site Scripting (XSS), misconfigured APEX applications remain a primary target for security audits.

1. Enforce Strict Session State Protection (SSP)

Navigate to Shared Components ➔ Security Attributes ➔ Session State Protection and set SSP to Enabled:

• Set Page Access Protection to Arguments Must Have Checksum.
• Prevents URL tampering where users alter page items in the browser URL (e.g., changing f?p=100:5:SESSION::::P5_CUSTOMER_ID:102 to 103).

2. Restrict APEX Administration Services Port

Never expose the APEX Internal Administration Services portal (/apex/apex_admin) on public internet gateways. Block access to apex_admin at your ORDS reverse proxy (Nginx or Caddy):

# Nginx Rule: Restrict APEX Admin Console
location /ords/apex_admin {
    allow 192.168.10.0/24; # Internal Management Network Only
    deny all;
}

---

🔍 Diagnostic Queries: Auditing APEX Workflows & Session Logs

Run these diagnostic SQL queries in SQL Developer or APEX SQL Commands to monitor workflow health and active application sessions:

Diagnostic 1: Monitor Pending & Stalled APEX Workflows

SELECT 
    workflow_id,
    workflow_name,
    state,
    initiator,
    created_on,
    last_updated_on
FROM apex_workflows
WHERE state IN ('FAULTED', 'STALLED', 'RUNNING')
ORDER BY created_on DESC;

Diagnostic 2: Audit APEX Page View Activity & Response Times

SELECT 
    app_user,
    application_id,
    page_id,
    elapsed_time,
    sqlerrm,
    view_date
FROM apex_workspace_activity_log
WHERE view_date >= SYSDATE - 1
  AND elapsed_time > 2.0 -- Queries taking > 2 seconds
ORDER BY elapsed_time DESC;

---

📚 Official Documentation & Technical References

• Oracle APEX Official Documentation: Oracle APEX Release Portal — Official release notes, API references, and developer guides.
• Oracle APEX App Builder User’s Guide: Using Generative AI and AI Assistants in APEX — Configuring GenAI REST Data Sources, OCI GenAI, and Builder AI features.
• Oracle APEX Workflow Guide: Managing Workflows in Oracle APEX — BPMN workflow definition, human tasks, and APEX_WORKFLOW API.
• ORACLE-BASE: Oracle APEX Articles & Tutorials — Tim Hall’s extensive tutorials on Oracle APEX installation, ORDS configuration, security, and feature guides.

---

Need assistance upgrading to Oracle APEX 24.x, setting up GenAI/Vector Search integrations, or hardening ORDS/APEX security? Request an APEX Architecture Audit or Contact our Enterprise Oracle Team.