---
# === IDENTITY ===
id: business/erp-integration/oracle-erp-cloud-integration-security-roles/2026
canonical_question: "Which Oracle ERP Cloud security roles are needed for integration and how to design minimum privilege?"
aliases:
  - "Oracle Fusion Cloud integration user roles and privileges"
  - "How to set up minimum privilege security roles for Oracle ERP Cloud integrations"
  - "Oracle Cloud ERP RBAC integration security design"
  - "Oracle Fusion Cloud duty roles and function security for API integrations"
entity_type: erp_integration
domain: business > erp-integration > oracle-erp-cloud-integration-security-roles
region: global
jurisdiction: global
temporal_scope: 2024-2026

# === SYSTEM PROFILE ===
systems:
  - name: "Oracle Fusion Cloud ERP"
    vendor: "Oracle"
    version: "Release 25A-25D (24.01-24.12 quarterly updates)"
    edition: "Enterprise"
    deployment: cloud
    api_surface: "REST, SOAP, FBDI, BIP"

# === VERIFICATION ===
last_verified: 2026-03-09
confidence: 0.87
version: 1.0
first_published: 2026-03-09

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: volatile
  last_breaking_change: "Release 24C — new data security policy enforcement for REST APIs"
  next_review: 2026-09-05
  change_sensitivity: high

# === CONSTRAINTS ===
constraints:
  - "Integration users must have both function security privileges AND data security policies — function security alone does not grant data access"
  - "Predefined (seeded) roles cannot be edited directly — you must copy them to create custom roles"
  - "Data roles are not directly assignable to users — they must be inherited through job roles or abstract roles"
  - "Duty roles cannot be assigned directly to users — they must be nested within job roles or abstract roles"
  - "Role changes in Security Console require re-provisioning — users must sign out and back in for changes to take effect"
  - "FBDI import jobs require specific ESS (Enterprise Scheduler Service) privileges in addition to module-level duty roles"
  - "REST API access requires the specific API duty role for each endpoint — generic module roles do not automatically grant REST access"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "User needs Oracle Integration Cloud (OIC) adapter-level configuration, not ERP-side roles"
    use_instead: "business/erp-integration/oracle-oic-deep-dive/2026"
  - condition: "User needs Oracle ERP Cloud API capabilities and rate limits, not security roles"
    use_instead: "business/erp-integration/oracle-erp-cloud-rest-api-capabilities/2026"
  - condition: "User needs Segregation of Duties (SoD) rule design, not integration roles"
    use_instead: "Search knowledgelib.io for Segregation of Duties rule design - no dedicated unit yet"

# === AGENT HINTS ===
inputs_needed:
  - key: integration_pattern
    question: "What integration pattern do you need?"
    type: choice
    options:
      - "real-time sync (REST/SOAP API calls)"
      - "batch/bulk (FBDI file-based data import)"
      - "event-driven (Business Events, ERP callbacks)"
      - "reporting (BI Publisher extracts, OTBI)"
  - key: erp_module
    question: "Which Oracle ERP module are you integrating with?"
    type: choice
    options:
      - "Financials (GL, AP, AR, FA, CM)"
      - "Procurement (PO, Purchasing, Supplier)"
      - "Supply Chain Management (INV, OM, Shipping)"
      - "Human Capital Management (HCM, Payroll)"
      - "Project Management (PPM)"
      - "Multiple modules"
  - key: direction
    question: "What's the data flow direction?"
    type: choice
    options:
      - "inbound (writing to Oracle ERP Cloud)"
      - "outbound (reading from Oracle ERP Cloud)"
      - "bidirectional sync"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/business/erp-integration/oracle-erp-cloud-integration-security-roles/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-03-09)"

# === RELATED UNITS ===
related_kos:
  depends_on: []
  related_to:
    - id: "business/erp-integration/oracle-erp-cloud-rest-api-capabilities/2026"
      label: "Oracle ERP Cloud (Fusion) REST API capabilities — 499-record pagination, expand vs fields, CRUD"
  solves: []
  alternative_to: []
  often_confused_with: []

# === SOURCES ===
sources:
  - id: src1
    title: "Overview of ERP Security Implementation"
    author: Oracle
    url: https://docs.oracle.com/en/cloud/saas/applications-common/25d/faser/overview-of-erp-security-implementation.html
    type: official_docs
    published: 2025-10-01
    reliability: authoritative
  - id: src2
    title: "Create ERP Roles in the Security Console"
    author: Oracle
    url: https://docs.oracle.com/en/cloud/saas/applications-common/25c/faser/create-erp-roles-in-the-security-console.html
    type: official_docs
    published: 2025-07-01
    reliability: authoritative
  - id: src3
    title: "Security Role Requirements for Oracle ERP Cloud Integrations"
    author: Oracle
    url: https://docs.oracle.com/en/cloud/saas/enterprise-performance-management-common/diepm/integrations_erp_cloud_oracle_gl_security_roles.html
    type: official_docs
    published: 2025-01-01
    reliability: authoritative
  - id: src4
    title: "The Case for Custom Roles: Optimizing Security and Efficiency in Oracle Cloud ERP"
    author: Pathlock
    url: https://pathlock.com/custom-roles-in-oracle-cloud-erp/
    type: technical_blog
    published: 2025-03-15
    reliability: moderate_high
  - id: src5
    title: "Managing Roles & Privileges in Oracle Fusion Cloud"
    author: More4apps
    url: https://more4apps.com/resources/blogs/managing-roles-and-privileges-in-oracle-fusion-cloud/
    type: technical_blog
    published: 2025-06-10
    reliability: moderate_high
  - id: src6
    title: "Oracle Fusion Security: Roles, Privileges and Data Access"
    author: Hexstream
    url: https://www.hexstream.com/tech-corner/oracle-fusion-security-roles-privileges-and-data-access
    type: technical_blog
    published: 2025-04-20
    reliability: moderate_high
  - id: src7
    title: "ERP Cloud Security Best Practices: Strengthen Protection & Simplify Audits"
    author: Quest Oracle Community
    url: https://questoraclecommunity.org/learn/blogs/erp-cloud-security-and-audit-proven-best-practices/
    type: community_resource
    published: 2025-05-01
    reliability: moderate_high
---

# Oracle ERP Cloud Integration Security Roles: Minimum Privilege Design

## TL;DR

- **Bottom line**: Create custom integration roles by copying predefined duty roles and stripping unnecessary privileges rather than assigning broad seeded job roles like Financial Application Administrator to integration users.
- **Key limit**: Integration users require BOTH function security privileges (what actions) AND data security policies (which data) -- function security alone does not grant data access.
- **Watch out for**: Seeded roles include far more privileges than integrations need -- the Integration Specialist role includes UI navigation and approval privileges that create SoD violations when assigned to service accounts.
- **Best for**: Any Oracle Fusion Cloud ERP integration using REST APIs, SOAP web services, FBDI file imports, or BI Publisher report extracts.
- **Authentication**: OAuth 2.0 (JWT assertion for server-to-server), SAML for SOAP, or basic auth over HTTPS -- all require the integration user to have the correct role assignments in Security Console.

## System Profile

Oracle Fusion Cloud ERP uses a layered RBAC (Role-Based Access Control) model where security is enforced through job roles, duty roles, and privileges organized in a strict hierarchy. Integration security applies across all modules -- Financials, Procurement, Supply Chain Management, HCM, and Project Management. This card covers Release 24A through 25D (the current quarterly update cycle). On-premise Oracle E-Business Suite uses a fundamentally different security model and is not covered here.

| Property | Value |
|---|---|
| **Vendor** | Oracle |
| **System** | Oracle Fusion Cloud ERP (Release 25A-25D) |
| **API Surface** | REST, SOAP, FBDI, BIP |
| **Current API Version** | Release 25D (quarterly updates) |
| **Editions Covered** | Enterprise (cloud-only) |
| **Deployment** | Cloud |
| **API Docs URL** | [Oracle ERP Cloud Security Guide](https://docs.oracle.com/en/cloud/saas/applications-common/25d/faser/overview-of-erp-security-implementation.html) |
| **Status** | GA |

## API Surfaces & Capabilities

Oracle ERP Cloud exposes multiple integration surfaces, each requiring different security role configurations. The security model applies consistently across all surfaces, but the specific duty roles and privileges differ.

| API Surface | Protocol | Best For | Security Requirement | Auth Method | Real-time? | Bulk? |
|---|---|---|---|---|---|---|
| REST API | HTTPS/JSON | Individual record CRUD, lookups | API-specific duty roles + data security | OAuth 2.0 / JWT | Yes | No |
| SOAP Web Services | HTTPS/XML | Complex operations, legacy integrations | Service-specific privileges + data roles | SAML / WS-Security | Yes | No |
| FBDI (File-Based Data Import) | UCM + ESS | Bulk data loads (AP invoices, journals, etc.) | Module duty roles + ESS privileges | Basic Auth / OAuth | No | Yes |
| BI Publisher (BIP) | HTTPS/XML | Report extracts, data exports | BI role + report-specific access | Basic Auth / OAuth | No | Yes |
| Business Events | Oracle Integration Cloud | Event-driven callbacks | Event subscription privileges | Token-based | Yes | N/A |
| ADF/Web Services | HTTPS/XML-SOAP | UI-level service operations | Full module job roles | SAML | Yes | No |

## Rate Limits & Quotas

### Per-Request Limits

| Limit Type | Value | Applies To | Notes |
|---|---|---|---|
| REST API payload size | 5 MB | REST API requests | Split larger payloads into multiple requests |
| FBDI file size | 250 MB per file | File uploads to UCM | Use multiple files for larger data sets |
| SOAP message size | 25 MB | SOAP web service calls | Configurable via admin but default is 25 MB |
| REST query results | 500 records default | REST GET operations | Use offset/limit for pagination |
| BIP report output | 300 MB | BI Publisher report generation | Large reports must be scheduled |

[src1]

### Rolling / Daily Limits

| Limit Type | Value | Window | Notes |
|---|---|---|---|
| REST API calls | No published hard limit | N/A | Fair-use throttling applies; Oracle monitors abnormal usage patterns |
| ESS job submissions | 50 concurrent jobs | Per pod | FBDI imports count toward ESS job limits |
| UCM file uploads | 1,000 per hour | Per user | Applies to FBDI data file staging |
| Business Event subscriptions | 50 per integration | Per OIC instance | Each subscription requires its own role configuration |

[src1, src3]

## Authentication

| Flow | Use When | Token Lifetime | Refresh? | Notes |
|---|---|---|---|---|
| OAuth 2.0 (JWT Assertion) | Server-to-server REST integrations | Configurable (default 1h) | New JWT per request | Recommended for production integrations |
| SAML Assertion | SOAP web service calls | Session-based | No | Requires Identity Provider federation |
| Basic Auth (Username/Password) | Development, testing, FBDI uploads | Session timeout | No | Must be over HTTPS; not recommended for production REST calls |
| OAuth 2.0 (Authorization Code) | User-context REST operations | 1h access token | Yes (refresh token) | For integrations acting on behalf of a specific user |

[src1, src3]

### Authentication Gotchas

- JWT assertion flow requires registering a confidential application in Oracle Identity Cloud Service (IDCS) or OCI IAM -- the client ID and secret must be managed as secrets, not embedded in integration code. [src1]
- The integration user in Oracle ERP Cloud must be a separate, dedicated user -- never share a human user's credentials for integrations because it breaks audit trails and complicates role certification. [src7]
- Session timeout settings configured by the Oracle Cloud administrator affect all authentication flows -- if sessions are shortened for security, integration tokens may expire mid-batch. [src1]

## Constraints
<!-- Agents: read this section before recommending any integration approach from this unit.
     These are hard constraints that must not be violated. -->

- Integration users must have both function security privileges AND data security policies -- function security alone allows the API call but returns empty results without data security.
- Predefined (seeded) roles cannot be modified -- you must copy them first in Security Console before customizing.
- Duty roles cannot be assigned directly to users -- they must be nested inside job roles or abstract roles.
- Role changes require user re-provisioning -- the integration user must sign out and back in (or the session must expire) for new role assignments to take effect.
- FBDI imports require ESS (Enterprise Scheduler Service) scheduling privileges in addition to the module-specific import duty roles.
- REST API endpoints each have their own duty role -- a role granting access to GL journals does not automatically grant access to AP invoices.
- Cross-module integration users (e.g., an integration touching both Financials and Procurement) accumulate privileges that may trigger SoD (Segregation of Duties) violations.

## Integration Pattern Decision Tree

```
START -- Design security roles for Oracle ERP Cloud integration
|-- What integration surface?
|   |-- REST API
|   |   |-- Identify each REST endpoint your integration calls
|   |   |-- Map endpoints to API-specific duty roles (see Quick Reference)
|   |   |-- Create custom job role -> nest required API duty roles
|   |   |-- Assign data security policies for each business unit/ledger
|   |   |-- Assign custom job role to dedicated integration user
|   |   +-- Authentication: OAuth 2.0 JWT assertion (recommended)
|   |-- SOAP Web Services
|   |   |-- Identify WSDL services required
|   |   |-- Map to service operation privileges
|   |   |-- Create custom job role -> nest service duty roles
|   |   |-- Assign data security policies
|   |   +-- Authentication: SAML assertion
|   |-- FBDI (File-Based Data Import)
|   |   |-- Identify import templates needed
|   |   |-- Assign module-specific import duty roles
|   |   |-- Add ESS scheduling privilege: "Run <Module> Scheduled Processes"
|   |   |-- Add UCM content access privileges
|   |   |-- Create custom job role -> nest all above
|   |   +-- Authentication: Basic auth (upload) + ESS job scheduling
|   |-- BI Publisher (BIP) Extracts
|   |   |-- Identify reports needed
|   |   |-- Assign BI Consumer or BI Author role
|   |   |-- Add report folder access via catalog policy
|   |   +-- Authentication: Basic auth or OAuth
|   +-- Business Events (via OIC)
|       |-- Assign Business Event Subscription Management privilege
|       |-- Assign read access to relevant business objects
|       +-- Authentication: Token-based (auto-managed by OIC adapter)
|-- How many modules?
|   |-- Single module -> one custom integration job role
|   |-- Multiple modules -> evaluate SoD risk first
|   |   |-- Option A: one integration user per module (safest)
|   |   |-- Option B: one integration user, multi-module role (faster, riskier)
|   |   +-- Always: run SoD analysis before go-live
|   +-- All modules -> use per-module roles assigned to one abstract role
+-- What data scope?
    |-- Single business unit -> restrict data role to that BU
    |-- Multiple business units -> create data role per BU or use set-based conditions
    +-- All business units -> use "Grant on all values" (maximum access, audit carefully)
```

## Quick Reference

### Key Predefined Integration Roles by Module

| Module | Predefined Role | Role Code | What It Grants | Integration Surface |
|---|---|---|---|---|
| Financials (GL) | Financial Integration Specialist | ORA_GL_FINANCIAL_INTEGRATION_SPECIALIST | Journal import, GL inquiry, period operations | FBDI, REST, SOAP |
| Financials (AP) | Accounts Payable Integration Specialist | ORA_AP_ACCOUNTS_PAYABLE_INTEGRATION_SPECIALIST | Invoice import, payment processing | FBDI, REST |
| Financials (AR) | Receivables Integration Specialist | ORA_AR_RECEIVABLES_INTEGRATION_SPECIALIST | Receipt processing, customer import | FBDI, REST |
| Financials (FA) | Asset Integration Specialist | ORA_FA_ASSET_INTEGRATION_SPECIALIST | Asset mass additions, transfers | FBDI |
| Procurement | Procurement Integration Specialist | ORA_PO_PROCUREMENT_INTEGRATION_SPECIALIST | PO import, supplier management | FBDI, REST |
| SCM (Inventory) | Inventory Integration Specialist | ORA_INV_INVENTORY_INTEGRATION_SPECIALIST | Item import, on-hand transactions | FBDI, REST |
| SCM (Order Mgmt) | Order Management Integration Specialist | ORA_OM_ORDER_MANAGEMENT_INTEGRATION_SPECIALIST | Sales order import, fulfillment | FBDI, REST |
| HCM | Integration Specialist | ORA_HCM_INTEGRATION_SPECIALIST | Worker data import, absence management | FBDI, REST, HDL |
| Projects | Project Integration Specialist | ORA_PA_PROJECT_INTEGRATION_SPECIALIST | Project/task import, cost transactions | FBDI, REST |

[src1, src2, src3]

### Duty Roles Commonly Needed for REST API Access

| API Endpoint Category | Required Duty Role | Privilege Example | Notes |
|---|---|---|---|
| GL Journals | General Accounting Duty | Create Journal, Import Journal | Must pair with ledger data security |
| AP Invoices | Accounts Payable Invoice Duty | Create AP Invoice, View AP Invoice | Must pair with BU data security |
| AR Receipts | Receivables Transaction Duty | Create AR Receipt, Apply AR Receipt | Must pair with BU data security |
| Suppliers | Supplier Maintenance Duty | Create Supplier, Update Supplier | Must pair with procurement BU data security |
| Purchase Orders | Purchasing Transaction Duty | Create Purchase Order, View Purchase Order | Must pair with BU and requisitioning BU |
| Items/Inventory | Item Management Duty | Create Item, Update Item | Must pair with inventory organization data security |
| Employees/Workers | Worker Management Duty | View Worker, Create Person | HCM-specific data roles required |

[src1, src5, src6]

## Step-by-Step Integration Guide

### 1. Create a Dedicated Integration User

Create a separate user account exclusively for the integration. Never reuse a human user account. [src7]

```
Navigation: Setup and Maintenance > Manage Users
1. Click "Add User" or use SCIM REST API
2. Set User Name: INT_<SYSTEM>_<MODULE> (e.g., INT_OIC_FINANCIALS)
3. Set a strong password (if using basic auth) or leave password-less for OAuth-only
4. Set User Category: leave as default
5. Do NOT assign any seeded job roles at this stage
```

**Verify**: Navigate to Security Console > Users > search for the new user -> user should exist with zero roles assigned.

### 2. Design a Custom Integration Job Role

Create a minimal custom job role that nests only the required duty roles. [src2, src4]

```
Navigation: Tools > Security Console > Roles > Create Role
1. Role Name: Custom <Module> Integration Role
   (e.g., "Custom GL Integration Role")
2. Role Code: CUSTOM_INT_GL (your naming convention)
3. Role Category: Common
4. Click "Duty Roles" tab > Add Duty Role
5. Search and add ONLY the duty roles your integration needs:
   - For GL journal import: "General Accounting Duty"
   - For GL inquiry: "General Ledger Reporting Duty"
   - For ESS scheduling: "Run Financials Scheduled Processes"
6. Click "Function Security Policies" tab
7. Verify only necessary privileges are inherited
8. REMOVE any privileges your integration does not need
   (e.g., UI navigation privileges, approval privileges)
```

**Verify**: In Security Console > Roles > search your custom role > "Privilege" tab -> verify no unnecessary privileges like "Manage Users" or "Approve Journals" exist.

### 3. Configure Data Security Policies

Data security defines WHICH data the integration can access. Without this, the integration user can call APIs but gets empty results. [src1, src6]

```
Navigation: Security Console > Roles > [Your Custom Role] > Data Security Policies
1. Click "Create Data Security Policy"
2. Database Resource: select the business object
   (e.g., "Ledger" for GL, "Business Unit" for AP/AR)
3. Dataset: select the condition
   - "Select by instance set" -> specific ledger(s) or BU(s)
   - "Grant on all values" -> all records (use sparingly)
4. Actions: select only needed actions
   - Read (for outbound/query integrations)
   - Manage (for inbound/create/update integrations)
5. Repeat for each business object the integration touches
```

**Verify**: Sign in as the integration user -> navigate to the module -> confirm you can only see data for the assigned business units/ledgers. For REST API: call the endpoint and verify the response contains only the expected records.

### 4. Assign the Custom Role to the Integration User

```
Navigation: Security Console > Users > [Integration User] > Roles > Add Role
1. Search for your custom role (e.g., "Custom GL Integration Role")
2. Click "Add Role Membership"
3. Set Provisioning Status to "Provisioned"
4. Click Save
```

**Verify**: Security Console > Users > [Integration User] > "Roles and Role Memberships" tab -> confirm only your custom integration role appears (no seeded job roles).

### 5. Configure FBDI-Specific Privileges (If Using File Import)

FBDI requires additional privileges beyond module-level duty roles. [src3]

```
Add these duty roles to your custom integration job role:
1. "Manage File Import and Export" (for UCM file staging)
2. "Run <Module> Scheduled Processes" (for ESS job submission)
   - Financials: "Run Financials Scheduled Processes"
   - Procurement: "Run Procurement Scheduled Processes"
   - SCM: "Run Supply Chain Management Scheduled Processes"
3. "Import <Object>" privilege specific to your import template
   - e.g., "Import Journals" for GL journal FBDI
   - e.g., "Import Payables Invoices" for AP invoice FBDI

Add UCM content security:
1. Navigate to: File Import and Export > Security
2. Grant the integration user access to relevant content folders:
   - /fin/generalLedger/import (for GL journal files)
   - /ap/invoice/import (for AP invoice files)
```

**Verify**: Sign in as the integration user -> navigate to Scheduled Processes -> confirm only the relevant import jobs are visible.

### 6. Validate and Test the Configuration

```bash
# Test REST API access with the integration user credentials
curl -X GET \
  "https://<your-instance>.fa.ocs.oraclecloud.com/fscmRestApi/resources/latest/journals" \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json"

# Expected: 200 OK with journal data for assigned ledgers only
# If 403: missing function security privilege for journals endpoint
# If 200 with empty items[]: missing data security policy for ledger
```

**Verify**: Check that the response contains data ONLY for the ledgers/business units assigned in data security policies. Any data outside the assigned scope indicates over-provisioning.

## Code Examples

### Python: Audit Integration User Privileges via REST API

```python
# Input:  Oracle ERP Cloud instance URL, OAuth access token
# Output: List of all roles and privileges assigned to integration user

import requests

base_url = "https://<instance>.fa.ocs.oraclecloud.com"
token = "<oauth_access_token>"
username = "INT_OIC_FINANCIALS"

headers = {
    "Authorization": f"Bearer {token}",
    "Content-Type": "application/json"
}

# Get user's role assignments
resp = requests.get(
    f"{base_url}/hcmRestApi/resources/latest/userAccounts",
    params={"q": f"Username={username}", "expand": "roles"},
    headers=headers
)

if resp.status_code == 200:
    user_data = resp.json()
    for item in user_data.get("items", []):
        print(f"User: {item.get('Username')}")
        for role in item.get("roles", []):
            print(f"  Role: {role.get('RoleName')} ({role.get('RoleCode')})")
else:
    print(f"Error: {resp.status_code} - {resp.text}")
```

### cURL: Test Integration User REST API Access

```bash
# Input:  Instance URL, username, password (basic auth for testing)
# Output: Verify what data the integration user can access

# Step 1: Get journals (tests GL access + data security)
curl -s -o /dev/null -w "%{http_code}" \
  -u "INT_OIC_FINANCIALS:<password>" \
  "https://<instance>.fa.ocs.oraclecloud.com/fscmRestApi/resources/latest/journals?limit=1"
# Expected: 200 if function + data security correct; 403 if function security missing

# Step 2: Get invoices (tests AP access + data security)
curl -s -o /dev/null -w "%{http_code}" \
  -u "INT_OIC_FINANCIALS:<password>" \
  "https://<instance>.fa.ocs.oraclecloud.com/fscmRestApi/resources/latest/invoices?limit=1"
# Expected: 200 if AP role assigned; 403 if not

# Step 3: Verify data scope restriction
curl -s \
  -u "INT_OIC_FINANCIALS:<password>" \
  "https://<instance>.fa.ocs.oraclecloud.com/fscmRestApi/resources/latest/ledgers" \
  | python -m json.tool | grep -c "LedgerName"
# Expected: count should match number of ledgers in data security policy
```

## Data Mapping

### Security Object Hierarchy

| Security Layer | Oracle Term | Purpose | Example | Assignable To Users? |
|---|---|---|---|---|
| Job Role | Job Role | Top-level role representing a job function | Financial Integration Specialist | Yes |
| Abstract Role | Abstract Role | Cross-functional role (e.g., Employee, Contingent Worker) | Employee | Yes |
| Duty Role | Duty Role | Logical group of related privileges | General Accounting Duty | No (nest in job role) |
| Function Privilege | Function Security Privilege | Atomic permission to perform an action | Create Journal Entry | No (nest in duty role) |
| Data Security Policy | Data Security Policy | Grant to access specific data rows | Access Ledger: Vision Operations | No (attach to duty/job role) |
| Data Role | Data Role | Job role + data security combined | US Financials Integration Data Role | Yes |

[src1, src5, src6]

### Data Type Gotchas

- Function security privileges in Oracle Fusion Cloud are cumulative (additive) -- there is no "deny" privilege. To restrict access, you must NOT include the privilege in the role rather than trying to add a deny rule. [src1]
- Data security policies use conditions that reference "set" columns (e.g., SetId, BusinessUnitId, LedgerId). If your data model uses reference data sets, the integration user needs access to both the transaction business unit AND the reference data set. [src6]
- Role inheritance in Oracle Fusion Cloud is unlimited depth -- a job role can inherit from duty roles that inherit from other duty roles. When auditing privileges, you must trace the full inheritance chain using Security Console > "Privilege" tab > "Inherited Roles" view. [src5]

## Error Handling & Failure Points

### Common Error Codes

| Code | Meaning | Cause | Resolution |
|---|---|---|---|
| 403 Forbidden | Function security violation | Integration user lacks the API-specific duty role or privilege | Add the required duty role via Security Console; verify with Roles > Privilege tab |
| 200 with empty items[] | Data security violation (silent) | User has function access but no data security policy for the target data set | Add data security policy for the specific ledger/BU/org to the integration role |
| 401 Unauthorized | Authentication failure | Invalid credentials, expired token, or user account locked | Verify credentials; check if user account is active; regenerate OAuth token |
| 500 Internal Server Error | Server-side privilege conflict | Role configuration creates circular references or missing dependent privileges | Review role hierarchy in Security Console; check for missing aggregate privileges |
| JBO-26061 | Data security policy violation | Attempted operation on data outside granted data security scope | Expand data security policy to include the missing business unit or ledger |
| FND-0062 | Privilege not found | Referenced privilege code does not exist in the current release | Check privilege code against current release documentation; may have been renamed |

[src1, src2]

### Failure Points in Production

- **Silent data filtering**: REST APIs return 200 OK with empty results when data security is missing instead of returning a clear error. This means the integration appears to work but produces incomplete data. Fix: `Always validate record counts against a known baseline after role changes.` [src1]
- **Role provisioning delay**: After assigning a new role, the integration user must log out and back in (or wait for session expiry) before the new privileges take effect. Fix: `Force re-provisioning by calling the "Run User and Roles Synchronization" ESS job or by programmatically invalidating the user session.` [src2]
- **Quarterly update privilege changes**: Oracle quarterly updates can rename, deprecate, or introduce new duty roles and privileges. An integration role built for 24A may silently lose access after upgrading to 24D. Fix: `After every quarterly update, run a privilege comparison report using Security Console > "Compare Roles" feature and re-validate integration access.` [src4]
- **FBDI import fails with "Insufficient Privileges"**: The integration user has module duty roles but is missing the ESS scheduling privilege. FBDI requires both the import privilege AND the ability to submit ESS jobs. Fix: `Add "Run <Module> Scheduled Processes" duty role to the integration job role.` [src3]
- **Cross-module SoD violations**: An integration user that touches both AP (create invoices) and GL (post journals) may trigger SoD alerts because these are segregated duties. Fix: `Either use separate integration users per module or document the SoD exception with compensating controls.` [src7]

## Anti-Patterns

### Wrong: Assigning Seeded Job Roles Directly to Integration Users

```
# WRONG -- assigning broad seeded roles
Security Console > Users > INT_OIC_ALL > Add Role
  Role: "General Accountant"        # 200+ privileges, includes approvals
  Role: "Accounts Payable Manager"  # includes payment approvals and UI navigation
  Role: "Procurement Manager"       # includes sourcing and negotiation privileges
```

### Correct: Creating Minimal Custom Integration Roles

```
# CORRECT -- custom role with only needed duty roles
Security Console > Roles > Create Role
  Role Name: "Custom Financials Integration Role"
  Duty Roles:
    - "General Accounting Duty"        # journal operations only
    - "Accounts Payable Invoice Duty"  # invoice CRUD only, no approvals
    - "Run Financials Scheduled Processes"  # ESS for FBDI
  Data Security:
    - Ledger: "US Primary Ledger" only
    - Business Unit: "US Business Unit" only
```

### Wrong: Using "Grant on All Values" for Data Security

```
# WRONG -- granting access to ALL business units/ledgers
Data Security Policy:
  Database Resource: Business Unit
  Condition: "Grant on all values"  # integration can see ALL BUs globally
```

### Correct: Restricting Data Security to Specific Business Units

```
# CORRECT -- granting access only to required business units
Data Security Policy:
  Database Resource: Business Unit
  Condition: "Select by instance set"
  Business Units: ["US Business Unit", "UK Business Unit"]
  # Integration can only see data for these 2 BUs
```

### Wrong: Sharing a Human User Account for Integrations

```
# WRONG -- using a named user for integration
Integration Connection:
  Username: "john.smith"     # human user
  Password: "********"
  # Problems: breaks audit trail, SoD conflict with John's UI role,
  # integration breaks when John changes password or leaves company
```

### Correct: Using Dedicated Integration Service Accounts

```
# CORRECT -- dedicated service account
Integration Connection:
  Username: "INT_OIC_GL"           # dedicated, non-human user
  Auth: OAuth 2.0 JWT assertion    # no password to rotate
  Roles: "Custom GL Integration Role" only
  # Clear audit trail, no SoD conflict, survives personnel changes
```

## Common Pitfalls

- **Copying too much from seeded roles**: When creating custom roles by copying a predefined Integration Specialist role, the copied role inherits ALL duty roles and privileges from the seeded role. You must manually remove unnecessary duty roles after copying -- the copy operation does not give you a minimal starting point. Fix: `Start with an empty custom role and ADD only the duty roles you need rather than copying and REMOVING.` [src4]
- **Forgetting data security for REST APIs**: Function security privileges control which API endpoints the user can call. Data security policies control which records are returned. Missing data security is the most common reason integrations return empty results with a 200 status code. Fix: `For every duty role added, identify the corresponding data security policy and add both.` [src1]
- **Not testing with the integration user**: Developers often test REST APIs using their own admin accounts (which have broad access), then the integration breaks in production when the integration user has minimal access. Fix: `Always test REST API calls using the actual integration user credentials before go-live.` [src7]
- **Ignoring quarterly update impact on roles**: Oracle quarterly updates can introduce new privileges, rename existing ones, or change the duty role inheritance tree. Integrations that worked in 24B may fail silently in 24C if a duty role was restructured. Fix: `After every quarterly update, re-validate integration user access by running the same test suite used during initial setup.` [src4]
- **Over-provisioning to "make it work"**: When an integration fails due to missing privileges, the common fix is to keep adding broader roles until it works. This creates a security liability and SoD violations. Fix: `Use Security Console > "Analyze Roles" to identify the specific missing privilege rather than adding entire duty roles.` [src2]
- **Not managing multiple environments**: Integration roles must exist in all environments (Dev, Test, Stage, Prod) with identical configurations. Security Console role definitions do not automatically migrate between environments. Fix: `Export role definitions using the "Security Setup Data" implementation project task and import into each environment.` [src1]

## Diagnostic Commands

```bash
# List all roles assigned to integration user
curl -s -u "admin_user:<password>" \
  "https://<instance>.fa.ocs.oraclecloud.com/hcmRestApi/resources/latest/userAccounts?q=Username=INT_OIC_FINANCIALS&expand=roles" \
  | python -m json.tool

# Test function security: attempt a GL journal query
curl -s -w "\nHTTP Status: %{http_code}\n" \
  -u "INT_OIC_FINANCIALS:<password>" \
  "https://<instance>.fa.ocs.oraclecloud.com/fscmRestApi/resources/latest/journals?limit=1"
# 200 = function security OK; 403 = missing duty role

# Test data security: count accessible ledgers
curl -s -u "INT_OIC_FINANCIALS:<password>" \
  "https://<instance>.fa.ocs.oraclecloud.com/fscmRestApi/resources/latest/ledgers" \
  | python -c "import sys,json; d=json.load(sys.stdin); print(f'Accessible ledgers: {d.get(\"count\",0)}')"

# Check if ESS scheduling privilege exists (for FBDI)
curl -s -w "\nHTTP Status: %{http_code}\n" \
  -u "INT_OIC_FINANCIALS:<password>" \
  "https://<instance>.fa.ocs.oraclecloud.com/fscmRestApi/resources/latest/erpintegrations"
# 200 = ESS access OK; 403 = missing scheduling privilege

# Verify data scope: check accessible business units
curl -s -u "INT_OIC_FINANCIALS:<password>" \
  "https://<instance>.fa.ocs.oraclecloud.com/fscmRestApi/resources/latest/businessUnits" \
  | python -c "import sys,json; d=json.load(sys.stdin); [print(i['BusinessUnitName']) for i in d.get('items',[])]"
```

## Version History & Compatibility

| Release | Date | Status | Security Changes | Migration Notes |
|---|---|---|---|---|
| 25D | 2025-11 | Current | Enhanced REST API data security enforcement | Verify all REST integrations post-upgrade |
| 25C | 2025-08 | Supported | New duty roles for Project Management REST APIs | Add new duty roles if using PPM REST endpoints |
| 25B | 2025-05 | Supported | Security Console UI refresh; role comparison tool added | No breaking changes; new diagnostic tools available |
| 25A | 2025-02 | Supported | None significant | -- |
| 24D | 2024-11 | Supported | Data security policy enforcement tightened for REST APIs | REST integrations may return empty results if data security was previously not configured |
| 24C | 2024-08 | Supported | New data security requirement for Procurement REST APIs | Add procurement data security policies for existing integrations |
| 24B | 2024-05 | EOL | None significant | Minimum version for current REST API features |

[src1, src2]

### Deprecation Policy

Oracle Fusion Cloud releases quarterly updates that are mandatory (customers cannot skip updates). Security role changes are documented in "What's New" release notes. Oracle does not deprecate duty roles or privileges without at least one release cycle of advance notice in the release readiness documents, but renames and restructuring can occur without explicit deprecation warnings. [src1]

## When to Use / When Not to Use

| Use When | Don't Use When | Use Instead |
|---|---|---|
| Setting up a new integration with Oracle ERP Cloud | Configuring Oracle Identity Cloud Service (IDCS) federation | Oracle IDCS documentation |
| Designing minimum-privilege roles for service accounts | Managing end-user (human) role assignments | Oracle HCM Security Implementation Guide |
| Troubleshooting 403 errors or empty API responses | Debugging Oracle Integration Cloud (OIC) adapter configuration | OIC adapter documentation |
| Auditing integration user privileges before go-live | Implementing Segregation of Duties (SoD) rules | SoD analysis tools (Pathlock, SafePaaS) |
| Migrating integration roles between environments | Setting up Oracle Cloud Infrastructure (OCI) IAM policies | OCI IAM documentation |

## Important Caveats

- Quarterly updates are mandatory in Oracle Cloud ERP -- you cannot defer them. Every update can potentially modify duty roles, privileges, or data security enforcement. Integration role configurations must be re-validated after each quarterly update.
- The security model described here applies to Oracle Fusion Cloud ERP only. Oracle E-Business Suite (EBS), PeopleSoft, and JD Edwards use fundamentally different security models.
- Data security policies use database-level conditions (SQL predicates). Complex conditions (e.g., cross-referencing multiple business objects) require custom data security policies that must be tested carefully to avoid performance degradation.
- Oracle provides over 3,000 predefined duty roles and 12,000+ function security privileges. The specific role codes and privilege names referenced in this card are current as of Release 25D but may be renamed or restructured in future releases.
- SoD (Segregation of Duties) analysis is not covered in this card but is critical for integration users that span multiple modules. Use Oracle Risk Management Cloud or third-party tools (Pathlock, SafePaaS) to analyze SoD conflicts in integration roles.

## Related Units

- [Oracle ERP Cloud REST API Capabilities](/business/erp-integration/oracle-erp-cloud-rest-api/2026)