Oracle Procurement Cloud REST API Capabilities

TL;DR

• Bottom line: Oracle Fusion Cloud Procurement exposes 30+ REST resources under /fscmRestApi/resources/11.13.18.05/ covering requisitions, draft purchase orders, suppliers, negotiations, and compliance — but receipts live in SCM Cloud, and PO creation requires the Draft PO resource, not the read-only PO resource.
• Key limit: FBDI bulk imports are capped at 100,000 records per import and 5 concurrent import activities; REST API is throttled per-tenant with no published hard cap.
• Watch out for: The purchaseOrders resource is read-only (GET + actions) — to create or update POs via REST you must use draftPurchaseOrders, then submit for approval.
• Best for: Real-time procure-to-pay integration (requisitions, PO lifecycle, supplier management) with moderate volumes under 10,000 records/day.
• Authentication: OAuth 2.0 via Fusion Applications Identity Domain (2-legged client credentials for server-to-server, 3-legged authorization code for user-context).

System Profile

Oracle Fusion Cloud Procurement is Oracle's SaaS procurement platform, part of the broader Oracle Fusion Cloud Applications suite. The REST API (version 11.13.18.05) provides programmatic access to procurement objects including purchase requisitions, draft purchase orders, suppliers, supplier negotiations, approved supplier lists, compliance checklists, and catalog management. The API version string remains constant across quarterly releases, but endpoint behavior changes with each release. This card covers Release 26A (January 2026). Receipts and receiving are managed by the SCM Cloud REST API, not the Procurement API. [src1]

API Surfaces & Capabilities

Rate Limits & Quotas

Per-Request Limits

Rolling / Daily Limits

Authentication

Authentication Gotchas

• OAuth requires a Confidential Application configured in the Fusion Applications Identity Domain — the client ID and secret are generated there, not in Procurement Cloud itself. [src5]
• JWT Bearer flow requires uploading a signing certificate to the Identity Domain trusted partner configuration — self-signed certificates work for development but CA-signed is required for production. [src5]
• The integration user's roles and data security policies determine API access — a misconfigured integration user is the #1 cause of "403 Forbidden" errors. [src1]
• Token endpoints differ between OCI IAM Identity Domains and legacy IDCS — verify which identity provider your Fusion instance uses before coding the auth flow. [src5]

Constraints

• The purchaseOrders REST resource is read-only — it supports GET and action operations (cancel, close, freeze, hold) but NOT POST for creation or PATCH for updates. Use draftPurchaseOrders to create and edit POs.
• Receipts and receiving transactions are NOT part of the Procurement REST API — they belong to Oracle SCM Cloud under receivingReceiptRequests.
• FBDI imports cannot exceed 100,000 records per job or 5 concurrent import activities across all Fusion modules.
• Business Events in Procurement are limited to Purchase Orders — Suppliers and Purchase Agreements do not have standard business events.
• REST API version 11.13.18.05 is static across releases — endpoint behavior changes silently with quarterly Fusion updates.
• All REST endpoints require appropriate Fusion security roles — missing roles produce 403 errors with no descriptive message.
• OAuth 2.0 via Fusion Applications Identity Domain is required — basic auth is deprecated for production integrations.

Integration Pattern Decision Tree

START — User needs to integrate with Oracle Procurement Cloud
|-- What's the procurement object?
|   |-- Purchase Requisitions
|   |   |-- Volume < 1,000 records/day?
|   |   |   |-- YES -> REST API: purchaseRequisitions (POST + submitRequisition)
|   |   |   +-- NO -> FBDI: Import Requisitions template via ERP Integration Service
|   |-- Purchase Orders
|   |   |-- Creating/editing POs?
|   |   |   |-- YES -> REST API: draftPurchaseOrders (POST/PATCH), then submit
|   |   |   +-- NO (read-only) -> REST API: purchaseOrders (GET + actions)
|   |   |-- Need PO lifecycle events?
|   |   |   |-- YES -> Business Events via OIC (PO event subscription)
|   |   |   +-- NO -> REST API polling with lastUpdateDate filter
|   |   +-- Bulk PO creation?
|   |       +-- YES -> FBDI: Purchase Orders Import template
|   |-- Suppliers
|   |   |-- Volume < 500 suppliers/day?
|   |   |   |-- YES -> REST API: suppliers (POST/PATCH)
|   |   |   +-- NO -> FBDI: Supplier Import template
|   |   +-- Need real-time supplier updates?
|   |       |-- YES -> REST API polling (no business events for suppliers)
|   |       +-- NO -> Scheduled FBDI export via BI Publisher
|   |-- Receipts / Receiving
|   |   +-- Use SCM Cloud API: receivingReceiptRequests (NOT Procurement API)
|   +-- Sourcing / Negotiations
|       +-- REST API: supplierNegotiations, draftSupplierNegotiationResponses
|-- Which direction?
|   |-- Inbound -> Use draftPurchaseOrders or FBDI
|   |-- Outbound -> Use purchaseOrders or requisitionLifecycleDetails
|   +-- Bidirectional -> Design conflict resolution on PO status + lastUpdateDate
+-- Error tolerance?
    |-- Zero-loss -> FBDI with ERP Integration Service callbacks + retry queue
    +-- Best-effort -> REST API with exponential backoff on 429/503

Quick Reference

Step-by-Step Integration Guide

1. Authenticate and obtain access token

Configure a Confidential Application in the Fusion Applications Identity Domain and obtain an OAuth 2.0 access token using client credentials flow. [src5]

# Obtain OAuth 2.0 token from Fusion Identity Domain
curl -X POST "https://<identity-domain>.identity.oraclecloud.com/oauth2/v1/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=<CLIENT_ID>" \
  -d "client_secret=<CLIENT_SECRET>" \
  -d "scope=urn:opc:resource:consumer::all"

Verify: Response contains access_token field with a JWT value and expires_in (typically 3600).

2. Create a purchase requisition

Create a requisition header with at least one line. The requisition starts in "Incomplete" status until submitted. [src2]

curl -X POST "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/purchaseRequisitions" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "RequisitioningBUName": "US1 Business Unit",
    "PreparerId": 300000001234567,
    "Description": "Office Supplies Q2",
    "lines": [{
      "LineNumber": 1,
      "ItemDescription": "Printer Paper A4",
      "CategoryName": "Office Supplies",
      "Quantity": 100,
      "UnitPrice": 5.99,
      "UOMCode": "EA",
      "CurrencyCode": "USD"
    }]
  }'

Verify: Response HTTP 201 with RequisitionHeaderId in response body.

3. Submit requisition for approval

After creating lines, submit the requisition to trigger the approval workflow. [src2]

curl -X POST "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/purchaseRequisitions/<ReqHeaderId>/action/submitRequisition" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{}'

Verify: Response returns "result": "SUCCESS" — requisition status changes to "Pending Approval".

4. Query purchase orders with filters

Retrieve POs filtered by date range, status, or supplier. [src1]

curl -X GET "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/purchaseOrders?q=OrderNumber%3D1234&expand=lines&limit=25&offset=0" \
  -H "Authorization: Bearer <ACCESS_TOKEN>"

Verify: Response contains items array with PO header and expanded lines child resources.

5. Create a supplier

Create a new supplier record with addresses and sites as child resources. [src3]

curl -X POST "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/suppliers" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "Supplier": "Acme Corp",
    "SupplierType": "Supplier",
    "TaxOrganizationType": "Corporation",
    "addresses": [{"AddressName": "HQ", "Country": "US", "AddressLine1": "123 Main St", "City": "New York", "State": "NY", "PostalCode": "10001"}],
    "sites": [{"ProcurementBU": "US1 Business Unit", "SupplierSite": "MAIN", "PaymentCurrencyCode": "USD"}]
  }'

Verify: Response HTTP 201 with SupplierId in response body.

6. Implement FBDI bulk import

For volumes exceeding 1,000 records, use FBDI via the ERP Integration Service. [src4]

# Upload ZIP to UCM and trigger import job
curl -X POST "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/erpintegrations" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "OperationName": "importBulkData",
    "DocumentContent": "<BASE64_ENCODED_ZIP>",
    "DocumentName": "PoImport.zip",
    "ContentType": "zip",
    "JobName": "/oracle/apps/ess/prc/po/PurchaseOrderImportEss",
    "ParameterList": "US1 Business Unit,N,#NULL,#NULL,N,N"
  }'

Verify: Job status returns "SUCCEEDED" — check import error report for rejected records.

Code Examples

Python: Query purchase orders with pagination

# Input:  OAuth token, Fusion host URL
# Output: List of all open purchase orders

import requests

def get_all_open_pos(host, token, bu_name="US1 Business Unit"):
    url = f"https://{host}/fscmRestApi/resources/11.13.18.05/purchaseOrders"
    headers = {"Authorization": f"Bearer {token}"}
    params = {
        "q": f'Status="OPEN";ProcurementBUName="{bu_name}"',
        "limit": 500, "offset": 0,
        "expand": "lines",
        "fields": "OrderNumber,SupplierId,Supplier,Status,OrderedAmount,CurrencyCode"
    }
    all_pos = []
    while True:
        resp = requests.get(url, headers=headers, params=params)
        if resp.status_code == 429:
            import time
            time.sleep(int(resp.headers.get("Retry-After", 30)))
            continue
        resp.raise_for_status()
        data = resp.json()
        all_pos.extend(data.get("items", []))
        if not data.get("hasMore", False):
            break
        params["offset"] += params["limit"]
    return all_pos

JavaScript/Node.js: Create purchase requisition

// Input:  Fusion host, OAuth token, requisition data
// Output: Created requisition header ID

const axios = require("axios"); // v1.6+

async function createRequisition(host, token, reqData) {
  const url = `https://${host}/fscmRestApi/resources/11.13.18.05/purchaseRequisitions`;
  try {
    const resp = await axios.post(url, reqData, {
      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
    });
    const reqId = resp.data.RequisitionHeaderId;
    await axios.post(`${url}/${reqId}/action/submitRequisition`, {},
      { headers: { Authorization: `Bearer ${token}` } });
    return reqId;
  } catch (err) {
    if (err.response?.status === 429) {
      const retryAfter = err.response.headers["retry-after"] || 30;
      await new Promise((r) => setTimeout(r, retryAfter * 1000));
      return createRequisition(host, token, reqData);
    }
    throw err;
  }
}

cURL: Test API connectivity

# Input:  Valid OAuth token, Fusion host
# Output: Resource metadata

# Test authentication and list procurement resources
curl -s -X GET "https://<fusion-host>/fscmRestApi/resources/11.13.18.05" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" | python -m json.tool

# Describe purchaseRequisitions resource (schema/metadata)
curl -s -X GET "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/purchaseRequisitions/describe" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" | python -m json.tool

Data Mapping

Field Mapping Reference

Data Type Gotchas

• Oracle Fusion REST API returns dates in ISO 8601 format but expects them without timezone offset for date-only fields — sending "2026-04-15T00:00:00Z" may shift the date depending on server timezone. [src1]
• Amount fields use the currency's natural precision — JPY amounts are integers (no decimal), USD allows 2 decimal places. [src1]
• Boolean fields in Fusion REST API use "Y"/"N" strings, not true/false — sending JSON booleans causes 400 Bad Request errors. [src1]
• Flexfield (DFF) values require exact segment names matching the flexfield context — retrieve the structure via the describe endpoint first. [src1]

Error Handling & Failure Points

Common Error Codes

Failure Points in Production

• FBDI imports fail silently on malformed CSV: Import ESS job reports "SUCCEEDED" even when individual records are rejected. Fix: Always download and parse the import error report from UCM after every FBDI job. [src4]
• Draft PO submission fails with no error detail: Submitting a draft PO that violates approval rules returns a generic error. Fix: Call action/checkFunds and validate all required fields before submission. [src1]
• OAuth token caching across Fusion updates: Quarterly updates can invalidate OAuth configurations. Fix: Implement token endpoint discovery and handle 401 with a fresh token request. [src5]
• Supplier creation fails on duplicate tax registration: Returns 500 error instead of descriptive conflict message. Fix: Query suppliers by TaxRegistrationNumber before creating. [src3]
• Business Events stop firing after Fusion update: OIC subscriptions may break after quarterly updates. Fix: Re-test event subscriptions in a test instance after each quarterly update. [src6]

Anti-Patterns

Wrong: Using purchaseOrders resource to create POs

# BAD — purchaseOrders is read-only, returns 405 Method Not Allowed
curl -X POST "https://host/fscmRestApi/resources/11.13.18.05/purchaseOrders" \
  -H "Authorization: Bearer $TOKEN" -d '{"Supplier": "Acme"}'

Correct: Using draftPurchaseOrders to create, then submit

# GOOD — create via draftPurchaseOrders, then submit for approval
curl -X POST "https://host/fscmRestApi/resources/11.13.18.05/draftPurchaseOrders" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"Supplier": "Acme", "ProcurementBUName": "US1 Business Unit"}'
# Then submit:
curl -X POST "https://host/.../draftPurchaseOrders/<id>/action/submitDocument" \
  -H "Authorization: Bearer $TOKEN" -d '{}'

Wrong: Polling for supplier changes without date filter

# BAD — retrieves ALL suppliers every poll cycle, wasting API quota
def check_supplier_updates(host, token):
    resp = requests.get(f"https://{host}/.../suppliers", headers={"Authorization": f"Bearer {token}"})
    return resp.json()["items"]

Correct: Filtering by LastUpdateDate for incremental sync

# GOOD — only fetches suppliers modified since last poll
def check_supplier_updates(host, token, last_poll_time):
    resp = requests.get(f"https://{host}/.../suppliers",
        headers={"Authorization": f"Bearer {token}"},
        params={"q": f'LastUpdateDate>"{last_poll_time}"', "limit": 500})
    return resp.json()["items"]

Wrong: Using REST API for bulk supplier migration (>5,000 records)

# BAD — creates suppliers one-by-one via REST, hits throttling at scale
for supplier in ten_thousand_suppliers:
    requests.post(url, json=supplier, headers=headers)

Correct: Using FBDI for bulk supplier import

# GOOD — batch via FBDI, handles 100K records per import
import base64, zipfile, io
def bulk_import_suppliers(host, token, csv_data):
    buf = io.BytesIO()
    with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
        zf.writestr("SupplierImport.csv", csv_data)
    payload = {"OperationName": "importBulkData",
        "DocumentContent": base64.b64encode(buf.getvalue()).decode(),
        "DocumentName": "SupplierImport.zip", "ContentType": "zip",
        "JobName": "/oracle/apps/ess/prc/poi/SupplierImportEss"}
    return requests.post(f"https://{host}/.../erpintegrations",
        json=payload, headers={"Authorization": f"Bearer {token}"})

Common Pitfalls

• Assuming purchaseOrders is writable: The purchaseOrders resource only supports GET and action operations. Fix: Always use draftPurchaseOrders for write operations. [src1]
• Missing child resources in create payload: Creating a requisition without lines requires separate POST to child resource. Fix: Include lines as a nested array in the initial POST to create atomically. [src2]
• Not handling pagination: Default page size is 25 records — integrations silently miss data. Fix: Always check hasMore flag and increment offset. [src1]
• Ignoring FBDI error reports: FBDI jobs can report "SUCCEEDED" while records fail. Fix: Download and parse error report CSV from UCM after every import. [src4]
• Using basic auth in production: Basic authentication bypasses MFA and is deprecated. Fix: Implement OAuth 2.0 client credentials flow. [src5]
• Hardcoding the Identity Domain token URL: Oracle migrates tenants between IDCS and OCI IAM. Fix: Use OpenID Connect discovery to dynamically resolve token endpoint. [src5]

Diagnostic Commands

# Test authentication — should return 200 with resource list
curl -s -o /dev/null -w "%{http_code}" \
  "https://<fusion-host>/fscmRestApi/resources/11.13.18.05" \
  -H "Authorization: Bearer <TOKEN>"

# Describe a resource — returns field names, types, and constraints
curl -s "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/purchaseRequisitions/describe" \
  -H "Authorization: Bearer <TOKEN>" | python -m json.tool

# Check requisition lifecycle (end-to-end P2P status)
curl -s "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/requisitionLifecycleDetails?q=RequisitionNumber=<REQ_NUM>" \
  -H "Authorization: Bearer <TOKEN>"

# Check FBDI job status
curl -s "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/erpintegrations?finder=ESSJobStatusRF;requestId=<JOB_ID>" \
  -H "Authorization: Bearer <TOKEN>"

# List all POs for a supplier
curl -s "https://<fusion-host>/fscmRestApi/resources/11.13.18.05/purchaseOrders?q=Supplier=%22Acme%22&limit=10" \
  -H "Authorization: Bearer <TOKEN>"

Version History & Compatibility

When to Use / When Not to Use

Important Caveats

• The API version string (11.13.18.05) does not change across releases — endpoint behavior can change with each quarterly Fusion update without version increment. Always test integrations after each quarterly release.
• Oracle does not publish hard rate limits for the Procurement REST API — throttling is adaptive and tenant-specific. Contact Oracle Support for your tenant's specific capacity.
• Receiving and receipts are managed by the SCM Cloud REST API, not the Procurement REST API, even though they are part of the same procure-to-pay process.
• Business Events are available only for Purchase Orders — Suppliers, Requisitions, and Agreements require polling-based integration patterns.
• FBDI import limits (100,000 records, 5 concurrent jobs, 250 MB ZIP) are shared across ALL Fusion modules, not just Procurement.
• Sandbox environments may have different data security configurations than production — test with production-equivalent security roles before go-live.