Oracle SCM Cloud API Capabilities — Inventory, Order Management, Shipping & Manufacturing

TL;DR

• Bottom line: Oracle Fusion Cloud SCM provides REST APIs across five major modules — Inventory Management, Order Management, Manufacturing, Shipping, and Product Data Management — all under the /fscmRestApi/resources/11.13.18.05/ base path. Use REST for real-time operations under 500 records; use FBDI for bulk imports.
• Key limit: 500 records max per REST response (practical limit 499); rate limits tiered at 150/1,500/5,000 requests per minute depending on identity domain type.
• Watch out for: REST API is not designed for bulk ETL — attempting to paginate through tens of thousands of records via REST will hit rate limits and perform poorly. Use FBDI + ESS jobs for any volume above 500 records.
• Best for: Real-time inventory queries, individual order creation/updates, work order status checks, and event-driven integrations via Business Events through OIC.
• Authentication: OAuth 2.0 with Client Credentials or JWT Bearer flow through Fusion Applications Identity Domain (IAM). JWT recommended for server-to-server. [src5]

System Profile

Oracle Fusion Cloud Supply Chain & Manufacturing (SCM) is a SaaS-only suite covering inventory management, order management, manufacturing execution, shipping/logistics, procurement, and supply chain planning. The REST API follows the common Oracle Fusion REST framework (same pagination, filtering, and authentication patterns as Oracle ERP Cloud Financials) but exposes SCM-specific resources — work orders, transfer orders, shipment lines, on-hand quantities, and sales order orchestration. All editions share the same API surface; rate limits depend on your identity domain tier. [src1]

API Surfaces & Capabilities

Rate Limits & Quotas

Per-Request Limits

Rolling / Daily Limits

Authentication

Authentication Gotchas

• JWT bearer flow requires a confidential application in the Fusion IAM identity domain with a digital certificate — self-signed works for dev, CA-signed required for production. [src6]
• OAuth tokens are scoped to the identity domain, not individual users — all API calls execute under the integration user's role and data security policies. [src5]
• Password-based auth is subject to Fusion's password rotation policy (default 90 days) — automated integrations using Basic Auth will break silently when the password expires. [src6]
• When using OIC with Business Events, the OIC adapter handles auth automatically — do not configure separate OAuth for event subscriptions. [src4]

Constraints

• REST API is limited to 500 records per response — any integration requiring more than 500 records per operation must use FBDI or BICC, not REST pagination loops.
• Business Events are not enabled by default — each event type must be explicitly activated in SCM Setup and then subscribed to in OIC.
• SOAP API is in maintenance mode for SCM modules — Oracle will not add new SOAP services for SCM. All new integrations must use REST.
• FBDI requires UCM (Universal Content Management) for file upload — you cannot POST a CSV directly to an SCM REST endpoint for bulk import.
• Rate limits are per identity domain, not per application or user — all integrations sharing a domain share the same rate limit pool.
• Manufacturing work orders support both discrete and process types — the API endpoints differ (discreteWorkOrders vs processWorkOrders). Using the wrong endpoint silently fails.
• SCM REST API does not support real-time inventory reservation via a single atomic call — reservation requires a two-step process with potential race conditions.

Integration Pattern Decision Tree

START — User needs to integrate with Oracle SCM Cloud
├── What's the integration pattern?
│   ├── Real-time (individual records, <1s)
│   │   ├── Data volume < 500 records/operation?
│   │   │   ├── YES → REST API: /fscmRestApi/resources/11.13.18.05/{resource}
│   │   │   └── NO → NOT suitable for REST — use FBDI + ESS job
│   │   └── Need event-driven notifications?
│   │       ├── YES → Business Events via OIC (enable event in SCM Setup first)
│   │       └── NO → REST API polling (acceptable for <1K records)
│   ├── Batch/Bulk (scheduled, high volume)
│   │   ├── Inbound (writing to SCM)?
│   │   │   ├── < 500 records → REST API (simpler, no FBDI overhead)
│   │   │   ├── 500-250,000 records → FBDI: CSV → UCM upload → ESS job
│   │   │   └── > 250,000 records → FBDI with file splitting (250 MB limit)
│   │   └── Outbound (reading from SCM)?
│   │       ├── < 5,000 records → REST API with pagination
│   │       └── > 5,000 records → BICC incremental extraction
│   ├── Event-driven (near-real-time)
│   │   ├── SCM module supports Business Events?
│   │   │   ├── YES → Subscribe via OIC adapter (guaranteed delivery)
│   │   │   └── NO → REST API polling on LastUpdateDate
│   │   └── Need cross-module orchestration?
│   │       ├── YES → OIC with multiple event subscriptions
│   │       └── NO → Single OIC integration with callback
│   └── File-based (CSV/XML)
│       └── FBDI → download template, populate CSV, upload to UCM, trigger ESS
├── Which direction?
│   ├── Inbound → check rate limits + FBDI thresholds
│   ├── Outbound → REST for real-time, BICC for bulk
│   └── Bidirectional → design conflict resolution FIRST
└── Error tolerance?
    ├── Zero-loss → FBDI (transactional) + OIC error hospital + DLQ
    └── Best-effort → REST API with exponential backoff retry

Quick Reference

Step-by-Step Integration Guide

1. Authenticate and obtain access token

Obtain an OAuth 2.0 access token from the Fusion Applications Identity Domain using Client Credentials flow. [src5]

curl -X POST "https://{identity-domain}.identity.oraclecloud.com/oauth2/v1/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "{client_id}:{client_secret}" \
  -d "grant_type=client_credentials&scope=urn:opc:resource:consumer::all"

Verify: Response contains access_token field with a JWT string and expires_in value.

2. Query on-hand inventory balances

Use the inventoryOnhandBalanceSummaries resource to check current stock levels for a specific item and organization. [src1]

curl -X GET "https://{host}/fscmRestApi/resources/11.13.18.05/inventoryOnhandBalanceSummaries?q=ItemNumber='AS54888';OrganizationCode='M1'&limit=500" \
  -H "Authorization: Bearer {access_token}"

Verify: Response JSON contains items array with OnhandQuantity, ReservedQuantity, and AvailableQuantity fields.

3. Create a sales order via Order Hub

Submit a new sales order through Order Management. Uses an action request pattern for asynchronous order processing. [src3]

curl -X POST "https://{host}/fscmRestApi/resources/11.13.18.05/salesOrdersForOrderHub" \
  -H "Authorization: Bearer {access_token}" \
  -H "Content-Type: application/json" \
  -d '{"SourceTransactionNumber":"EXT-SO-001","SourceTransactionSystem":"EXTERNAL_SYSTEM","BuyingPartyName":"Acme Corp","lines":[{"SourceTransactionLineNumber":"1","ProductNumber":"AS54888","OrderedQuantity":10,"OrderedUOM":"Ea"}]}'

Verify: Response returns HeaderId and processing status. Poll salesOrderActionRequests/{id} for completion.

4. Paginate through large result sets

Oracle SCM REST API returns max 500 records per call. Use offset and limit parameters. Check hasMore flag. [src1]

# First page
curl -X GET "https://{host}/fscmRestApi/resources/11.13.18.05/shipmentLines?limit=500&offset=0" \
  -H "Authorization: Bearer {access_token}"
# Subsequent pages
curl -X GET "https://{host}/fscmRestApi/resources/11.13.18.05/shipmentLines?limit=500&offset=500" \
  -H "Authorization: Bearer {access_token}"

Verify: When hasMore: false, all records have been retrieved.

5. Bulk import via FBDI

For bulk operations, upload a CSV to UCM and trigger an ESS import job. Recommended for data migration and batch loads. [src3]

# Upload CSV to UCM
curl -X POST "https://{host}/fscmRestApi/resources/11.13.18.05/erpintegrations" \
  -H "Authorization: Bearer {access_token}" \
  -H "Content-Type: application/json" \
  -d '{"OperationName":"importBulkData","DocumentContent":"BASE64_ENCODED_ZIP","ContentType":"zip","FileName":"SalesOrderImport.zip"}'
# Trigger ESS import job
curl -X POST "https://{host}/fscmRestApi/resources/11.13.18.05/erpintegrations" \
  -H "Authorization: Bearer {access_token}" \
  -H "Content-Type: application/json" \
  -d '{"OperationName":"submitESSJobRequest","JobPackageName":"/oracle/apps/ess/scm/doo/decomposition/receiveSalesOrder","JobDefName":"ImportOrdersJob","ESSParameters":"EXTERNAL_SYSTEM,N,Y"}'

Verify: Poll job status via GET erpintegrations?finder=ESSJobStatusRF;requestId={ReqstId} until SUCCEEDED.

6. Subscribe to Business Events via OIC

For event-driven integration, subscribe to SCM Business Events through Oracle Integration Cloud. Events must be enabled in SCM Setup. [src4]

OIC Integration Flow:
1. Create OIC integration with Oracle ERP Cloud Adapter as trigger
2. Select "Subscribe to Business Events" connection type
3. Choose SCM event (e.g., SalesOrderEvent, InventoryTransactionEvent)
4. Map event payload to target system
5. Activate integration

Verify: In OIC Monitoring, confirm integration shows "Active" and events are received after a test transaction.

Code Examples

Python: Query Inventory On-Hand Balances

# Input:  OAuth2 credentials (client_id, client_secret), item number, org code
# Output: On-hand quantity details for the specified item

import requests
from requests.auth import HTTPBasicAuth

FUSION_HOST = "https://your-instance.fa.us2.oraclecloud.com"
IAM_HOST = "https://your-domain.identity.oraclecloud.com"

# Get OAuth token
token_resp = requests.post(
    f"{IAM_HOST}/oauth2/v1/token",
    auth=HTTPBasicAuth("client_id", "client_secret"),
    data={"grant_type": "client_credentials", "scope": "urn:opc:resource:consumer::all"}
)
access_token = token_resp.json()["access_token"]

# Query on-hand balances
headers = {"Authorization": f"Bearer {access_token}"}
resp = requests.get(
    f"{FUSION_HOST}/fscmRestApi/resources/11.13.18.05/inventoryOnhandBalanceSummaries",
    headers=headers,
    params={"q": "ItemNumber='AS54888';OrganizationCode='M1'", "limit": 500}
)
for item in resp.json().get("items", []):
    print(f"Item: {item['ItemNumber']}, On-Hand: {item['OnhandQuantity']}")

JavaScript/Node.js: Create Transfer Order with Retry

// Input:  OAuth2 token, source/destination org, item details
// Output: Transfer order ID and status

const axios = require('axios'); // v1.6+
const FUSION_HOST = 'https://your-instance.fa.us2.oraclecloud.com';

async function createTransferOrder(token, sourceOrg, destOrg, item, qty) {
  const resp = await axios.post(
    `${FUSION_HOST}/fscmRestApi/resources/11.13.18.05/transferOrders`,
    { SourceOrganizationCode: sourceOrg, DestinationOrganizationCode: destOrg,
      transferOrderLines: [{ ItemNumber: item, Quantity: qty, UOM: 'Ea' }] },
    { headers: { Authorization: `Bearer ${token}` } }
  );
  return resp.data;
}

async function withRetry(fn, maxRetries = 5) {
  for (let i = 0; i < maxRetries; i++) {
    try { return await fn(); } catch (err) {
      if (err.response?.status === 429 && i < maxRetries - 1) {
        await new Promise(r => setTimeout(r, Math.pow(2, i) * 1000));
      } else throw err;
    }
  }
}

cURL: Check Work Order Status

# Input:  Access token, work order number
# Output: Work order status, operation details

curl -X GET "https://{host}/fscmRestApi/resources/11.13.18.05/discreteWorkOrders?q=WorkOrderNumber='WO-001'&expand=operations,operations.materials&fields=WorkOrderNumber,WorkOrderStatusCode,PlannedStartDate" \
  -H "Authorization: Bearer {access_token}"

Data Mapping

Field Mapping Reference

Data Type Gotchas

• Oracle SCM datetime fields are stored in UTC internally — always pass dates with explicit timezone offset (ISO 8601) to avoid off-by-one-day errors. [src1]
• Oracle uses a party-site data model for addresses — you cannot pass raw address strings to Order Management. Look up Party and PartySite first. [src2]
• Item numbers in Oracle are case-sensitive in REST API queries — q=ItemNumber='as54888' returns no results if stored as AS54888. [src1]
• Oracle SCM uses UOM codes that may differ from external systems — "Each" is Ea, "Kilogram" is Kg. UOM must exist in Oracle's UOM class. [src2]

Error Handling & Failure Points

Common Error Codes

Failure Points in Production

• FBDI import succeeds but records not visible: ESS job shows "Succeeded" but import had validation errors. Fix: Always check ESS job output file, not just status — download output via UCM and inspect error rows. [src3]
• Business Events stop firing after SCM update: Quarterly updates can reset event enablement flags. Fix: After each quarterly update, verify Business Event enablement in SCM Setup. [src4]
• REST API returns stale inventory data: On-hand query returns cached data during high-transaction periods. Fix: Use inventoryOnhandBalanceSummaries and add unique query parameter to bypass caching. [src1]
• Transfer order creation fails silently: POST returns 200 but order not created. Fix: Check response body for embedded errors in informationalMessage field — Oracle returns 200 with inline errors. [src2]
• OAuth token works for Financials but not SCM: Token scope missing SCM resources. Fix: In IAM confidential app, ensure scope includes SCM-specific resource types. [src5]
• Pagination loop runs forever: hasMore stays true due to concurrent inserts. Fix: Add date filter (LastUpdateDate < pagination_start_time) to freeze result set. [src1]

Anti-Patterns

Wrong: Polling REST API every minute for inventory changes

# BAD — consumes rate limit budget, returns entire dataset each time
while True:
    resp = requests.get(f"{host}/fscmRestApi/.../inventoryOnhandBalanceSummaries?limit=500")
    process_all_records(resp.json()["items"])
    time.sleep(60)

Correct: Use Business Events for change notifications

# GOOD — event-driven: OIC receives inventory event, calls your webhook
@app.route('/webhook/inventory-change', methods=['POST'])
def handle_inventory_event(event_payload):
    item_id = event_payload['ItemId']
    resp = requests.get(f"{host}/fscmRestApi/.../inventoryOnhandBalanceSummaries?q=ItemId={item_id}")
    update_local_cache(resp.json()["items"][0])

Wrong: Using REST API for bulk data migration

# BAD — paginating 50K records via REST hits rate limits, takes hours
for offset in range(0, 50000, 500):
    resp = requests.get(f"{host}/fscmRestApi/.../items?limit=500&offset={offset}")
    insert_to_target(resp.json()["items"])

Correct: Use FBDI for bulk loads

# GOOD — FBDI for bulk: CSV template → UCM upload → ESS job
import base64, zipfile, io
csv_data = generate_fbdi_csv(source_records)
zip_buffer = io.BytesIO()
with zipfile.ZipFile(zip_buffer, 'w') as zf:
    zf.writestr('ItemImport.csv', csv_data)
encoded = base64.b64encode(zip_buffer.getvalue()).decode()
requests.post(f"{host}/fscmRestApi/.../erpintegrations", json={
    "OperationName": "importBulkData", "DocumentContent": encoded,
    "ContentType": "zip", "FileName": "ItemImport.zip"
}, headers=auth_headers)

Wrong: Ignoring inline error messages in 200 responses

# BAD — assumes 200 means success
resp = requests.post(f"{host}/fscmRestApi/.../transferOrders", json=payload)
if resp.status_code == 200:
    print("Success!")  # May have validation errors in response body

Correct: Check response body for embedded errors

# GOOD — inspect informationalMessage for embedded errors
resp = requests.post(f"{host}/fscmRestApi/.../transferOrders", json=payload, headers=auth_headers)
data = resp.json()
if resp.status_code == 200:
    errors = data.get("informationalMessage", [])
    if any(msg.get("severity") == "ERROR" for msg in errors):
        raise ValueError(f"Oracle returned 200 with errors: {errors}")
    print(f"Transfer order created: {data.get('OrderNumber')}")

Common Pitfalls

• Using the wrong work order endpoint: Discrete uses discreteWorkOrders; process uses processWorkOrders. Wrong endpoint returns 404 or empty results. Fix: Check org's manufacturing type in SCM Setup before choosing endpoint. [src1]
• Not enabling Business Events before subscribing: Events must be enabled in SCM Setup for each event type. OIC subscription alone is insufficient. Fix: Enable at Setup > SCM > Business Events, then create OIC subscription. [src4]
• Hardcoding resource version: While 11.13.18.05 has been stable, Oracle can deprecate versions. Fix: Use Describe endpoint (GET /fscmRestApi/resources/) to discover current versions. [src1]
• UCM file naming conflicts: Same filename overwrites previous FBDI uploads. Fix: Append timestamp or UUID: ItemImport_20260309_143022.zip. [src3]
• Assuming SCM = ERP availability: SCM modules can have different maintenance windows. Fix: Check Oracle Cloud status page for SCM-specific maintenance. [src2]
• Flooding ESS job queue: Too many FBDI jobs blocks queue for all users. Fix: Queue jobs with 30-second delays; monitor ESS job slots before submitting. [src3]

Diagnostic Commands

# Test authentication — get token and verify
curl -s -X POST "https://{iam-host}/oauth2/v1/token" \
  -u "{client_id}:{client_secret}" \
  -d "grant_type=client_credentials&scope=urn:opc:resource:consumer::all" | jq .access_token

# Check API availability — discover available resources
curl -s -X GET "https://{host}/fscmRestApi/resources/" \
  -H "Authorization: Bearer {token}" | jq '.items[] | .name'

# Verify SCM access — list inventory organizations
curl -s -X GET "https://{host}/fscmRestApi/resources/11.13.18.05/inventoryOrganizations?limit=5" \
  -H "Authorization: Bearer {token}" | jq '.items[] | {name: .OrganizationCode}'

# Check on-hand quantity for specific item
curl -s -X GET "https://{host}/fscmRestApi/resources/11.13.18.05/inventoryOnhandBalanceSummaries?q=ItemNumber='AS54888'&limit=5" \
  -H "Authorization: Bearer {token}" | jq '.items[0]'

# Monitor ESS job status (FBDI imports)
curl -s -X GET "https://{host}/fscmRestApi/resources/11.13.18.05/erpintegrations?finder=ESSJobStatusRF;requestId={job_id}" \
  -H "Authorization: Bearer {token}" | jq '.items[0] | {status: .RequestStatus}'

Version History & Compatibility

When to Use / When Not to Use

Important Caveats

• Rate limits are per identity domain, not per integration — if multiple integrations share an identity domain, they compete for the same rate limit pool.
• Business Events have at-least-once delivery semantics — your integration must be idempotent to handle duplicate events during OIC restarts or network retries.
• FBDI template formats change with Oracle quarterly updates — always download the latest template after each update rather than reusing templates from previous releases.
• Test environments have lower ESS concurrency limits than production — performance testing on test instances underestimates production throughput.
• Oracle SCM REST API documentation lags behind actual API capabilities by 1-2 quarters — use the Describe endpoint to discover available resources.
• Rate limit numbers (150/1,500/5,000 per minute tiers) are from Oracle support notes and community sources — Oracle can change these without notice.