# Oracle Fusion Cloud Applications > Oracle Fusion Cloud Applications: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the Oracle Fusion Cloud Applications REST resources you name (ERP, HCM and SCM), so finance, people and supply agents can answer from invoices, workers or orders. It signs in with a JWT assertion made with the client’s certificate for a read-only integration user, and sends only GETs. ## At a glance | Collector | Oracle Fusion Cloud Applications, version `1.0.0` | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | Oracle: Oracle Fusion Cloud Applications (ERP, HCM, SCM REST) ([the vendor's documentation](https://docs.oracle.com/en/cloud/saas/index.html)) | | Family | ERP | | Kind | ERP | | Ways to connect | Key pair | | Scopes | - Read: `view duties on the named REST resources (Fusion does not state a user's roles)` | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Financial, Employment, Identity, Content | | Hosts it may contact | `{pod}.fa.{region}.oraclecloud.com` | | Vendor API versions | Oracle Fusion Cloud Applications REST API 11.13.18.05 and latest (fscmRestApi, hcmRestApi, crmRestApi) | | Lowest engine version | `0.46.0` | ## What it reads - The REST resources you name, each as `{path, key, updated, title, fields}` where `path` is `/resources//` and nothing else. A whole pod is never the default. - Changes by `LastUpdateDate` (or the field named), ordered ascending, paged by offset while `hasMore`. Fusion’s dates carry their offset, so no widening is needed. - Deletions: every six hours the keys are listed (`fields=`) and what has gone is withdrawn. A resource the user cannot read (403, 404) keeps its ids. - A record with a null key is skipped. ## How to connect 1. In Fusion’s Security Console, register the client’s certificate under API Authentication with a trusted issuer name, and create or choose an integration user whose roles hold the view duties of the resources named and nothing that creates or edits. 2. In LightHouse, open **Connectors**, choose **Oracle Fusion Cloud Applications**, and give the pod address, the issuer, the user name and the PEM of the private key and certificate. They are sealed in your browser to your deployment’s key and kept in your own secrets store; LightHouse never opens them. 3. In code, set `ORACLE_FUSION_CREDENTIAL` to the credential’s JSON fields (`pod_url`, `issuer`, `username`, `certificate`) and add a `kind: oracle-fusion` source card with `resources`, `label` and `requires`. ## Permissions Read-only is the integration user’s roles: give it the view duties of the resources named. Fusion does not state a user’s roles to the caller, so the health check reads one resource and the card says the roles were not stated. Fusion’s inbound JWT authentication takes the signed assertion itself as the bearer token: there is no token exchange, no password and no client secret, and the key never leaves the client’s account. Each assertion is valid ten minutes, held in memory and signed again a minute before it lapses. Every request is a `GET` to the sealed pod’s host; the fetcher refuses anything else, a `next` link included. Its read-only test proves it on every change. ## Limits - `pod_url` must be `https://.fa..oraclecloud.com`. - A resource path must match the three families and a version; field names are identifiers; a query value is never built from data. - A resource is named once. - Pages are capped by the pod (500 by default in the tests). - Requests are paced and back off when Fusion asks (`Retry-After`). ## Data handling - The fields you name are copied into the deployment’s corpus under the source’s `label`. Invoices and suppliers are financial records; HCM resources hold employment records and people’s names, so name the fields, not the resource, where a resource holds more than the question needs. - The private key stays in the client’s store; only the signed assertion is sent, and it is never written to logs or run notes. - Nothing leaves the deployment: only counts reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | -------------------------------------------------------------- | -------------------------------------------------------------------- | ----------------------------------------------- | | `pod_url is https://.fa..oraclecloud.com` | The pod address is not Oracle’s | Use the pod’s address | | `not a Fusion REST resource path` | A resource path is not one of the three families and a version | Use `fscmRestApi/resources//` | | `name the resources to sync; a whole pod is never the default` | `resources` is empty | Name the resources | | `a resource is named twice` | The same resource appears twice | Remove the duplicate | | `HTTP 401` | The assertion was rejected: the certificate, issuer or user is wrong | Check the API Authentication registration | | `HTTP 403` on a resource | The user has no role that reads it | Grant the view duty; its ids are kept meanwhile | | Read succeeded, 0 written | No record changed since the cursor | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ---------------------------------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | Oracle Fusion Cloud Applications REST API 11.13.18.05 and latest | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 1 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/oracle-fusion/