Oracle Fusion Cloud Applications

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the Oracle Fusion Cloud Applications REST resources you name (ERP, HCM and SCM), so finance, people and supply agents can answer from invoices, workers or orders. It signs in with a JWT assertion made with the client’s certificate for a read-only integration user, and sends only GETs.

At a glance

Collector	Oracle Fusion Cloud Applications, version 1.0.0
Reads	Oracle: Oracle Fusion Cloud Applications (ERP, HCM, SCM REST) (the vendor's documentation)
Family	ERP
Kind	ERP
Ways to connect	Key pair
Scopes	Read: view duties on the named REST resources (Fusion does not state a user's roles)
Read only	Yes
Vendor's API can move money	No
Personal data	Financial, Employment, Identity, Content
Hosts it may contact	{pod}.fa.{region}.oraclecloud.com
Vendor API versions	Oracle Fusion Cloud Applications REST API 11.13.18.05 and latest (fscmRestApi, hcmRestApi, crmRestApi)
Lowest engine version	0.46.0

What it reads

• The REST resources you name, each as {path, key, updated, title, fields} where path is <fscmRestApi|hcmRestApi|crmRestApi>/resources/<version>/<name> and nothing else. A whole pod is never the default.
• Changes by LastUpdateDate (or the field named), ordered ascending, paged by offset while hasMore. Fusion’s dates carry their offset, so no widening is needed.
• Deletions: every six hours the keys are listed (fields=<key>) and what has gone is withdrawn. A resource the user cannot read (403, 404) keeps its ids.
• A record with a null key is skipped.

How to connect

1. In Fusion’s Security Console, register the client’s certificate under API Authentication with a trusted issuer name, and create or choose an integration user whose roles hold the view duties of the resources named and nothing that creates or edits.
2. In LightHouse, open Connectors, choose Oracle Fusion Cloud Applications, and give the pod address, the issuer, the user name and the PEM of the private key and certificate. They are sealed in your browser to your deployment’s key and kept in your own secrets store; LightHouse never opens them.
3. In code, set ORACLE_FUSION_CREDENTIAL to the credential’s JSON fields (pod_url, issuer, username, certificate) and add a kind: oracle-fusion source card with resources, label and requires.

Permissions

Read-only is the integration user’s roles: give it the view duties of the resources named. Fusion does not state a user’s roles to the caller, so the health check reads one resource and the card says the roles were not stated. Fusion’s inbound JWT authentication takes the signed assertion itself as the bearer token: there is no token exchange, no password and no client secret, and the key never leaves the client’s account. Each assertion is valid ten minutes, held in memory and signed again a minute before it lapses.

Every request is a GET to the sealed pod’s host; the fetcher refuses anything else, a next link included. Its read-only test proves it on every change.

Limits

• pod_url must be https://<pod>.fa.<region>.oraclecloud.com.
• A resource path must match the three families and a version; field names are identifiers; a query value is never built from data.
• A resource is named once.
• Pages are capped by the pod (500 by default in the tests).
• Requests are paced and back off when Fusion asks (Retry-After).

Data handling

• The fields you name are copied into the deployment’s corpus under the source’s label. Invoices and suppliers are financial records; HCM resources hold employment records and people’s names, so name the fields, not the resource, where a resource holds more than the question needs.
• The private key stays in the client’s store; only the signed assertion is sent, and it is never written to logs or run notes.
• Nothing leaves the deployment: only counts reach LightHouse.

Troubleshooting

What you see	What it means	What to do
pod_url is https://<pod>.fa.<region>.oraclecloud.com	The pod address is not Oracle’s	Use the pod’s address
not a Fusion REST resource path	A resource path is not one of the three families and a version	Use fscmRestApi/resources/<version>/<name>
name the resources to sync; a whole pod is never the default	resources is empty	Name the resources
a resource is named twice	The same resource appears twice	Remove the duplicate
HTTP 401	The assertion was rejected: the certificate, issuer or user is wrong	Check the API Authentication registration
HTTP 403 on a resource	The user has no role that reads it	Grant the view duty; its ids are kept meanwhile
Read succeeded, 0 written	No record changed since the cursor	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	Oracle Fusion Cloud Applications REST API 11.13.18.05 and latest	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	1
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only