Oracle Fusion

Connect Oracle Fusion Cloud Applications to BotDojo so agents can read customer-account, receivables-invoice, sales-order, and shipment data through Oracle's native REST APIs. The built-in tools and Oracle Fusion Custom Integration Tools are read-only.

Before You Start

You need an Oracle Fusion Applications identity-domain administrator and an Oracle Fusion security administrator. In the identity domain associated with the Fusion tenant:

1. Create a Confidential Application.
2. Configure it as a client and enable the Client Credentials grant type.
3. Limit Authorized resources to the Fusion Applications resource and add the required scope.
4. Activate the application and record its client ID and client secret.
5. In the Fusion Applications Security Console, create or configure a user whose user name exactly matches the OAuth client ID.
6. Assign that user only the read privileges, duty roles, and data-security contexts needed for the Financials and SCM records the agent should see.

Oracle documents this as a two-legged OAuth flow. See Configure OAuth Using the Fusion Applications Identity Domain for the current Oracle setup procedure.

Collect these connection values:

• Tenant URL (also called the instance URL) — the HTTPS origin of the Fusion Applications tenant, such as https://example.fa.us2.oraclecloud.com. Do not include a REST resource path.
• Token URL — the OAuth token endpoint for the associated identity domain, normally ending in /oauth2/v1/token. Oracle exposes the exact value in the identity domain's OpenID configuration.
• OAuth Client ID — the confidential application's client ID and the exact user name configured in Fusion Applications.
• OAuth Client Secret — the secret generated for the confidential application.
• Scope — the exact Fusion resource scope authorized for the application. In the Fusion identity domain, open Oracle Cloud Services, select Oracle Applications Cloud (Fusion), and copy IDCS_CONNECTOR_CLIENT_SCOPE from Application Information. For the traditional REST paths used here, it resembles two space-separated values: urn:opc:resource:fa:<instanceid>=<podname> urn:opc:resource:consumer::all.
• API Version — the Oracle REST resource version to place in API paths. Use the version enabled for all required resources; 11.13.18.05 is the default used by the built-in tools.

Connect Oracle Fusion In BotDojo

1. In BotDojo, open your project and select Connections.
2. Select Add Connection, search for Oracle Fusion, and select its card.
3. Enter the tenant URL, token URL, OAuth client ID, OAuth client secret, scope, and API version.
4. Select Test Connection to verify that BotDojo can obtain an OAuth access token.
5. Select Connect.
6. Run each tool your agent will use with a known record from an allowed business unit or organization.

The connection test verifies OAuth token acquisition only. It does not prove that the Fusion user has permission or data access for every Financials and SCM resource.

BotDojo stores the OAuth client secret only in protected integration auth storage. OAuth access tokens are cached in server memory for the active provider instance and are not persisted back to the connection record.

What This Integration Supports

Oracle Fusion exposes five built-in, read-only tools:

findCustomerAccounts intentionally uses the Financials receivablesCustomerAccountActivities resource. It does not substitute a CRM account record for the Receivables customer-account view.

Use Complete or Incomplete for customer-activity status and a non-negative integer for transaction lookback days. Receivables invoice status accepts Complete, Incomplete, or Frozen.

An Oracle order-number finder can return both a reference order and the latest order revision. The built-in tool requests all bounded matches and selects the record whose OrderKey matches Oracle's documented SourceTransactionSystem:SourceTransactionId form. If the result is still ambiguous, use the order key or header ID instead.

Build Custom Integration Tools

Project administrators can add a narrow, read-only tool to an Oracle Fusion connection when the five built-in tools do not cover a tenant-specific lookup. Read the Custom Connection Tools guide for the authoring, publishing, permission, and sandbox model.

Oracle Fusion Custom Integration Tools have a stricter provider policy:

• Requests must use GET.
• Paths must be relative and begin with /fscmRestApi/resources/ or /crmRestApi/resources/.
• Requests are always sent to the configured tenant origin; the tool cannot choose another host.
• The program cannot read the OAuth client secret or access token.
• Write methods, action endpoints that require POST, HCM REST paths, SOAP, and arbitrary outbound requests are not supported.

For example, a custom tool can read a sales order using a fixed resource and a validated order number:

const response = await connection.http.request({
	method: "GET",
	path: "/fscmRestApi/resources/11.13.18.05/salesOrdersForOrderHub",
	query: {
		finder: "findByOrderNumber;OrderNumber=" + input.orderNumber,
		onlyData: true,
	},
});

For this example, constrain input.orderNumber in the published input schema, for example with pattern: "^[A-Za-z0-9._/-]{1,80}$". When broader string values are required, quote Oracle finder literals that contain separators or other special characters and escape embedded double quotes.

Keep the API version in the path aligned with the connection's configured API version. Keep the resource name, method, and finder in administrator-authored code; expose only the smallest validated input the agent must choose.

Roles And Data Security

Oracle evaluates both function security and data security for REST calls. The matching Fusion user therefore needs the appropriate read privileges or duty roles for each resource and data access for the relevant business units, ledgers, inventory organizations, or other security contexts.

This has two important consequences:

• A successful Test Connection can be followed by a 401 or 403 from a tool when the OAuth client is valid but its Fusion user lacks a required privilege.
• A successful tool call can return no records, or fewer records than expected, when the user's data-security assignments exclude the requested business unit or organization.

Use a dedicated integration user and least-privilege, read-only assignments. Ask the Oracle Fusion security administrator to validate access separately for Receivables, Order Management, and Inventory Management; access to one module does not imply access to the others. Oracle's Financials REST Quick Start describes the roles-and-privileges requirement, and the Sales Orders for Order Hub reference notes that business-unit data security can affect order access.

Troubleshooting

Test Connection cannot obtain a token

Confirm that both URLs use HTTPS, the token URL belongs to the tenant's identity domain, the confidential application is active, client authentication uses the Basic authorization header, and the configured scope exactly matches an authorized Fusion resource scope.

A tool returns 401 or 403

Confirm that the OAuth client ID exactly matches the Fusion Applications user name. Then verify the user's module-specific read privileges, duty roles, and data-security assignments.

A lookup returns no record

First verify the identifier: customer account or party number, customer transaction ID, order number, or delivery ID. Then check whether the record is inside a business unit or organization assigned to the Fusion user.

A resource path is rejected

Oracle Fusion Custom Integration Tools accept only relative GET paths under /fscmRestApi/resources/ and /crmRestApi/resources/. Use a built-in tool or another purpose-built integration for unsupported modules and write actions.

Oracle References

• Configure OAuth Using the Fusion Applications Identity Domain
• Oracle Fusion Cloud Financials REST API
• Receivables Customer Account Activities REST endpoints
• Receivables Invoices REST endpoints
• Oracle Fusion Cloud SCM REST API
• Sales Orders for Order Hub REST endpoints
• Shipments REST endpoints