Create a role with a specific name. After the role is created, you can associate it with a privilege.

1. In the Roles page, click Create Role.
2. In the Role Name field, enter the name of the role to create.

   Show code: Select this option to view the PL/SQL code equivalent of the Create Role slider. You can copy and execute this PL/SQL code in the worksheet to perform the same action that occurs when you click Create in the Create Role slider.

3. Click Create.

   The new assigned role is displayed on the Roles page.

This section describes how to edit a role.

1. In the Roles page, for the specific role, click Actions and select Edit.
2. Enter the changes required and click Save.

   For a description of the fields, see Creating a Role.

This section describes how to delete a role.

1. In the Roles page, for the specific role, click Actions and select Delete.

   You are prompted to confirm.

2. Click Yes to delete.

This section describes how to view the privileges associated with a role.

In the Roles page, for the specific role, click Actions and select Details. The privilges assigned to the role are displayed.

This section describes how to create a privilege.

1. In the Privileges page, click Create Privilege.
2. Enter the following fields. The fields with an asterisk (*) are mandatory:
   • Label: Enter the name of the privilege in a way that it is easy to understand.
   • Name: Enter a unique name for the privilege.
   • Description: Enter a brief description of the purpose of the privilege.
   • Comments: Enter comments.
   • Roles: Enter one or more roles assigned to the privilege.
   • Protected Modules: Select the modules to protect.
   • Protected Resources: Instead of Protected Modules, use the Protect Resources tab to apply security based on a URI pattern.

   Show code: Select this option to view the PL/SQL code equivalent of the Create Privilege slider. You can copy and execute this PL/SQL code in the worksheet to perform the same action that occurs when you click Create in the Create Privilege slider.

3. Click Create.

   The new privilege is displayed on the Privileges page.

This section describes how to edit a privilege.

1. In the Privileges page, for the specific privilege, click Actions and select Edit.
2. Make the required changes and click Save.

   For a description of the fields, see Creating a Privilege.

This section describes how to delete a privilege.

1. In the Privileges page, for the specific privilege, click Actions and select Delete.
2. You are prompted to confirm. Click Yes.

Creates the OAuth Client and grants the required roles and privileges.

1. In the OAuth Clients page, select Create OAuth Client.
2. Enter the following fields. The fields with an asterisk (*) are mandatory:

   Client Definition tab

   • Grant type: Select the authorization grant type. The options are Client_Cred, Auth Code, or Implicit.

     For more information about these grant types, see OAuth Flows in Oracle REST Data Services Developer's Guide.

   • Name: Name of the client.
   • Description: Description of the purpose of the client.
   • Redirect URI: Enter the client-controlled URI to which redirect containing an OAuth access token or error will be sent.
   • Support URI: Enter the URI where end users can contact the client for support. Example: http:// www.myclientdomain.com/support/
   • Support Email: Enter the email where end users can contact the client for support.
   • Logo: Upload your logo in JPG, BMP or SVG file format. Ensure that the logo is less than 100 KB in size.
   • Roles: Select roles to be granted.
   • Allowed Origins: Add the list of URL prefixes.
   • Privileges: Select privileges that the client wants to access.

   Show code: Select this option to view the PL/SQL code equivalent of the Create OAuth Client panel. You can copy and execute this PL/SQL code in the worksheet to perform the same action that occurs when you click Create in the Create OAuth Client panel.

3. Click Create.

   The OAuth Client registered is displayed on the OAuth Clients page.

   A preview of the client secret is displayed. Secrets are applicable only for Client Credentials and OAuth Code grant types. Copy the secret value as this is the only instance when it is shown. If you forget the client secret, you can use the Rotate Secret action to change it. See Managing Secrets.

   The Client ID value represents the secret credential for the OAuth client. Click Show/Hide to see the values.

   Test the secured REST service endpoint using a REST client or the cURL command line tool.

This section describes how to edit an OAuth Client.

1. In the OAuth Clients page, for the specific client, click Actions and select Edit.
2. Edit the required fields and click Save.

   For a description of the fields, see Creating an OAuth Client.

This section describes how to delete an OAuth Client.

1. In the OAuth Clients page, for the specific client, click Actions and select Delete.
2. You are prompted to confirm. Click Yes.

This section describes how to export an OAuth Client.

1. In the OAuth Clients page, for the specific client, click Actions and select Export.
2. In the OAuth Client panel, click the Copy icon or Download to copy or download the OAuth Client information.

After a client secret is generated for an OAuth client, you can rotate or revoke the secret when required. The Rotate and Revoke options are available in the specific OAuth client's context menu.

This section describes how to create an OAuth Client using the Client Credential grant type.

1. In the OAuth Clients page, click Create OAuth Client.
2. Enter the following fields:
   • In the Grant type field, select CLIENT_CRED.

   • Enter Name, Description, Redirect URI, Support URI and Support Email for your OAuth Client.

   • In the Roles tab, add the created role (HR Admin).

   • In the Privileges tab, add the created privilege (Example.HR).

   • Click Create.

   The new OAuth Client card appears on the OAuth Clients page.

3. Using cURL, test the service endpoint without OAuth credentials.

   curl --location --request POST --header "Content-Type: application/json" 
   --data '{"DEPTNO": 55, "DEPTNAME": "Sales", "DEPTLOC": "Australia" }' 
   'http://xyz.us.comp.com:1234/ords/pdbdba/example/emp/'

   You see an error.

4. Test the endpoint with OAuth credentials:

   1. To get an access token, select Get Bearer Token from the context menu in the OAuth Client card.

      
      Description of the illustration example_oauth.png

      The OAuth Token dialog appears. Use Copy to Clipboard to copy the token.

      
      Description of the illustration bearer_token.png

   2. In cURL, use the bearer access token in the following statement to request the resource:

      curl -H "Content-Type: application/json" -H "Authorization: Bearer AMccwlnt99gm9kxDs_w1DA" --location --request POST --data 
      '{"DEPTNO": 55, "DEPTNAME": "Sales", "DEPTLOC": "Australia"}' 'http://xyz.us.comp.com:1234/ords/pdbdba/example/emp/'

   The output shows:

   {"deptno":55,"dname":"Sales","loc":"Australia","links":[{"rel":"collection",
   "href":"http://xyz.us.comp.com:1234/ords/pdbdba/example/emp/"}]}

5. In the SQL page, you can verify the new record that has been inserted in the DEPT table by using the following statement:

   SELECT * FROM DEPT;

This section describes how to create an OAuth Client using the Auth Code grant type.

1. In the OAuth Clients page, click Create OAuth Client.
2. Enter the following fields:
   • In the Grant type field, select Auth Code.

   • Enter Name, Description, Redirect URI, Support URI and Support Email for your OAuth Client.

   • In the Roles tab, add the relevant roles.

   • In the Privileges tab, add the relevant privileges.

   • Click Create.

   The new OAuth Client card appears on the OAuth Clients page.

3. In the OAuth Client card, click the Actions icon and select Auth Details.
   The Unique Value and Authorization URI appears.
4. In the Authorization URI field, click the Open in New Tab icon. A new window is displayed with an Unauthorized error message along with a Sign In link.
5. Click Sign in and enter your login credentials again.
6. You are prompted to approve the request to access the protected URI. Click Approve.