{
  "schema": "aaes/capability-pack/1",
  "provider": "oracle",
  "version": "1.0.0",
  "description": "Read Oracle Fusion suppliers, payables invoices, and purchase orders; create payables invoices. Creation does not pay an invoice, but its unrestricted body can set writable validation-status fields.",
  "notes": "The endpoint host 'oracle-fusion.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's own Oracle Fusion pod host (the documented examples use the form servername.fa.us2.oraclecloud.com) before enabling, in every endpoint, in every resource locator and in every egress allowlist entry. The allowlist matches exactly, so endpoints and allowlist must be substituted together, and substitution is a required deployment step — the reserved host being allowlisted does not make an unsubstituted pack safe to enable.\n\nThe path version segment 11.13.18.05 is the version Oracle's REST references document for these resources; Oracle also accepts 'latest' in the version position, but this pack pins the documented version so the registration names what was reviewed. This pack registers only endpoints Oracle's REST API for Oracle Fusion Cloud Financials and REST API for Oracle Fusion Cloud Procurement document: the Suppliers List of Values collection read (suppliersLOV), the payables invoices collection read and invoice create, and the purchase orders collection read.\n\nThe supplier read registers the suppliersLOV list-of-values resource because that is the collection read Oracle's procurement reference documents in full; the Suppliers management resource with its create, update and child resources is deliberately not registered. All reads are collection reads only: single-record reads (GET /invoices/{invoicesUniqID}, GET /purchaseOrders/{purchaseOrdersUniqID}, GET /suppliersLOV/{SupplierId}) exist in the APIs and are deliberately not registered.\n\nDocumented exclusions, framed as what this pack does not register: invoice update (PATCH), invoice delete (DELETE /invoices/{invoicesUniqID}), invoice cancel (POST /invoices/action/cancelInvoice), prepayment apply/unapply and distribution generate/reverse actions, every child resource (invoiceLines, invoiceInstallments, attachments, descriptive flexfields), draft purchase orders and their actions, and every payments, payees and disbursement resource — nothing in this pack pays anyone, and a created invoice is a payables document subject to the pod's own validation and approval workflows, not a payment.\n\nOracle enforces the calling user's function and data security, so a capability works only if the integration user's roles permit the operation; the registration records the endpoint, not the pod's authorization decision.",
  "credential": {
    "secret_ref_id": "secret-ref-oracle-fusion-integration-user",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "Authorization",
    "note": "Credentials of an integration user on the customer's own Oracle Fusion pod, held in the client's own secret manager. Oracle's documented examples authenticate with HTTP Basic (curl -u username:password), and the stored material must be the complete Authorization header value (scheme included): 'Basic', one separating space, then the base64 of 'user:password' — 'Basic <base64>'.\n\nAn external deployment process provisions the integration user, rotates the password and stores the renewed header value; the executor injects the stored value verbatim and performs no credential lifecycle itself. customer_vault is the only generally-supported production custody model here — identity_federation and customer_broker are refused at startup and inline is lab-only.\n\nPasswords expire under the pod's password policy and the user can be locked or have its roles removed at any time, which revokes access; an expired or revoked value fails closed.\n\nLeast privilege: grant the integration user only the duty roles that make the registered capabilities work (supplier and purchase order inquiry, payables invoice inquiry and invoice entry) and nothing more — the same user must not be authorized for invoice cancellation, invoice deletion or any payments function this pack deliberately does not register.\n\nWhere the deployment prefers OAuth 2.0 against the pod's identity domain, the complete stored value becomes 'Bearer <token>' and token obtain/renew ownership sits with the external process: OAuth access tokens carry their own expiry (the token response's expires_in) and the external process must obtain a replacement before expiry and store the new complete header value; revoking the identity-domain OAuth client, disabling the user or removing its roles stops future token issuance but does not invalidate an already-issued token, which remains usable until it expires.\n\nReview rotation and role assignments before enabling.\n\nExecutor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack."
  },
  "capabilities": [
    {
      "capability_id": "oracle.suppliers.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "oracle-fusion.invalid"
      ],
      "endpoint": "https://oracle-fusion.invalid/fscmRestApi/resources/11.13.18.05/suppliersLOV",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-oracle-fusion-integration-user",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "oracle-fusion-suppliers",
      "description": "Read the Suppliers List of Values collection: supplier names, numbers, statuses, DUNS and tax registration numbers — supplier records can identify individual persons, so the read is classified as pii (personal data) (a deployment whose policy classifies supplier master data differently may change it). The registered path covers the collection read only — single-supplier reads, supplier sites and the Suppliers management resource are not registered by this pack.\n\nThe host is a reserved placeholder: substitute the customer's pod host before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "oracle.invoices.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "financial",
      "egress_allowlist": [
        "oracle-fusion.invalid"
      ],
      "endpoint": "https://oracle-fusion.invalid/fscmRestApi/resources/11.13.18.05/invoices",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-oracle-fusion-integration-user",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "oracle-fusion-invoices",
      "description": "Read the payables invoices collection: invoice headers with suppliers, amounts, currencies and payment terms, classified as financial data. The registered path covers the collection read only — single-invoice reads (GET /invoices/{invoicesUniqID}) and the child resources (invoiceLines, invoiceInstallments, attachments) are not registered by this pack.\n\nThe host is a reserved placeholder: substitute the customer's pod host before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "oracle.invoices.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "financial",
      "egress_allowlist": [
        "oracle-fusion.invalid"
      ],
      "endpoint": "https://oracle-fusion.invalid/fscmRestApi/resources/11.13.18.05/invoices",
      "method": "POST",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-oracle-fusion-integration-user",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "create"
      ],
      "resource_id": "oracle-fusion-invoices",
      "description": "Create one payables invoice through POST /invoices, at the create floor of R2. This creates a document subject to the pod's validation, holds, and approval workflows; it does not pay an invoice. This pack registers no invoice validation, approval, cancellation, deletion, or payment operation. Oracle documents validation and cancellation as separate POST actions (action/validateInvoice and action/cancelInvoice).\n\nThe create schema has no approval-status input: ApprovalStatus is read-only, and no attribute initiates validation or approval. Requester and RequesterId only feed the Invoice Approval Workflow's approver list.\n\nValidationStatus is different: it is writable and defaults to Not Validated on creation. The unrestricted request can carry a status value that the pod's validation process did not produce. The deployment must assess reliance on pod-side function security and audit for that input. Other writable attributes are limited only by the pod's security, not by this registration. Replace the reserved host with the customer's pod host before enabling.",
      "requires_review": true
    },
    {
      "capability_id": "oracle.purchaseorders.read",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "financial",
      "egress_allowlist": [
        "oracle-fusion.invalid"
      ],
      "endpoint": "https://oracle-fusion.invalid/fscmRestApi/resources/11.13.18.05/purchaseOrders",
      "method": "GET",
      "connector": "http",
      "custody": "customer_vault",
      "secret_ref_id": "secret-ref-oracle-fusion-integration-user",
      "inject": "header",
      "inject_name": "Authorization",
      "actions": [
        "read"
      ],
      "resource_id": "oracle-fusion-purchaseorders",
      "description": "Read the purchase orders collection documented in the REST API for Oracle Fusion Cloud Procurement: order headers with suppliers, buyers, amounts and currencies, classified as financial data. The registered path covers the collection read only — single-order reads, lines, schedules, distributions and the draft purchase orders resource are not registered by this pack.\n\nThe host is a reserved placeholder: substitute the customer's pod host before enabling.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "oracle-fusion-suppliers",
      "kind": "api",
      "locator": "https://oracle-fusion.invalid/fscmRestApi/resources/11.13.18.05/suppliersLOV",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    },
    {
      "resource_id": "oracle-fusion-invoices",
      "kind": "api",
      "locator": "https://oracle-fusion.invalid/fscmRestApi/resources/11.13.18.05/invoices",
      "data_class": "financial",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    },
    {
      "resource_id": "oracle-fusion-purchaseorders",
      "kind": "api",
      "locator": "https://oracle-fusion.invalid/fscmRestApi/resources/11.13.18.05/purchaseOrders",
      "data_class": "financial",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "library",
    "date": "2026-09-22",
    "sources": [
      "https://docs.oracle.com/en/cloud/saas/financials/26a/farfa/op-invoices-get.html (retrieved 2026-09-21)",
      "https://docs.oracle.com/en/cloud/saas/financials/25d/farfa/op-invoices-post.html (retrieved 2026-09-21)",
      "https://docs.oracle.com/en/cloud/saas/procurement/26c/fapra/op-purchaseorders-get.html (retrieved 2026-09-21)",
      "https://docs.oracle.com/en/cloud/saas/procurement/26c/fapra/op-supplierslov-get.html (retrieved 2026-09-21)",
      "https://docs.oracle.com/en/cloud/saas/financials/26c/farfa/op-paymentsexternalpayees-get.html (retrieved 2026-09-21)"
    ],
    "reviewer_id": "aaes-eng"
  }
}