Rest API Client

Rest API Client

Purpose

Route Oracle Fusion REST, CPQ, Knowledge Management, Risk and Security, and Fusion BOSS REST API work to the correct OAuth-backed client script and instruction file without duplicating token-cache, request, retry, and response handling logic in consuming skills.

Routing

Use this skill whenever another router, shared, core, or pillar skill needs to call a Fusion REST endpoint.

Before invoking a script, read the routed instruction file in this skill folder.

Shared Configuration

All client scripts read the default Fusion environment properties file:

textCopy code
core/auth/fusionEnv.properties

All client scripts import OAuth helpers from:

textCopy code
core/auth/fusion-oauth-authentication/scripts/fusion_auth.py

Endpoints under /fscmUI/applcoreApi, including Flexfield deployment APIs, are standard Fusion REST routes. Authenticate them with the default Fusion scope and restBaseUrl properties; do not select a service-specific scope or token cache for them.

If the cached token is missing, expired, or rejected by Fusion with HTTP 401 or 403, the selected script invokes core.auth.fusion-oauth-authentication to obtain a fresh token, saves it to the requested cache, and retries the REST call once.

Inputs

• fusion_environment_context
• request_payload
• execution_options

Common script-level inputs:

• endpoint: Fusion REST resource path or absolute URL.
• --method: GET, POST, PUT, PATCH, or DELETE.
• --query: repeated query parameters as key=value.
• --header: repeated extra headers as Name=value or Name: value.
• --body or --body-file: JSON request body for write operations.
• --output: optional response output file.
• --token-cache: optional external private cache override; the default auto resolves to ~/.fusionaim/<profile-fingerprint>_token.json; checkout paths fail.
• --scim-only: provisioning mode; requires the standard service and relative /hcmRestApi/scim/Users or /hcmRestApi/scim/Roles collection/resource paths. Password fields, alternate origins and write redirects are rejected.
• --force-login, --auth-code, --redirect-url, and browser flags passed to the shared OAuth flow when login is required.

Outputs

• execution_result
• diagnostics
• audit_summary

Script-level outputs:

• Pretty-printed JSON response to stdout by default, or raw response bytes when --output is supplied.
• HTTP status when writing to a file.
• Token-cache refresh status without printing access tokens.

Implementation Notes

Never print access tokens, refresh tokens, client secrets, token-cache contents, or Authorization headers.

Only send credentials or bearer tokens to the single HTTPS origin selected for the active service in core/auth/fusionEnv.properties. Reject other absolute endpoints before obtaining a token, and reject redirects to a different origin, including other configured service origins. Fusion Common endpoints require --service fusion-common, fusion_common_scope, and their separate token cache.

Consumers that must pin a token to one approved service origin, including FSM Set Optin, use scripts/trusted_http.py. Supply approved_origin from the trusted environment profile, independently of request URLs or overrides. This transport validates HTTPS scheme, hostname, and effective port on the initial request and every redirect. Only same-origin GET/HEAD redirects are followed; write redirects fail without replay. It never obtains or refreshes tokens. The multi-service REST CLI routes use fusion_auth.py to bind requests to the selected service origin and OAuth scope.

For mutating methods such as POST, PUT, PATCH, and DELETE, consuming skills must capture the request purpose, target environment, endpoint, and any Fusion job or process identifiers returned by Fusion in their own audit output.