1. Create a Module:

   • In Oracle APEX, navigate to SQL Workshop > RESTful Services and create a new module for your web service.

     

2. Create a Web Service Under the Module:

   • Define your web service within the module you created by adding the necessary templates, handlers, and configurations for the endpoints you want to expose.

     

3. Create a Role and Privilege:

   • To secure the web service, you need to create a role and privilege in Oracle APEX.

   • Define a Role: Go to SQL Workshop > RESTful Services > Roles and create a new role (e.g., empinfo-api-role).

     

   • Define a Privilege: Go to SQL Workshop > RESTful Services > Privileges and create a new privilege.

     

     • In the privilege configuration, select the newly created role and module we want to secure.

     • Save the privilege to enforce security for the specified module.

4. Create OAuth Client Credentials:

   • Now, create OAuth client credentials that are linked to the role and privilege created in the previous step.

   • Use the OAUTH.CREATE_CLIENT procedure from the OAUTH package with the required parameters.

   • Parameters for OAUTH.CREATE_CLIENT:

     • p_name: Unique name for the client (e.g., 'rob-api-client').

     • p_grant_type: Type of OAuth grant (e.g., 'client_credentials', 'authorization_code', or 'implicit').

     • p_owner: Owner of the client application (optional).

     • p_description: Description of the client, shown to the end user during approval (optional if using client credentials).

     • p_origins_allowed: Comma-separated list of allowed URL prefixes.

     • p_redirect_uri: URI for OAuth token or error redirects (required for non-client credentials flows).

     • p_support_email: Support email for end-user inquiries.

     • p_privilege_names: List of privileges the client is allowed to access.

     • p_token_duration, p_refresh_duration, p_code_duration: Optional durations (in seconds) for access, refresh, and authorization code tokens, respectively.

     • Note: Use a COMMIT statement after calling OAUTH.CREATE_CLIENT to ensure the changes are saved.

   • Example

    BEGIN
       oauth.create_client(
                          p_name => 'rob-api-client'
                        , p_grant_type => 'client_credentials'
                        , p_owner => 'ROB'
                        , p_description => 'Client credentials for the web service used HR app'
                        , p_support_email => 'support@rob.com'
                        , p_privilege_names => 'empinfo-api-priv'
       );

       COMMIT;
    END;

5. Grant Role to the OAuth Client:

   • Assign the role to the newly created OAuth client to give it the appropriate access.

   • Run the following PL/SQL block with the client name and associated role name:

    BEGIN
       oauth.grant_client_role(
                              p_client_name => 'rob-api-client'
                            , p_role_name => 'empinfo-api-role'
       );
       COMMIT;
    END;

6. Verify Client Credentials:

   • After creating and configuring the OAuth client, you can query the client credentials for verification.

   • Execute the following SQL query in Oracle APEX to view client details:

    SELECT
       id
     , name
     , auth_flow
     , response_type
     , client_id
     , client_secret
    FROM
       user_ords_clients
    WHERE
       name = 'CLIENT_NAME';

Steps to Test the Web Service in Postman

1. Open Postman:

   • Launch Postman and navigate to File > New > HTTP Request to create a new request.

2. Set Up the HTTP Request:

   • Request Method: Select the HTTP method for your request (e.g., GET).

   • URL: Enter the URL of your secured REST API. This should point to the specific endpoint you want to test.

3. Configure Authorization Settings:

   • Go to the Authorization tab within the request setup.

   • Type: Select OAuth 2.0 from the dropdown.

   • Add authorization data to: Choose Request Headers to include the OAuth token in the headers.

4. Configure and Use New Access Token:

   To authenticate with your REST web service, follow these steps to configure and use a new access token in Postman:

   1. Enter Token Details:

      • Token Name: Provide a name to identify this token in Postman.

      • Grant Type: Select Client Credentials.

      • Access Token URL: Enter the token endpoint URL in the following format:
        https://your-host/your-web-server/your-workspace/oauth/token
        Replace your-host, your-web-server, and your-workspace with the specific details of your APEX environment.

      • Client ID: Enter the Client ID generated earlier in Oracle APEX.

      • Client Secret: Enter the Client Secret generated earlier in Oracle APEX.

   2. Obtain and Apply the Access Token:

      • Click Get New Access Token to request a new token.

      • When prompted by Postman, click Proceed to confirm.

      • Once the token is retrieved, click Use Token to add it to your request headers automatically.

5. Send the Request:

   • Click Send to execute the request and call your REST API.

   • Review the response to ensure the web service is functioning as expected.

     

This process allows you to securely access and test your Oracle APEX web service in Postman. If the request is successful, the web service is properly secured and accessible via OAuth 2.0.