Set up Oracle Fusion Cloud for Auditoria

Written by Uday Kumar Updated

1. Overview

Auditoria uses supplier, invoice, purchase order, and payment data from your Oracle Fusion Cloud ERP to respond to vendor inquiries such as payment status, PO status, and remittance requests. This guide describes the Oracle Fusion Cloud roles, data security grants, and Auditoria connection configuration required to set up the integration.

Setup involves four tasks. An Oracle Fusion administrator creates a dedicated integration user, assigns the required roles, and grants Business Unit data security. An Auditoria administrator then configures the connection in Auditoria and runs the initial sync.

Prerequisites

  • An Oracle Fusion Cloud ERP instance (SaaS)
  • An administrator account with access to the Security Console, to create users and assign roles
  • The list of Business Units to sync to Auditoria

2. Create the integration user

Create a dedicated integration user in Oracle Fusion for the Auditoria connection. Do not use a personal user account. The following table lists the fields to complete when you create the user, with example values.

Table 1. Integration user fields

Field Description Example value
Username The sign-in name of the integration user. Enter it in uppercase. AUDITORIA.AI
First Name The first name on the user account. Auditoria
Last Name The last name on the user account. AI
Display Name The name Oracle Fusion displays for the user. Auditoria AI Integration
Email The contact email address for the integration user. example@email.com

Note: Enter the username in uppercase. Oracle Fusion usernames are case-sensitive in some contexts.

Figure 1. Create the integration user (Add User Account)

3. Understand the two security layers

Oracle Fusion enforces two independent security layers. Both must be configured for the integration to retrieve data.

  1. Functional security (roles) grants the ability to read specific types of data.
  2. Data security (Business Unit grants) scopes which Business Units' data the integration user can access.

Critical: Without both layers configured, Oracle Fusion returns zero records to Auditoria. There is no error, just empty results.

4. Assign the required roles

Assign the following 3 roles to the integration user through the Oracle Fusion Security Console.

Table 2. Required Oracle Fusion roles

# Role display name Role code Description BU grant required
1 Accounts Payable Manager ORA_AP_ACCOUNTS_PAYABLE_MANAGER_JOB Provides access to supplier invoices and payments. Yes
2 Procurement Manager ORA_PO_PROCUREMENT_MANAGER_JOB Provides access to purchase orders. Yes
3 General Accountant ORA_GL_GENERAL_ACCOUNTANT_JOB Provides access to GL accounts, Chart of Accounts, and ledgers. No

To assign the roles

  1. Navigate to Tools > Security Console > Users.
  2. Search for the integration user.
  3. Click Edit, then select the Roles tab.
  4. Add each of the 3 roles listed above.
  5. Click Save and Close.

Figure 2. Assign the required roles to the integration user

5. What each role enables

Each role grants read access to a specific category of Oracle Fusion data. This section describes what the integration retrieves under each role and which roles need Business Unit grants.

1. Accounts Payable Manager

ORA_AP_ACCOUNTS_PAYABLE_MANAGER_JOB

Provides access to supplier invoices (headers, lines, distributions, holds) and supplier payments (payment records and their related invoices). This is a Financials role. Requires BU data grants for each Business Unit. Without them, zero invoices and payments are returned.

2. Procurement Manager

ORA_PO_PROCUREMENT_MANAGER_JOB

Provides access to purchase orders (headers, lines, schedules, distributions). This is a Procurement role. Requires BU data grants for each Business Unit.

3. General Accountant

ORA_GL_GENERAL_ACCOUNTANT_JOB

Provides access to financial reference data. Used for GL account display and validation in the Auditoria UI. No BU data grants needed. The following table lists the reference data this role provides.

Table 3. Financial reference data provided by the General Accountant role

Data Description
Chart of Accounts (COA) COA structure and segments (auto-discovered)
GL Account Combinations Account code combinations for distribution coding
Ledgers Ledger configuration and currency

6. Grant Business Unit data security

For the two roles that require BU-level data security, create a grant for each Business Unit you want to sync. The following table shows which roles need grants and what each grant controls.

Table 4. Roles requiring Business Unit grants

Role code Description
ORA_AP_ACCOUNTS_PAYABLE_MANAGER_JOB The grant controls which Business Units' invoices and payments are visible to the integration user.
ORA_PO_PROCUREMENT_MANAGER_JOB The grant controls which Business Units' purchase orders are visible to the integration user.

Grants are per role. Granting Business Units to the Accounts Payable Manager role does not automatically grant PO access. Grant the same Business Units to the Procurement Manager role separately. For example, an organization with 50 Business Units needs 100 total grants (50 BUs × 2 roles).

To assign BU data security

  1. Navigate to Tools > Security Console > Users.
  2. Search for the integration user.
  3. Click Edit, then select the Roles tab.
  4. For each role requiring BU grants, click the role and select Data Security.
  5. Add each Business Unit under Security Context: Business Unit.
  6. Repeat for both roles listed above.

Note: The Business Unit name in each grant must exactly match the Business Unit name in Oracle Fusion.

7. Create a custom abstract role

Section 4 assigns the three seeded job roles to the integration user individually. As an alternative, you can create a single custom abstract role that inherits those roles, assign that one role to the integration user, grant Business Unit data access, and run the synchronization process. This centralizes role management: you assign and maintain one role, and Oracle Fusion resolves the inherited access.

Note: Don't modify a predefined (seeded) role. Make a copy of the predefined role and edit the copy, or create a new custom role as described below.

Step 1. Create the custom abstract role

In Oracle Fusion, go to Tools > Security Console > Roles, then click Create Role to open the Create Role wizard. Complete the wizard steps as follows.

  1. Basic Information. Enter a Role Name and Role Code, set Role Category to Financials - Abstract Roles, leave Predefined Role unchecked, and optionally add a Description. (Example: Role Name Auditoria Integration, Role Code AUDITORIA_INTEGRATION.)

  2. Function Security Policies. No function security policies need to be added directly for this role. To review the policies it inherits, click Load Inherited Policies.

  3. Permission Groups. Optional. This step is available only after you click Enable Permission Groups on the Basic Information step. Skip it unless you use permission groups.

  4. Data Security Policies. No data security policies need to be added directly for this role. You can add one with Create Data Security Policy if required.

  5. Role Hierarchy. Click Add Role and add the three seeded roles from section 4 so the custom role inherits their access:

    • Accounts Payable Manager (ORA_AP_ACCOUNTS_PAYABLE_MANAGER_JOB)
    • General Accountant (ORA_GL_GENERAL_ACCOUNTANT_JOB)
    • Procurement Manager (ORA_PO_PROCUREMENT_MANAGER_JOB)

  6. Segregation of Duties. Click Analyze to check for role combinations that violate provisioning rules. If any conflicting pairs appear, adjust the role hierarchy to remove one role in each pair. No conflicts are expected for these three roles.

  7. Users. Optionally click Add User to assign the role to the integration user now, or assign it later from Tools > Security Console > Users.

  8. Summary. Review the added and removed items, then click Save and Close.

Step 2. Verify the role inherits the seeded roles

  1. Go to Tools > Security Console > Roles and search for the custom role by name.
  2. Set Expand Toward to Privileges and Show to Roles.
  3. Confirm the three seeded roles appear, each with Inherited by Role Name set to your custom role.

Step 3. Assign the role to the integration user

  1. Go to Tools > Security Console > Users and create the integration user (see section 2) or open the existing one. 
  2. In the Roles section, click Add Role, add your custom role (for example, Auditoria Integration) instead of the three individual roles from section 4, then click Save and Close.

Step 4. Grant Business Unit data access

Grant the integration user data access for the custom role, scoped to each Business Unit you sync, using the Manage Data Access for Users task.

  1. Open Manage Data Access for Users (from Setup and Maintenance).

  2. Select Users without Data Access and set Security Context to Business unit.

  3. In User Name, enter the integration user, then click Search. The results show the user with the custom role (for example, Auditoria Integration) and Security Context Business unit.

  4. Select the row and click Authorize Data Access, then set the Security Context Value to the Business Unit to grant.

  5. Repeat for each Business Unit you sync, then click Done.

Note: The Business Unit data access is granted to the integration user for the custom role, with Security Context set to Business unit. See section 6 for how Business Unit grants control which data is returned.

Step 5. Synchronize users and roles

  1. Run the synchronization process so Oracle Fusion propagates the new user, role, and grants. 

  2. Run the Run User and Roles Synchronization Process task (for example, from Setup: Financials > Initial Users), which submits the Retrieve Latest LDAP Changes scheduled process. Set Schedule to As soon as possible and click Submit. 

  3. A confirmation shows the submitted process ID.

You can also add or edit function and data security policies directly on the abstract role (wizard steps 2 and 4) to tailor the access it provides.

8. Configure the connection in Auditoria

After the Oracle Fusion side is configured, an Auditoria administrator adds the connection in Auditoria under Administration > System Settings. ERP and Mailbox connections are mandatory in Auditoria.

Figure 3. Add New Connection screen with Oracle Fusion ERP Settings

To configure the connection

  1. Navigate to Administration > System Settings. The Connected Systems screen opens.
  2. Click Add New Connection. The Add New Connection screen opens.
  3. Select ERP. The available ERP systems appear.
  4. Select Oracle Fusion. The ERP Settings section opens.
  5. Complete the connection fields. The fields are described in Table 5.
  6. Click Save.
  7. After the connection settings are complete, select the Business Units to sync under Business Units to sync. Auditoria fetches the available Business Units from Oracle Fusion.

For Basic Auth connections, complete the User ID and User Password fields with the integration user credentials. For OAuth 2.0 connections, complete the Client ID, Client Secret, Token URL, and Scope fields; OAuth requires a confidential application registered in Oracle Identity Cloud Service.

Table 5. ERP Settings fields for Oracle Fusion

Field Description Example value
Instance Name A name that identifies this Oracle Fusion connection in Auditoria Oracle Fusion Production
Host Name The URL of the Oracle Fusion Cloud instance Auditoria connects to {customer}.fa.oraclecloud.com
User ID The username of the Oracle Fusion integration user created in section 2 AUDITORIA.AI
User Password The password of the integration user, used to authenticate with Basic Auth ••••••
Client ID The client identifier of the confidential application registered in Oracle Identity Cloud Service, used to authenticate with OAuth 2.0 Generated when the confidential application is registered
Client Secret The client secret generated for the registered confidential application Generated when the confidential application is registered
Token URL The token endpoint URL Auditoria calls to obtain OAuth 2.0 access tokens Provided by your Oracle identity administrator
Scope The OAuth 2.0 scope that defines the access requested in the token Provided by your Oracle identity administrator
Business Units to sync The Business Units Auditoria syncs data for. Available after the connection settings are complete; Auditoria fetches the Business Units from Oracle Fusion. US Business Unit, EU Business Unit

Adding a Business Unit later: Add it in the connection settings, click Save, and run a sync. Auditoria creates the required records automatically.

9. What happens on first sync

When you save the connection and run the initial sync, Auditoria:

  1. Creates a record for each configured Business Unit.
  2. Fetches suppliers, including contacts, addresses, and sites.
  3. Fetches invoices, purchase orders, and payments for each configured Business Unit.
  4. Syncs reference data such as payment terms, tax classifications, and COA segments.
  5. Updates the last sync time.

After the initial sync completes, supplier, invoice, purchase order, and payment data appears in the Auditoria UI.

10. Data synced by Auditoria

Auditoria syncs two categories of data from Oracle Fusion: primary transaction records and supporting reference data. This section shows the overall data flow and describes each category.

Data flow

The following diagram shows how data flows from Oracle Fusion Cloud into the Auditoria platform, including the Oracle Fusion API endpoint each record type comes from and the protocol used.

Figure 4. Data flow from Oracle Fusion Cloud APIs to the Auditoria platform

Primary record types

Auditoria syncs the following transaction records from Oracle Fusion. Auditoria uses these records to respond to payment status, PO status, and remittance inquiries.

Table 6. Primary record types

Record type Description
Suppliers Supplier records with sites, contacts, and addresses
Supplier Invoices Invoice headers, lines, distributions, and holds
Purchase Orders PO headers, lines, schedules, and distributions
Supplier Payments Payment records and their related invoices

Dimension and reference data

These are synced automatically alongside the primary records. Reference data supports filtering, classification, and GL account display in Auditoria.

Table 7. Dimension and reference data

Data type Description
Payment Terms Standard and vendor-specific payment terms
Business Units Organizational units for data filtering
Tax Classifications Tax codes for invoice line classification
Legal Entities Company and organizational structure
COA Structure Chart of Accounts segments and combinations
Supplier Contacts Contact details per supplier (name, email, phone)

Note: If you wanted to edit any seeded roles then you can copy the role and their inherent policy and edit it accordingly.

11. Write invoices to Oracle Fusion (Write to SoR)

After an invoice is processed and approved in Auditoria, Write to SoR creates the invoice in Oracle Fusion. Line-level coding on the Auditoria invoice maps to Oracle GL accounts. When you trigger Write to SoR, you remain on the document details page while the write completes.

The status the invoice is created with in Oracle Fusion depends on your invoice write-back configuration in Auditoria. Auditoria can write the invoice in draft, validate it, and trigger it for approval. Oracle Fusion's tax engine runs when the invoice is created, so tax on the invoice total is calculated at creation.

If an invoice is missing required attributes, it must be re-validated by a user before it can proceed. Invoice attachments are written to Oracle Fusion together with the invoice.

12. What Auditoria enables with Oracle Fusion

With the integration configured, the following Auditoria capabilities are supported for Oracle Fusion Cloud Financials: invoice extraction with multi-language line description support, predictive coding that populates Oracle GL account fields, automatic invoice-to-vendor resolution against Oracle Fusion supplier records, PO matching with automatic population of header fields, approval workflows routed by Oracle Fusion Business Unit, document-level audit history covering user edits and system actions, and dashboard reporting that includes autonomous processing metrics.

13. Important notes

Role naming: the ORA_ prefix matters. Oracle Fusion has two versions of some roles, for example AP_ACCOUNTS_PAYABLE_MANAGER_JOB and ORA_AP_ACCOUNTS_PAYABLE_MANAGER_JOB. These are different roles. Use the exact role codes listed in section 4. Data security grants assigned to the wrong version do not enable the required access.

BU grants are per role. Granting Business Units to the Accounts Payable Manager role does not automatically grant PO access. Grant the same Business Units to the Procurement Manager role separately.

Supplier sync order. Suppliers sync before purchase orders. Auditoria handles this ordering automatically.

14. Verify the setup

Setup is complete when the initial sync finishes and data appears in the Auditoria UI for each configured Business Unit.

If the sync completes but no data appears, ask your Oracle Fusion administrator to check the following:

  1. The exact role codes from section 4 are assigned to the integration user.
  2. BU data security grants exist for both roles that require them.
  3. The Business Unit name in each grant exactly matches Oracle Fusion's BU name.