How to Add or Remove a User Role Using Oracle Fusion SCIM REST API with Postman

How to Add or Remove a User Role Using Oracle Fusion SCIM REST API with Postman

Introduction / Issue

In Oracle Fusion Applications, every user’s access is controlled by the roles assigned to them.
While the application UI (Security Console) allows an administrator to assign or remove roles
for a user, this manual process becomes slow and error-prone when roles need to be managed
for many users or when role assignment needs to be triggered from an external system,
script, or automated workflow.

This is where Oracle Fusion REST and SCIM APIs are useful. They allow us to add or remove
a role for a user directly through Postman or another REST client without manually performing
the role assignment through the Security Console.

Why We Need to Do This / Cause of the Issue

Manually assigning roles through the Security Console works well when only a few users
need to be managed. However, this approach does not scale efficiently when dealing with
larger numbers of users.

API-based role management becomes useful in scenarios such as:

  • Bulk onboarding or offboarding:
    Multiple employees may need the same role added or removed.
  • Third-party integrations:
    HR or identity-management systems may need to automatically trigger role changes.
  • Testing and demo environments:
    Roles may need to be provisioned and de-provisioned repeatedly.
  • Reducing manual errors:
    API-based processing avoids repetitive navigation through the Security Console.

To manage user roles programmatically, we mainly need two important pieces of information:

  • User GUID
  • Role GUID

Oracle Fusion SCIM APIs use these GUID values to identify the user and role before
performing the role assignment or removal.

How Do We Solve?

Step 1: Get the Person ID

If only the username is known, we can first verify that the user exists and retrieve
the user’s Person ID using the Oracle Fusion publicWorkers REST resource.

Method: GET

https://<your-instance>/hcmRestApi/resources/11.13.18.05/publicWorkers?q=Username='UserName'

The response returns worker information such as Person ID, Person Number,
First Name, Last Name and Display Name. This helps confirm that the correct
user has been identified before proceeding with the SCIM APIs.

Step 2: Get the User GUID

Next, use the SCIM Users endpoint, filtering by userName,
to retrieve the unique User GUID:

GET

https://<your-instance>/hcmRestApi/scim/Users?filter=userName eq "UserName"

Fig 2: Fetching the User GUID from the SCIM Users API.

The response contains an id field — this is the User GUID
we’ll need later.

Step 3: Get the Role GUID

Roles also need to be referenced by GUID rather than name.
You can list all roles first:

GET

https://<your-instance>/hcmRestApi/scim/Roles

Fig 3: Listing all roles and their GUIDs.

Authentication for these calls uses Basic Auth — the username
and password of an account with appropriate privileges, configured under the
Authorization tab in Postman.

Fig 4: Configuring Basic Auth credentials in Postman.

To narrow the search down to one specific role, filter by
displayName:

GET

https://<your-instance>/hcmRestApi/scim/Roles?filter=displayName eq "Employee"

Fig 5: Retrieving the Role GUID for a specific role (“Employee”).

Step 4: Add or Remove the Role

With both GUIDs in hand, send a PATCH request to the
specific role’s endpoint:

PATCH

https://<your-instance>/hcmRestApi/scim/Roles/{Role_GUID}

To add the role to the user, use the following request body: 

{
    "members": [
        {
            "value": "<User_GUID>",
            "operation": "ADD"
        }
    ]
}

Fig 6: PATCH request body adding a user (by GUID) to a role.

To remove the role instead, use the same body but set
“operation”: “Remove”. A successful call returns a
204 No Content response, confirming the role assignment
change was applied.

Example Test and Result

In our test, we used the “Employee” role and a test user.
After retrieving the Person ID via publicWorkers,
the User GUID via scim/Users, and the Role GUID via
scim/Roles, we sent a PATCH request to
scim/Roles/{Role_GUID} with the
ADD operation and the User GUID in the body.

Postman returned a 204 No Content response in a few seconds,
confirming the update was accepted.

To validate the result, we logged into Oracle Fusion and checked the user’s
Security Console record — the “Employee”
role now appeared in the user’s assigned roles list, confirming the API call
worked as expected.

Repeating the process with the Remove operation successfully
took the role away from the user.

Conclusion

Using Postman to call Oracle Fusion’s SCIM and REST APIs is a fast,
repeatable way to add or remove roles for a user without relying on
manual UI steps.

The key is understanding the two-GUID dependency — you need the
User GUID and the Role GUID before you
can make the PATCH call — and that operations are expressed simply as
ADD or Remove in the request body.

This approach is especially valuable for bulk role management,
automation, and integration scenarios where speed and consistency matter.

Recent Posts