--- title: ORDS, OAuth2 & Web Services in APEX – Part 2 description: Protecting Web Services with OAuth2 In my previous blog, I took you through how to create RESTful Web Services with ORDS and how to test them with a REST client. image: https://content.dsp.co.uk/hubfs/Imported_Blog_Media/access_token_c1.jpg --- [![DSP From Ground to Cloud](https://content.dsp.co.uk/hubfs/Logos/DSP%20From%20Ground%20to%20Cloud/DSP-Logo-Colour-From-Ground-to-Cloud.svg "DSP From Ground to Cloud")](https://dsp.co.uk) [![DSP From Ground to Cloud](https://content.dsp.co.uk/hs-fs/hubfs/2023/Logos/DSP/DSP-Logo-2019-White-600px.png?width=70&height=72&name=DSP-Logo-2019-White-600px.png "DSP From Ground to Cloud")](https://dsp.co.uk) - Services - Consulting Services - [Oracle](https://www.dsp.co.uk/oracle-consultancy) - [Microsoft](https://www.dsp.co.uk/sql-server-consultancy) - [Google](https://www.dsp.co.uk/google-cloud-consultancy) - [Architecture](https://www.dsp.co.uk/solution-design-and-architecture) - Managed Services - [Oracle Managed Services](https://www.dsp.co.uk/oracle-managed-services) - [SQL Server Managed Services](https://www.dsp.co.uk/sql-server-managed-services) - [OCI Managed Services](https://www.dsp.co.uk/oracle-cloud-infrastructure-managed-services) - [Azure Managed Services](https://www.dsp.co.uk/azure-managed-services) - [On Premise Apps Managed Services](https://www.dsp.co.uk/application-managed-services) - [Cloud Apps Managed Services](https://www.dsp.co.uk/oracle-cloud-applications-services) - Licensing and SAM - [Oracle Licensing](https://www.dsp.co.uk/oracle-licensing-services) - [Software Asset Management](https://www.dsp.co.uk/oracle-software-asset-management-sam) - Application Services - [Application Development](https://www.dsp.co.uk/software-development) - [Application Modernisation](https://www.dsp.co.uk/legacy-software-modernisation) - [Oracle Forms to Oracle APEX](https://www.dsp.co.uk/oracle-forms-to-oracle-apex) - [Application Extensions](https://www.dsp.co.uk/software-customisation) - [Archiving Solutions](https://www.dsp.co.uk/application-archiving-solution) - [Application Hosting](https://www.dsp.co.uk/oracle-apex-hosting-services) - [Development Training](https://www.dsp.co.uk/oracle-apex-training) - Data Science - [AI Strategy](https://www.dsp.co.uk/ai-strategy) - [Responsible AI and Governance](https://www.dsp.co.uk/responsible-ai) - [Agentic AI](https://www.dsp.co.uk/agentic-ai) - [Data Management for AI](https://www.dsp.co.uk/data-management) - [Power BI](https://www.dsp.co.uk/power-bi-services) - [Microsoft Fabric](https://www.dsp.co.uk/microsoft-fabric-services) - [Machine Learning](https://www.dsp.co.uk/oci-machine-learning) - Cloud Migration and Management - [Cloud Readiness and Design](https://www.dsp.co.uk/oracle-cloud-readiness-assessment) - [Migration to Fusion and Cloud Applications](https://www.dsp.co.uk/oracle-cloud-application-modernisation) - [Migration to Cloud Infrastructure](https://www.dsp.co.uk/oracle-cloud-migration) - [Private Cloud](https://www.dsp.co.uk/oracle-private-cloud-services) - [Database@ Hyperscaler](https://www.dsp.co.uk/multicloud-management) - [FinOps and Optimisation](https://www.dsp.co.uk/optimise-oracle-cloud-infrastructure) - Integration and APIs - [API Management](https://www.dsp.co.uk/api-development-services) - [GoldenGate](https://www.dsp.co.uk/oracle-goldengate-services) - Disaster Recovery and Security - [Disaster Recovery](https://www.dsp.co.uk/oracle-database-disaster-recovery-solutions) - [Security Compliance](https://www.dsp.co.uk/data-security) - [Cloud Security](https://www.dsp.co.uk/cloud-security)   ![Oracle Partner, Microsoft Partner and Google Partner](https://content.dsp.co.uk/hubfs/logo-2021/Partner-logos/multiple-vendor/rectangle-2022/Partner-logos-rectangle-Nov21.svg) #### Getting to know us - [About us](https://www.dsp.co.uk/about) - [What we do](https://www.dsp.co.uk/what-we-do) - [Leadership](https://www.dsp.co.uk/dsp-product-leads) - [Careers](https://www.dsp.co.uk/careers) - Technologies - Oracle Cloud Infrastructure - [Oracle Cloud Infrastructure](https://www.dsp.co.uk/oracle-cloud-infrastructure-services) - [IaaS](https://www.dsp.co.uk/iaas) - [PaaS](https://www.dsp.co.uk/paas-security) - Oracle Database - [Oracle Database](https://www.dsp.co.uk/oracle-database-consulting) - [Autonomous Database](https://www.dsp.co.uk/oracle-autonomous-database-services) - [MySQL and Heatwave](https://www.dsp.co.uk/mysql-services) - [Oracle APEX](https://www.dsp.co.uk/oracle-apex-services) - Oracle Engineered Systems - [Oracle Exadata](https://www.dsp.co.uk/exadata-database-service-consultancy) - [Oracle Database Appliance](https://www.dsp.co.uk/oracle-database-appliance) - Oracle Applications - [Oracle Fusion and Cloud Applications](https://www.dsp.co.uk/oracle-fusion-services) - [Oracle E-Business Suite](https://www.dsp.co.uk/oracle-ebs-services) - [JD Edwards](https://www.dsp.co.uk/jd-edwards-services) - [Peoplesoft](https://www.dsp.co.uk/oracle-peoplesoft-services) - [Hyperion](https://www.dsp.co.uk/oracle-hyperion-services) - Microsoft - [SQL Server](https://www.dsp.co.uk/sql-server-consultancy) - [Microsoft Azure](https://www.dsp.co.uk/microsoft-azure-services) - [Power BI](https://www.dsp.co.uk/power-bi-services) - [Microsoft Fabric](https://www.dsp.co.uk/microsoft-fabric-services) - Google - [Google Cloud Platform (GCP)](https://www.dsp.co.uk/google-cloud-partner) - Multicloud and Database Hyperscaler - [Oracle Database@Azure](https://www.dsp.co.uk/oracle-databaseazure-partner) - [Oracle Database@GCP](https://www.dsp.co.uk/google-cloud-machine-learning) - [Oracle Database@AWS](https://www.dsp.co.uk/amazon-web-services-aws) - [Oracle Azure Interconnect](https://www.dsp.co.uk/oracle-microsoft-multicloud) - Open Source Database - [PostgreSQL](https://www.dsp.co.uk/postgresql-services) - [MySQL](https://www.dsp.co.uk/mysql-services) - [MariaDB](https://www.dsp.co.uk/migration-from-mariadb-to-mysql) #### Managed Services - [Oracle Database](https://www.dsp.co.uk/oracle-managed-services) - [SQL Server](https://www.dsp.co.uk/sql-server-managed-services) - [MySQL](https://www.dsp.co.uk/mysql-support) #### Application Services - [Oracle Applications](https://www.dsp.co.uk/oracle-application-cloud-migration) - [Oracle APEX](https://www.dsp.co.uk/oracle-apex-services) - [Microsoft](https://www.dsp.co.uk/microsoft-partnership) - [ISV Services](https://www.dsp.co.uk/isv-support-and-services) #### Cloud Services - [Oracle Cloud Infrastructure](https://www.dsp.co.uk/oracle-cloud-services) - [Microsoft Azure](https://www.dsp.co.uk/microsoft-azure-services) - [Google Cloud Platform](https://www.dsp.co.uk/gcp-database) - [Multi-cloud](https://www.dsp.co.uk/oracle-microsoft-multicloud) #### Data Science - [Machine Learning](https://www.dsp.co.uk/machine-learning-consulting-services) - [Business Intelligence](https://www.dsp.co.uk/business-intelligence-services) - [Artificial Intelligence](https://www.dsp.co.uk/artificial-intelligence-consulting-services) #### Consulting Services - [Oracle](https://www.dsp.co.uk/oracle-consultancy) - [Microsoft](https://www.dsp.co.uk/sql-server-consultancy) - [Google](https://www.dsp.co.uk/google-cloud-consultancy) - [Cloud Migration](https://www.dsp.co.uk/cloud-migrations) #### Technology Solutions - [Engineered Systems](https://www.dsp.co.uk/oracle-engineered-systems-partner) - [Data Security](https://www.dsp.co.uk/data-security) - [Database Architecture](https://www.dsp.co.uk/solution-design-and-architecture) - [Disaster Recovery](https://www.dsp.co.uk/database-disaster-recovery) - Industries - [Finance](https://www.dsp.co.uk/finance) - [Healthcare](https://www.dsp.co.uk/healthcare-it-services) - [Travel and Transport](https://www.dsp.co.uk/database-solutions-for-travel-and-transport) - [Higher Education](https://www.dsp.co.uk/higher-education) - [Public Sector](https://www.dsp.co.uk/public-sector) - [Manufacturing](https://www.dsp.co.uk/manufacturing) - [Retail](https://www.dsp.co.uk/retail) - [Software Vendors](https://www.dsp.co.uk/isv-support-and-services) ### Recent case study: #### Oracle EBS Cloud Deployment Consolidating and Migrating assets into Oracle Cloud Infrastructure. [**![Oracle EBS Cloud Deployment](https://content.dsp.co.uk/hs-fs/hubfs/stonewater-logo%20(1).png?width=250&name=stonewater-logo%20(1).png)**](https://www.dsp.co.uk/stonewater)   #### Most Visited Pages - [Oracle Licensing](https://www.dsp.co.uk/oracle-licensing) - [Oracle Cloud Calculator](https://www.oracle-cloud-calculator.com/) - [Oracle Cloud Migration](https://www.dsp.co.uk/oracle-cloud-migration) - [Oracle Exadata Services](https://www.dsp.co.uk/oracle-exadata-services) - [Artificial Intelligence Services](https://www.dsp.co.uk/artificial-intelligence-consulting-services) #### - - [SQL Server Support](https://www.dsp.co.uk/sql-server-support) - [Oracle Support](https://www.dsp.co.uk/oracle-support) - [Google Cloud Consultancy](https://www.dsp.co.uk/google-cloud-consultancy) - [New Application Development](https://www.dsp.co.uk/oracle-apex-services) - [Azure Virtual Desktop](https://www.dsp.co.uk/azure-virtual-desktop) - Resources - [Gartner ](https://www.dsp.co.uk/complimentary-gartner-download) - [ISG](https://www.dsp.co.uk/isg-oracle-report) - [Blogs](https://www.dsp.co.uk/blogs) - [Case Studies](https://www.dsp.co.uk/case-studies) - [Testimonials](https://www.dsp.co.uk/testimonials) - [Events](https://www.dsp.co.uk/events) - [Webinars](https://www.dsp.co.uk/webinars) - [Insights](https://www.dsp.co.uk/insights) - [Technical Resources](https://www.dsp.co.uk/technical-resources) ### DSP-Explorer acquires leading Oracle Applications Managed Services Provider, Claremont, to further extend its data management capabilities.   [![Read More](https://no-cache.hubspot.com/cta/default/3321273/c7e13c9c-65e1-46e7-8541-8da86a4fc305.png)](https://cta-redirect.hubspot.com/cta/redirect/3321273/c7e13c9c-65e1-46e7-8541-8da86a4fc305) #### Resources - [Blogs](https://www.dsp.co.uk/blogs) - [Webinars](https://www.dsp.co.uk/webinars) - [Case Studies](https://www.dsp.co.uk/case-studies) - [Testimonials](https://www.dsp.co.uk/testimonials) - About - [About DSP](https://www.dsp.co.uk/about) - [What We Do](https://www.dsp.co.uk/what-we-do) - [DSP Group Board ](https://www.dsp.co.uk/dsp-group-board) - [Careers](https://www.dsp.co.uk/careers) - [Project Harar](https://www.dsp.co.uk/project-harar) - [Customer Area](https://www.dsp.co.uk/contact-us) - [Customer Support Portal](https://dspgroup-ism.ivanticloud.com/) - [Customer Resources](https://www.dsp.co.uk/welcome) - [Contact us](https://www.dsp.co.uk/contact-us) # ORDS, OAuth2 & Web Services in APEX – Part 2 [ Colin Archer ](https://content.dsp.co.uk/author/colin-archer) 13-Nov-2017 12:05:31 ### Contents [11-Jan-2018 10:34:01 ORDS, OAuth2 & Web Services in APEX – Part 3 ](https://content.dsp.co.uk/ordsoauth2-web-services-in-apex-part-3) [30-Oct-2017 10:08:26 ORDS,OAuth2 & Web Services in APEX – Part 1 ](https://content.dsp.co.uk/web-services-part-1) [11-Apr-2018 12:23:17 New REST features of 18.1 (Early Adopter 2) ](https://content.dsp.co.uk/apex-new-rest-features) In my [previous blog](https://content.dsp.co.uk/apex/web-services-part-1), I took you through how to create RESTful Web Services with ORDS and how to test them with a REST client. This blog will build on those Web Services (Fig.1) and show you how you can protect them to ensure they can only be accessed by the users you specify. Before you read on, you can find out more about our [Oracle APEX Services here](https://www.dsp.co.uk/oracle-apex-services). | **Handler** | **Method** | **URL** | | --- | --- | --- | | List departments | GET | http://:/ords/api/hr/v1/departments | | Create a Department | POST | http://:/ords/api/hr/v1/departments | | Create a Department | PUT | http://:/ords/api/hr/v1/departments | | Delete a Department | DELETE | http://:/ords/api/hr/v1/departments | | List employees | GET | http://:/ords/api/hr/v1/employees | *Fig. 1* To ensure your Web Services are only accessible by the appropriate users (clients) you can protect them using OAuth2. This involves creating roles and privileges to protect the Web Services and the creation of clients, which can be for individuals or applications. Each client can then be granted access to one or more roles in order to access the associated Web Services. ### **ORDS Metadata** There are several public views owned by the ORDS_METADATA schema that you can use to query roles, privileges, and clients that have been created. The following six views are the primary ones to use. | **View** | **Contents** | | --- | --- | | USER_ORDS_ROLES | All Roles | | USER_ORDS_PRIVILEGES | All Privileges | | USER_ORDS_PRIVILEGE_MAPPINGS | Web Service URLs protected by each privilege | | USER_ORDS_PRIVILEGE_ROLES | Privileges granted to each role | | USER_ORDS_CLIENTS | All Clients | | USER_ORDS_CLIENT_ROLES | Roles granted to each client | ### **OAuth Methods ** There are three OAuth2 methods available to ORDS. 1. Client Credentials – Two stage process for server-to-server communication where there is no human interaction. Credentials are used to generate an access token that are then used to authenticate the Web Service calls. 2. Authorisation Code – Three-stage process when there is human interaction. Using a browser and a URL the user enters their credentials to authenticate. This generates an Authorization Code that in turn is used to generate the access token for authenticating the Web Service calls. 3. Implicit – Two-stage process when there is human interaction. Using a browser and a URL the user enters their credentials to authenticate. This generates an Access Token for authenticating the Web Service calls. On this occasion we are going to use the Client Credentials method to protect the Employees / Department Web Services we previously created. This is so in part three of the blog we can automate the authentication and calling of the Web Services from an APEX application. ### **Test our existing Web Services** As we did in part one we will be using Postman to test the Web Services. Before we start protecting them we should test they are all working correctly and do not require any authentication. Using Postman, open your ORDS Demo collection and test each of the five previously saved requests are working correctly. For example, click on the ‘List Departments’ GET method request and press send to return all of the departments in JSON format. ### **Roles and Privileges** Projecting a Web Service is a three-part process. 1. 1. Create the ORDS roles that will be granted to the clients 2. Create the privileges that will protect the Web Services and link to one or more roles 3. Map the privileges on to the required URL patterns ### **Create Role** To protect the Web Services we first need to create roles, which can be subsequently granted to a client and allocated to a privilege. To give greater flexibility when granting roles to clients we will protect each module independent, starting with Departments. ``` BEGIN   ords.create_role(p_role_name => 'department_role');   COMMIT; END; ``` ### **Create Privilege** Next, we need to define the privileges and link them to the relevant roles so that when we grant a role to a client they will obtain the required privilege. ``` DECLARE   la_roles owa.vc_arr; BEGIN   la_roles(1) := 'department_role';   ords.define_privilege(p_privilege_name => 'department.privilege',                         p_roles          => la_roles,                         p_label          => 'Departments Access',                         p_description    => 'Access to HR Department Web Services');   COMMIT; END; ``` When defining a privilege you can allocate multiple roles depending on how you need to structure your security. In our example we have created one privilege for the department Web Service and linked it to a single role. ### **Create Privilege Mapping** The last step of the process is to map the URL patterns of the Web Services we wish to protect to the privilege. ``` DECLARE la_priv_patterns owa.vc_arr; BEGIN la_priv_patterns(1) := '/hr/v1/departments'; ords.create_privilege_mapping(p_privilege_name => 'department.privilege', p_patterns => la_priv_patterns);  COMMIT; END; ``` As all four of the Web Services for the Departments template use the same URL, we only need to add one URL pattern to protect them all. If we had more than one template within the HR module that we need protecting by the department privilege we could add additional URLs here. If we wanted to protect one or more of the Department Web Services independently so a client could have access to the GET method without having access to the POST, PUT or DELETE methods, we would have to define the GET template with a different pattern (e.g. list_departments). As soon as a privilege has been mapped to a pattern, and Web Services matching it will be protected immediately. To check all four of the department Web Services are now protected use your collection of Postman requests to test each one. Each request will now return a 401 unauthorised status when called as shown in Fig.2. [![ORDS, OAuth2 & Web Services](https://content.dsp.co.uk/hs-fs/hubfs/Imported_Blog_Media/fig2_postman_401.jpg?width=1194&name=fig2_postman_401.jpg)](https://content.dsp.co.uk/hubfs/Imported_Blog_Media/fig2_postman_401.jpg) *Fig. 2* Next, check the Employees module has not been protected and can still be accessed. Open the List Employees request and set the department_number parameter value to 10. The request will be successful, returning the employees and a status of 200 OK (Fig.3). [![ORDS, OAuth2 & Web Services](https://content.dsp.co.uk/hs-fs/hubfs/Imported_Blog_Media/fig3_postman_400.jpg?width=1304&name=fig3_postman_400.jpg)](https://content.dsp.co.uk/hubfs/Imported_Blog_Media/fig3_postman_400.jpg) *Fig. 3* To complete the protection of our Web Services run the following PL/SQL to create a second role and privilege to protect the Employees module.   ``` DECLARE   la_roles         owa.vc_arr;   la_priv_patterns owa.vc_arr; BEGIN   ords.create_role(p_role_name => 'employee_role');   la_roles(1)         := 'employee_role';   la_priv_patterns(1) := '/hr/v1/employees';   ords.define_privilege(p_privilege_name => 'employee.privilege',                         p_roles          => la_roles,                         p_patterns       => la_priv_patterns,                         p_label          => 'Employees Access',                         p_description    => 'Access to Employee Resources');   COMMIT; END; ``` The Employees Web Service is not protect and cannot be accessed without authenticating the request call. ### **Creating a Client** To access the protected Web Services we now need to pass a valid access token as a parameter in the HTTP Header. In order to generate an access token we need to create a client using the OAUTH API. ``` BEGIN   oauth.create_client(p_name => 'Client 1',                       p_grant_type       => 'client_credentials',                       p_description      => 'Client with access to Employee Resources',                       p_support_email    => 'client.one@ordsdemo.com',                       p_privilege_names  => NULL);   COMMIT; END; ``` The above example uses the create_client procedure to create a client called ‘Client 1’. The ‘p_privelage_names’ parameter is mandatory but can be set to NULL. Alternately, you can pass a comma-separated list of privilege names the client requires access to. When you create a new client it is allocated a unique client id and secret that is subsequently used to generate an access token. Use the following SQL query to verify the client has been created and the values for the client id and secret. ``` SELECT id, name, description, client_id, client_secret FROM user_ords_clients WHERE name = 'Client 1'; ``` | ID | NAME | DESCRIPTION | CLIENT_ID | CLIENT_SECRET | | --- | --- | --- | --- | --- | | 10393 | Client 1 | Client with access to Employee Resources | kyP5X83FXv2uPvDPDSjspw.. | dXhW3IPuabH0Bsp-5d_8fA.. | Once the client has been created, we need to grant one or more roles that are mapped to the privileges the client requires to. In this instance, the client only needs the ‘employee_role’. ``` BEGIN   oauth.grant_client_role(p_client_name => 'Client 1',                           p_role_name   => 'employee_role');   COMMIT; END; ``` We have now created a client and granted it the necessary role to call the Employees GET method Web, and can now use the generated client id / secret to obtain an access token. ### **Testing the Employees Web Service with a OAuth2.0** Open Postman and open the List Employees GET request and press send to confirm the Web Service is protected. We receive a 401 unauthorised status as expected, as we have not authenticated the request call by including a valid access token in the HTTP header. To generate an access token we must use the client id and secret details we generated for ‘Client 1’. Within Postman click on the Authorization tab, change the type to ‘OAuth 2.0’, click the ‘Get New Access Token’ button and enter the following details. | Token Name | Anything, e.g. Client 1 | | --- | --- | | Access Token URL | http:///ords/ordsdemo/oauth/token | | Client ID | Client ID generated for Client 1 | | Client Secret | Client secret generated for Client 1 | | Grant Type | Client Credentials | | Request access token locally | Un-ticked | **Note:** The must be set to the relevant name and port of your ORDS configuration. I have created the Web Services in a local copy of Oracle XE running on port 8081 with ORDS 3.11. Therefore, the access token URL will be http://localhost:8081/ords/api/oauth/token [![ORDS, OAuth2 & Web Services](https://content.dsp.co.uk/hs-fs/hubfs/Imported_Blog_Media/access_token_c1.jpg?width=460&name=access_token_c1.jpg)](https://content.dsp.co.uk/hubfs/Imported_Blog_Media/access_token_c1.jpg) Once you have entered all of the details press the ‘Request Token’ button. This will close the popup and generate an access token with a one-hour expiration time. We now need to add the access token to the Employees request. This can be achieved using the following steps. 1. Click on the newly generated token, which can be found in the ‘Existing Tokens’ list. 2. Ensure the ‘Access token to’ selection is set to ‘Header’. 3. Click on the use token button. If you now select the Headers tab you will see a new Authorization key value has been created and the value set to the access token. Now when we press the Send button the request is authenticated and the employees are returned along with the response status 200 – OK. The Web Service currently uses an optional URI parameter to restrict the employees to a single department. Use the following PL/SQL to update the parameter so that it is passed using the HTTP Header instead. ``` BEGIN   ords.define_parameter(p_module_name        => 'reports.v1',                         p_pattern            => 'employees.json',                         p_method             => 'GET',                         p_name               => 'department_number',                         p_bind_variable_name => 'pn_deptno',                         p_source_type        => 'HEADER',                         p_param_type         => 'INT',                         p_access_method      => 'IN',                         p_comments           => 'Used to restrict the employees to a single department');    COMMIT; END; ``` Now add a new key to the header with the name ‘department_number’ and a value of 10. Press the Send button to resubmit the request. Only the employees for the Accounting department are returned. ### **Testing the Add Department POST Web Service with a OAuth2.0** Open the Add Department request and click on the Headers tab. Now set the values for the department number, name and location to values that are valid and unique. Next click on the Authorization tab and change the type to OAuth 2.0 to display the list of existing tokens. Select the previously generated Client 1 token and use the Use Token button to add it to the HTTP Header and press Send. We get a 401 – Unauthorised response as the access token is for a client that has not been granted the required role to use Departments POST method Web Service. Use the following PL/SQL to create a new client with the required role.** ** ``` BEGIN   oauth.create_client(p_name            => 'Client 2',                       p_grant_type      => 'client_credentials',                       p_description     => 'Client with access Department Resources',                       p_support_email   => 'client.two@ordsdemo.com',                       p_privilege_names => NULL);   oauth.grant_client_role(p_client_name => 'Client 2',                           p_role_name   => 'department_role');   COMMIT; END; ``` Query the user_ords_clients view obtain the client id and secret for Client 2 and then use them to generate a new access token via the ‘Get New Access Token’ popup. Select the new token and press the Use Token button to add it to the header. Now when we press the Send button the request is successful and returns a response code of 200 OK status. To check the department has been added use the List Departments request to call the Departments GET method Web Service. Remember to use the access token generated for Client 2 by adding it to the HTTP Header before pressing send. The request will be successful and return all of the departments including the new one you just added. Use the access token to test Client 2 can also call the Departments PUT method to update a department and the DELETE to delete one. If you would like to find out more information speak to one of our [Oracle APEX](https://www.dsp.co.uk/oracle-apex-services) experts, get in touch through [enquiries@dsp.co.uk](mailto:enquiries@dsp.co.uk) or book a meeting... [![Book a Meeting](https://no-cache.hubspot.com/cta/default/3321273/3414edc1-fbe5-40fe-9b35-42e662d82b55.png)](https://cta-redirect.hubspot.com/cta/redirect/3321273/3414edc1-fbe5-40fe-9b35-42e662d82b55) If you liked this blog, check out our other [APEX blogs here](https://content.dsp.co.uk/apex). ---   **Author**: [Colin Archer ](https://content.dsp.co.uk/apex/author/colin-archer) **Job Title**: Senior Oracle APEX Development Consultant **Bio**: Colin is a Senior Development Consultant at DSP with 20 years’ experience of analysis, design, and development of bespoke Oracle applications for a wide variety of business functions. Building on his previous experience of Forms and PL/SQL he is now focusing on developing high quality fit for purpose solutions using APEX.   ---   [OAuth2](https://content.dsp.co.uk/topic/oauth2) [ORDS](https://content.dsp.co.uk/topic/ords) [How to](https://content.dsp.co.uk/topic/how-to) [RESTful](https://content.dsp.co.uk/topic/restful) [APEX](https://content.dsp.co.uk/topic/apex) [11-Jan-2018 10:34:01 ORDS, OAuth2 & Web Services in APEX – Part 3 ](https://content.dsp.co.uk/ordsoauth2-web-services-in-apex-part-3) [30-Oct-2017 10:08:26 ORDS,OAuth2 & Web Services in APEX – Part 1 ](https://content.dsp.co.uk/web-services-part-1) [11-Apr-2018 12:23:17 New REST features of 18.1 (Early Adopter 2) ](https://content.dsp.co.uk/apex-new-rest-features) [Previous Why invest in Exadata ](https://content.dsp.co.uk/why-invest-in-exadata) [Next "Self Managing Databases: Fable, Fantasy or the Future" ](https://content.dsp.co.uk/oracle-autonomous-database-business-lunch-1) #### Contact Sales Enquiries [+44 (0) 203 880 1686](tel:+4420%2038801686) Technical Support +44 (0) 330 058 8367 [enquiries@dsp.co.uk](mailto:enquiries@dsp.co.uk) #### Follow us #### Office Locations [**London (Head Office)**](https://www.google.com/maps/place/Fora+-+Chancery+House/@51.5174484,-0.1139686,198m/data=!3m2!1e3!5s0x48761adea956397d:0xb7585122cbe86fc0!4m6!3m5!1s0x48761b4b75bf77fb:0x97c4f0ad56af6d23!8m2!3d51.5174586!4d-0.1129066!16s%2Fg%2F11h_cy7xk5?entry=ttu&g_ep=EgoyMDI1MTAwOC4wIKXMDSoASAFQAw%3D%3D) [Chancery House](https://www.google.com/maps/place/Fora+-+Chancery+House/@51.5174484,-0.1139686,19z/data=!3m1!5s0x48761adea956397d:0xb7585122cbe86fc0!4m6!3m5!1s0x48761b4b75bf77fb:0x97c4f0ad56af6d23!8m2!3d51.5174586!4d-0.1129066!16s%2Fg%2F11h_cy7xk5?entry=ttu&g_ep=EgoyMDI1MDkyOS4wIKXMDSoASAFQAw%3D%3D) [53-64 Chancery Lane](https://www.google.com/maps/place/Fora+-+Chancery+House/@51.5174484,-0.1139686,19z/data=!3m1!5s0x48761adea956397d:0xb7585122cbe86fc0!4m6!3m5!1s0x48761b4b75bf77fb:0x97c4f0ad56af6d23!8m2!3d51.5174586!4d-0.1129066!16s%2Fg%2F11h_cy7xk5?entry=ttu&g_ep=EgoyMDI1MDkyOS4wIKXMDSoASAFQAw%3D%3D) [London](https://www.google.com/maps/place/Fora+-+Chancery+House/@51.5174484,-0.1139686,19z/data=!3m1!5s0x48761adea956397d:0xb7585122cbe86fc0!4m6!3m5!1s0x48761b4b75bf77fb:0x97c4f0ad56af6d23!8m2!3d51.5174586!4d-0.1129066!16s%2Fg%2F11h_cy7xk5?entry=ttu&g_ep=EgoyMDI1MDkyOS4wIKXMDSoASAFQAw%3D%3D) [WC2A 1QS](https://www.google.com/maps/place/Fora+-+Chancery+House/@51.5174484,-0.1139686,19z/data=!3m1!5s0x48761adea956397d:0xb7585122cbe86fc0!4m6!3m5!1s0x48761b4b75bf77fb:0x97c4f0ad56af6d23!8m2!3d51.5174586!4d-0.1129066!16s%2Fg%2F11h_cy7xk5?entry=ttu&g_ep=EgoyMDI1MDkyOS4wIKXMDSoASAFQAw%3D%3D) [**Leeds** Richmond House, Lawnswood Business Park, Leeds, LS16 6QY](https://www.google.com/maps/dir/53.8405223,-1.6062773/DSP-Explorer/@53.8404788,-1.6061783,17z/data=!4m9!4m8!1m1!4e1!1m5!1m1!1s0x4879591e5d204ac9:0x4e41b926d72adca!2m2!1d-1.6064847!2d53.8404842) [**Derby**](https://www.google.com/maps/place/Cubo+Pride+Park/@52.9142877,-1.4558952,331m/data=!3m2!1e3!5s0x4879f10728c1eea1:0x877f85530d38bf6!4m15!1m8!3m7!1s0x4879f1072b0e2ebb:0x7c717035ff049b12!2sPride+Pl,+Derby+DE24+8QR!3b1!8m2!3d52.913692!4d-1.4543743!16s%2Fg%2F1th7mf0r!3m5!1s0x4879f16809382b33:0x6fccc05b8500d970!8m2!3d52.914146!4d-1.4544105!16s%2Fg%2F11w4j8v8z2?entry=ttu&g_ep=EgoyMDI1MDYyMi4wIKXMDSoASAFQAw%3D%3D) [Cubo Pride Park,](https://www.google.com/maps/place/Cubo+Pride+Park/@52.9142877,-1.4558952,331m/data=!3m2!1e3!5s0x4879f10728c1eea1:0x877f85530d38bf6!4m15!1m8!3m7!1s0x4879f1072b0e2ebb:0x7c717035ff049b12!2sPride+Pl,+Derby+DE24+8QR!3b1!8m2!3d52.913692!4d-1.4543743!16s%2Fg%2F1th7mf0r!3m5!1s0x4879f16809382b33:0x6fccc05b8500d970!8m2!3d52.914146!4d-1.4544105!16s%2Fg%2F11w4j8v8z2?entry=ttu&g_ep=EgoyMDI1MDYyMi4wIKXMDSoASAFQAw%3D%3D) [1 Pride Place](https://www.google.com/maps/place/Cubo+Pride+Park/@52.9142877,-1.4558952,331m/data=!3m2!1e3!5s0x4879f10728c1eea1:0x877f85530d38bf6!4m15!1m8!3m7!1s0x4879f1072b0e2ebb:0x7c717035ff049b12!2sPride+Pl,+Derby+DE24+8QR!3b1!8m2!3d52.913692!4d-1.4543743!16s%2Fg%2F1th7mf0r!3m5!1s0x4879f16809382b33:0x6fccc05b8500d970!8m2!3d52.914146!4d-1.4544105!16s%2Fg%2F11w4j8v8z2?entry=ttu&g_ep=EgoyMDI1MDYyMi4wIKXMDSoASAFQAw%3D%3D) [Derby](https://www.google.com/maps/place/Cubo+Pride+Park/@52.9142877,-1.4558952,331m/data=!3m2!1e3!5s0x4879f10728c1eea1:0x877f85530d38bf6!4m15!1m8!3m7!1s0x4879f1072b0e2ebb:0x7c717035ff049b12!2sPride+Pl,+Derby+DE24+8QR!3b1!8m2!3d52.913692!4d-1.4543743!16s%2Fg%2F1th7mf0r!3m5!1s0x4879f16809382b33:0x6fccc05b8500d970!8m2!3d52.914146!4d-1.4544105!16s%2Fg%2F11w4j8v8z2?entry=ttu&g_ep=EgoyMDI1MDYyMi4wIKXMDSoASAFQAw%3D%3D) [DE24 8QR](https://www.google.com/maps/place/Cubo+Pride+Park/@52.9142877,-1.4558952,331m/data=!3m2!1e3!5s0x4879f10728c1eea1:0x877f85530d38bf6!4m15!1m8!3m7!1s0x4879f1072b0e2ebb:0x7c717035ff049b12!2sPride+Pl,+Derby+DE24+8QR!3b1!8m2!3d52.913692!4d-1.4543743!16s%2Fg%2F1th7mf0r!3m5!1s0x4879f16809382b33:0x6fccc05b8500d970!8m2!3d52.914146!4d-1.4544105!16s%2Fg%2F11w4j8v8z2?entry=ttu&g_ep=EgoyMDI1MDYyMi4wIKXMDSoASAFQAw%3D%3D) ** [Dublin](https://www.google.com/maps/search/Inniscarra,+Main+Street,+Rathcoole,+Dublin/@53.2810032,-6.4764674,17z/data=!3m1!4b1?entry=ttu)** [Inniscarra,](https://www.google.com/maps/search/Inniscarra,+Main+Street,+Rathcoole,+Dublin/@53.2810032,-6.4764674,17z/data=!3m1!4b1?entry=ttu) [Main Street,](https://www.google.com/maps/search/Inniscarra,+Main+Street,+Rathcoole,+Dublin/@53.2810032,-6.4764674,17z/data=!3m1!4b1?entry=ttu) [Rathcoole,](https://www.google.com/maps/search/Inniscarra,+Main+Street,+Rathcoole,+Dublin/@53.2810032,-6.4764674,17z/data=!3m1!4b1?entry=ttu) [Dublin](https://www.google.com/maps/search/Inniscarra,+Main+Street,+Rathcoole,+Dublin/@53.2810032,-6.4764674,17z/data=!3m1!4b1?entry=ttu) #### About Us DSP is a Data Management and Cloud Platform MSP that delivers enterprise grade support & consulting services for Oracle, Microsoft and Multi-Cloud technologies. ![Oracle Partner](https://content.dsp.co.uk/hubfs/logo-2021/Partner-logos/Oracle-logos/Colour/o-prtnr-cmyk-250.png) ![Microsoft Partner](https://content.dsp.co.uk/hubfs/Microsoft%20partner%20logos%20-%20July%202023/mic-sol-part-colour@200x.png) ![Google Cloud Partner](https://content.dsp.co.uk/hubfs/logo-2021/Partner-logos/GCP-Logos/Google-Cloud-Partner%20(1).svg) Registered Office: 30 City Road, London, EC1Y 2AB. Company Registration Number: 03898451 ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "dateModified" : "2024-10-01", "datePublished" : "2024-10-01", "headline" : "ORDS, OAuth2 & Web Services in APEX – Part 2", "image" : [ "https://www.dsp.co.uk/hubfs/Imported_Blog_Media/access_token_c1.jpg" ], "mainEntityOfPage" : { "@id" : "https://content.dsp.co.uk/ordsoauth2-web-services-in-apex-part-2", "@type" : "WebPage" } } ```