Oracle Recruiting
Job Requisitions Over REST: Grants, Roles and What the Page Will Not Tell You
Which duty role grants what on the recruitingJobRequisitions resource — and why the same role can hold both read-only and full privileges, and why this page is not where you learn the endpoint.
Learning objectives
- 1.Distinguish a read-only privilege from a full privilege on the recruitingJobRequisitions resource
- 2.Name the duty roles that grant each privilege level
- 3.Explain why the same role can appear under both a read-only and a full duty role
- 4.State what must be read from elsewhere before an API example is written
Why this matters
Authorisation and payload are learned from two different Oracle pages, and the one that is easy to find answers only half the question. A privilege matrix tells you who may create, read, update and delete a job requisition through the REST service. It tells you nothing about the URI, the request body or the response shape, and those cannot be inferred from a list of privileges.
If you skip this: An integration written from the security page alone gets every grant right and every payload wrong, and the failure appears at the first call rather than at review.
What it is, why it exists, what breaks
What it is
The recruitingJobRequisitions REST resource is granted through Duty Role grants. A read-only privilege grants Get and Describe; a full privilege grants Get, Post, Patch, Describe and Delete.
Why it exists
Grants attach to roles and not to users, so the question is never "what can this person do" but "which duty roles does this role carry". Naming the duty role is therefore the only way to reason about access at all.
What breaks without it
The Human Capital Management Integration Specialist appears under both a read-only duty role and a full-privilege duty role. Whether that role can create or delete a requisition depends on which duty role was granted, not on the role alone — so "the role has access" is not an answer.
Source: ORC-REST-030, ORC-REST-035
Who may act on a job requisition over REST
Three duty roles grant access to one resource in two privilege levels. A grant belongs to the duty role, not to the job role that carries it. Listed in order: Use REST Service - Job Requisitions Read Only, then Access Recruiting Activity Center, then Use REST Service - Job Requisitions, then Human Capital Management Integration Specialist, then Hiring Manager and Recruiter, then Not on this page.
Access to the recruitingJobRequisitions REST resource is granted through Duty Role grants, so the unit of access is the duty role rather than the user or even the job role. Three duty roles appear. Use REST Service - Job Requisitions Read Only, abstract role name ORA_IRC_REST_SERVICE_ACCESS_JOB_REQUISITIONS_RO, grants Get and Describe and nothing that changes a requisition. Two further duty roles grant the full privilege set of Get, Post, Patch, Describe and Delete: Access Recruiting Activity Center, ORA_IRC_ACCESS_RECRUITING_ACTIVITY_CENTER_DUTY, and Use REST Service - Job Requisitions, ORA_IRC_REST_SERVICE_ACCESS_JOB_REQUISITIONS. The case worth stopping on is that the Human Capital Management Integration Specialist role is listed under both the read-only duty role and a full-privilege duty role. The same role therefore has write access in one deployment and not in another, with the role configuration looking identical in both, and the difference is which duty role was granted. Hiring Manager and Recruiter are listed under the Access Recruiting Activity Center duty role only, and under neither REST service duty role. One boundary is deliberate: this page is a privilege matrix and contains no endpoint URI, request schema, response schema or field names. Those must be read from the corresponding resource page in the REST API guide, and an integration written from the matrix alone gets every grant right and every payload wrong.
What to take from this: The matrix is three duty roles crossed with two privilege levels, and a role appearing twice is the case worth noticing. Access is a property of the duty-role grant, not of the role, which is why an identical role can be read-only in one deployment and full in another.
Source: ORC-REST-033, ORC-REST-034, ORC-REST-035
The integration that worked in one tenant and not the next
A team builds an integration that creates job requisitions. In their development tenant the creating role is the Human Capital Management Integration Specialist, so it works. They promote the same role to production and every call returns an authorisation error.
- 1.The development tenant grants that role the full-privilege REST service duty role.
- 2.The production tenant grants the same role only the read-only duty role.
- 3.The role name is identical in both, so nothing in the role configuration looks different.
- 4.The failure is read as an integration defect until the duty role grants are compared between the two tenants.
Takeaway: Two duty roles carry full privileges and one carries read-only. Diagnosing "the role cannot do it" means comparing duty-role grants, not comparing roles.
Source: ORC-REST-034, ORC-REST-035
Configuration model
Objects
Use REST Service - Job Requisitions Read Only
Grants Get and Describe on recruitingJobRequisitions, and nothing that changes a requisition.
Risk if wrong: Assumed sufficient for an integration that also creates requisitions, and every write is refused at runtime.
Access Recruiting Activity Center
One of the two duty roles granting full privileges, and the one listed for Hiring Manager and Recruiter.
Risk if wrong: Read as the only route to full privileges, when a second REST service duty role grants the same set.
Use REST Service - Job Requisitions
The other duty role granting full privileges on the resource.
Risk if wrong: A deployment that grants only the Activity Center role is indistinguishable from one that grants both, until a role that appears under both is moved.
Constraints
- The recruitingJobRequisitions REST resource is granted through Duty Role grants.
- A read-only privilege grants Get and Describe only, while the full privilege grants Get, Post, Patch, Describe and Delete.
- The read-only duty role is Use REST Service - Job Requisitions Read Only (ORA_IRC_REST_SERVICE_ACCESS_JOB_REQUISITIONS_RO).
- Full privileges are granted by Access Recruiting Activity Center (ORA_IRC_ACCESS_RECRUITING_ACTIVITY_CENTER_DUTY) and Use REST Service - Job Requisitions (ORA_IRC_REST_SERVICE_ACCESS_JOB_REQUISITIONS).
- Hiring Manager and Recruiter are listed under the Access Recruiting Activity Center duty role only, and not under either REST service duty role.
Source: ORC-REST-030, ORC-REST-031, ORC-REST-033, ORC-REST-034, ORC-REST-036
Common mistakes
Wrong: Reading the page as documentation of the endpoint.
Symptom: An integration is built with no URI and no payload, because the page listed privileges and nothing else.
Fix: The endpoint URI, request schema, response schema and field names are not on the security page and must be read from the resource page in the REST API guide.
Wrong: Assuming a role has one privilege level.
Symptom: The same role is read-only in one tenant and full in another, and the role configuration looks identical.
Fix: Access follows the duty-role grant. The Human Capital Management Integration Specialist is listed under both a read-only and a full duty role.
Wrong: Assuming one duty role grants full privileges.
Symptom: A deployment grants the Activity Center duty role and a later change assumes the REST service role is also covered.
Fix: Two separate duty roles grant full privileges on this resource: Access Recruiting Activity Center and Use REST Service - Job Requisitions.
Diagnosing it
Symptom: A requisition integration is authorised for reads and refused for creates, in one tenant and not another.
Category: security
- 1.
Which duty role does the creating role actually carry in the failing tenant?
If no: The role is carrying only the read-only duty role, which grants Get and Describe and nothing else.
Evidence to capture: The duty role grants on the role in the failing tenant, by abstract role name
- 2.
Is the role named under a full-privilege duty role at all?
If no: Nothing on the page grants this role write access to the resource, and the refusal is correct.
Evidence to capture: The role name in the Available in Roles column of the privilege matrix
- 3.
Does the same role hold write access in the tenant where it works?
If no: The tenants differ in duty-role grants rather than in roles, which is the whole of this lesson.
Evidence to capture: Duty role grants for the same role across both tenants
Confirm: Compare the duty-role grants by abstract role name across both tenants, and confirm which of the three listed duty roles is present in the failing one.
Recall
Name the three duty roles that grant access to the recruitingJobRequisitions resource, say which privilege level each carries, and say which two roles appear under more than one of them.
Answer shape: Use REST Service - Job Requisitions Read Only grants Get and Describe. Access Recruiting Activity Center and Use REST Service - Job Requisitions both grant Get, Post, Patch, Describe and Delete. The Human Capital Management Integration Specialist appears under both the read-only duty role and a full-privilege duty role. Hiring Manager and Recruiter are listed under the Access Recruiting Activity Center duty role only.
Memory hook: Read-only grants Get and Describe. Two duty roles grant the rest. The same role can sit under both, so check the duty role, not the role.
Source evidence
The duty role abstract names, the privilege sets and the roles listed against each duty role were read from the Recruiting Job Requisitions security reference page on 2026-10-09. Claims ORC-REST-033 to ORC-REST-036 were added on that date; the page carried more structure than the two claims recorded on 2026-10-05 had captured.
Release scope: FA Latest
Recorded gaps
- Claim ORC-REST-032 records that the endpoint URI, request schema, response schema and field names are not on the security reference page and must be read from the corresponding resource page in the REST API guide. It is UNVERIFIED, so this lesson contains no endpoint path and no payload, and no API example is taught here.
- Whether granting a role the full-privilege duty role also confers the read-only one, or whether the two must both be granted, is not stated on the page read and is not asserted.
- Whether a custom role may carry these duty-role grants directly, rather than through one of the named roles, is not stated on the page read.
Related concepts
- Job requisitionteaches
The requisition is the object this resource exposes, and this lesson is about who may act on it programmatically.
- Oracle Recruiting mental modeldepends on
The requisition sits at the start of the candidate-to-hire lifecycle, and a read-only grant is most of what an integration needs before an approval workflow exists.
Self-check
An auto-graded assessment is attached to this lesson: assessment-orc-requisition-rest-access
Lesson progress
Checking your progress…