Our asset retirement automation returns 403 Forbidden errors in production but works perfectly in our test environment. We’re using the same service account credentials in both environments:
POST /fscmRestApi/resources/11.13.18.05/fixedAssets/{assetId}/action/retire
{
"retirementDate": "2025-01-14",
"retirementTypeCode": "FULL"
}
The service account has ‘Asset Manager’ role assigned and can successfully query asset data via GET requests. We’ve verified role and privilege assignment through the Security Console, but the REST API privilege requirements for asset retirement aren’t clearly documented. What specific privileges are needed for the retire action?
Navigation: Setup and Maintenance > Security Console > Users
Select service account > View Effective Privileges
Filter by 'Fixed Assets' and verify all above privileges show as 'Granted'
Verify ‘Asset Manager’ includes required duty roles:
Fixed Assets Management Duty
Fixed Assets Web Services Duty (often missing)
Data Security Policies:
Check: Security Console > Data Security Policies
Filter by ‘Fixed Assets’ object
Verify service account has access to:
All asset books in scope (or specific books being retired)
Asset categories for assets being processed
Operating units where assets reside
Environment Comparison:
Run this analysis in both test and production:
Reports > Analytics > Security Analytics
Report: 'User Security Comparison'
Parameters: Service Account, Test vs Production
Look for discrepancies in:
Duty role assignments
Data access sets
Asset book security grants
Common Production-Specific Issues:
Production often has stricter data security (book-level access)
Custom roles may have different compositions
IP-based access restrictions in production firewall
OAuth token scope limitations (if using OAuth)
REST API Privilege Requirements:
Detailed privilege matrix for asset retirement API:
Operation
Required Privilege
Privilege Code
Notes
GET /fixedAssets
View Fixed Assets
FA_VIEW_ASSETS_PRIV
Basic read access
POST /retire
Retire Fixed Assets
FA_RETIRE_ASSETS_PRIV
Action-specific
POST /retire
Manage via Web Services
FND_MANAGE_FIXED_ASSETS_WS
API access gate
POST /retire
Maintain Transactions
FA_MAINTAIN_TRANSACTIONS
Transaction posting
Undocumented Requirements:
Service accounts need ‘HZ_ROLE_GRANT’ profile option set to ‘Y’
REST API calls validate against both function and data security
Asset retirement requires open accounting period for retirement date
Book-level security must include ‘Retirement’ transaction type
Troubleshooting Steps:
Test Privilege Grant:
Temporarily grant ‘Asset Manager Application Administrator’ role to service account
If this works, systematically remove privileges to identify minimum required set
Enable Security Logging:
Navigate: Setup and Maintenance > Manage Administrator Profile Values
Profile: FND_SECURITY_DEBUG
Set to: TRUE for service account
Retry API call and review security logs for denial reasons
Verify OAuth Scope (if applicable):
If using OAuth, ensure token scope includes:
scope: urn:opc:resource:fa:assets:retire
Check Audit Trail:
Navigate: Tools > Audit Reports
Report: Security Access Audit
Filter: Service Account, Last 24 hours, Failed Actions
Solution for Your Scenario:
Based on your description, the most likely cause is missing data security for asset books in production. Grant the service account access to production asset books:
Navigate: Setup and Maintenance > Define Asset Book Security
Add Grant:
User: [service_account]
Asset Book: [Production Books]
Transaction Types: All (including Retirement)
After granting, wait 10-15 minutes for security cache refresh, then retry the API call.
This draft is based on general Oracle Fusion Cloud knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.
403 typically means missing function security privileges, not data security. Check if your service account has the ‘Retire Fixed Assets’ privilege specifically. Having the Asset Manager role doesn’t automatically grant all functional privileges - you need explicit privilege assignment for REST API actions.
Confirmed this resolves the 403 error—explicitly granting FND_MANAGE_FIXED_ASSETS_WS alongside FA_RETIRE_ASSETS_PRIV to our integration role fixed Oracle Fusion Fixed Assets REST API retirement calls immediately.
We had this exact issue. The problem is that REST API actions require different privileges than UI actions. Even though the user can retire assets through the UI, the API requires the ‘Manage Fixed Assets via Web Services’ privilege. Check if that’s granted to your service account in production.
Thanks Mark. I checked and ‘Manage Fixed Assets via Web Services’ is granted in both environments. Still getting 403 in production. Could there be additional data security policies blocking access to specific asset categories or books?
Yes, data security can cause 403 even with correct function privileges. Check the asset book assignments for your service account. If the asset belongs to a book that isn’t in the user’s data access set, retirement will be blocked. This is often overlooked when comparing test vs production environments.
Don’t forget to check duty role inheritance. Sometimes custom roles in production have different duty role compositions than test. Run a privilege analysis report comparing the service account’s effective privileges across both environments. There might be subtle differences in role hierarchies.
Another thing to verify: check if there are any IP whitelisting or network security policies in production that might be blocking your API client. 403 can also be triggered by web application firewall rules if the request pattern looks suspicious.