Enhancements

General

• Users can now create Pre-Authenticated endpoints (i.e., PAR requests) for their resources. Using the new ORDS_PAR PL/SQL package, users can create, revoke, and issue/set tokens and token life for specific resources.
• ORDS Central Configuration natively supports pool identifiers contained in URLs.
• ORDS will notify users when plain-text “secrets,” such as passwords, are present in the configuration xml files.
• The ORDS CLI now includes a script-friendly --quiet option, which hides banner, copyright, and configuration location information from the ORDS STDOUT.
• Application Common user schemas can now be rest-enabled at the application PDB level.
• Standalone access log records now include an APEX app_id and APEX page_id for records, where applicable. In the following format (App ID and Page ID in this example; 4550:1):

[0:0:0:0:0:0:0:1] - [21/Nov/2024:17:37:42 +0000] "POST /ords/wwv_flow.accept?p_context=workspace-sign-in/oracle-apex-sign-in/12558700474753 HTTP/1.1" 200 6494 "http://localhost:8080/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 1362 localhost:8080 - 4550:1

• New DBA_ORDS_ views added to provide administrators with a comprehensive, cross-schema view of ORDS configurations. The following new views exist:
  • DBA_ORDS_APPROVALS
  • DBA_ORDS_CLIENTS
  • DBA_ORDS_CLIENT_PRIVILEGES
  • DBA_ORDS_CLIENT_ROLES
  • DBA_ORDS_ENABLED_OBJECTS
  • DBA_ORDS_HANDLERS
  • DBA_ORDS_JWT_PROFILE
  • DBA_ORDS_MODULES
  • DBA_ORDS_OBJECTS
  • DBA_ORDS_OBJ_MEMBERS
  • DBA_ORDS_PARAMETERS
  • DBA_ORDS_PENDING_APPROVALS
  • DBA_ORDS_PRIVILEGES
  • DBA_ORDS_PRIVILEGE_MAPPINGS
  • DBA_ORDS_PRIVILEGE_MODULES
  • DBA_ORDS_PRIVILEGE_ROLES
  • DBA_ORDS_PROPERTIES
  • DBA_ORDS_ROLES
  • DBA_ORDS_SCHEMAS
  • DBA_ORDS_SERVICES
  • DBA_ORDS_TEMPLATES

 

Database Actions

• When viewing JSON data from a query result in the SQL Worksheet, pretty printing and JSON syntax highlighting are now applied.
• User-defined parameters (i.e., handler parameters) and implicit parameters can now be added to handler code blocks with a single mouse-click of the parameter name. For example, clicking on the :body implicit parameter will insert the :body at the location of a user’s cursor.
• Database Actions pinned items will no longer be shown in recently visited items.
• SQL Worksheets (from within Database Actions and the OCI console) can be renamed. The update applies to browser files and OCI object storage files.

 

Bug Fixes

ORDS

• 36472044 A user-defined privilege pattern (e.g., “/*“) prevented certain Database Actions U/I elements from rendering.
• 36566638 An APEX workspace sign-in card on the ORDS landing page remained enabled despite APEX not being installed in the same PDB.
• 36899444 Updated ORDS response codes (571 and 572) for connection pool errors caused by SQL exceptions.
• 35781572 Approve button is missing for the implicit code flow ORDS OAuth wizard.
• 36764517 Error retrieving single duality view document when the ID Primary Key is RAW(32).
• 36348529 ORDS created an additional item definition for query parameters in the OpenAPI specification document.
• 36556767 The --document-root option is not observed by the ORDS cli when used with the --dconfig.url --java-options option.
• 36731849 The ords uninstall command fails when using a bequeath connection while specifying a hostname.
• 35355987 Users received a 503 error when navigating to the Database Actions landing page when ORDS was installed at the CDB level and APEX installed at the PDB level.
• 37020279 ORDS landing page returns a 503 if PL/SQL Gateway proxy user is not set in the database. The ORDS landing page will now load, even if a PL/SQL gateway is misconfigured. A warning will be displayed to the user in the in-browser ORDS log.
• 36846263 Importing previously exported resource templates would include trailing slashes where none existed, leading to unexpected template and handler behavior.
• 36643605 Users received an incorrect error (ORA-01400) when an object alias name exceeded 235 characters (235 is the limit).
• 37041356 Query filtering fails when an auto-rest-enabled table or view contains a column of JSON type.

Database Actions

• 37236229 Share chart button, in the charts and dashboards public pages, not displaying with correct layout.
• 36830966 While creating a resource handler, hitting the escape key will cause the handler code to be lost. Users will now be asked permission to proceed.
• 36836360 Relocated the caps-lock icon of the ORDS sign-in page.
• 36501253 Unable to rest-enable a table with an alias if that alias was previously used on a since been rest-disabled.
• 36836349 Unable to close child slider when inspecting a column in the SQL Worksheet.
• 34026100 The sort by function in the query results tab of the SQL Worksheet was not working.
• 37159824 The Data Pump ADB-S import tool fails in manual mode after entering all required information and proceeding to the next screen.
• 36719011 Incorrect data type was assigned to the corresponding column, resulting in table data loading in the SQL Worksheet.
• 36698857 When a user creates a role, if the role already exists, an error message will display.
• 36108686 The edit call specification window failed to display when editing an MLE/JS’s call specification.
• 37183280 Failed update table reported in a customer’s region (France).
• 37071019 Info/inspect clicks (clicking the “Eyeball” icon) are not registered or registered intermittently in the SQL Worksheet.
• 36358019 When clicking on the Database Actions’ Launchpad walk through button, the rest tour fails to begin from the beginning of the tour.
• 36290425 The SQL Worksheet linter displays lint errors in incorrect rows and columns after a statement is executed.
• 35563308 Inspecting a view’s DDL removes the ability to update unique and foreign keys in the view properties slider (SQL Worksheet).
• 36349409 When viewing in Firefox, the language selector shows English, but the text is shown in the browser’s language (non-English) by default.
• 36660348 Notifications are obscured from the user by the editor mini-map in Database Actions’ Charts and Dashboards.
• 37035450 Duplicate context menus are visible when right-clicking from the SQL Worksheet objects navigator.
• 35755921 A user’s changes to a materialized view in the SQL Worksheet are not saved after clicking the apply button.
• 36669110 Validation rules, in the Scheduler > Scheduling > Chains Dashboard, would fail to display.
• 36708013 Search icon missing in the Database Actions > Monitoring > Sessions Dashboard.
• 37143651 ORDS incorrectly prompts users for substitution variables when "&" and "&&" JavaScript operators are used in the MLE/JS snippet editor.
• 37137899 Pop-up windows obstructed in the SQL Worksheet editor.
• 37046534 After clicking the share icon of a chart in Database Actions, a portion of the URL would be hidden behind the browser’s borders.

 

Library updates

• ORDS embedded Jetty Server Version 12

 

Deprecation notices

• The PL/SQL interfaces for managing OAUTH2 clients (formerly found in the OAUTH and OAUTH_ADMIN PL/SQL Packages) have been consolidated and updated into two new packages:
  • ORDS_SECURITY
  • ORDS_SECURITY_ADMIN
• We’ve deprecated the OAUTH and OAUTH_ADMIN PL/SQL Packages. Customers should plan for this move as these PL/SQL packages will no longer be available in ORDS 25.3 (October 2025).

 

Supported Java Versions

Oracle REST Data Services requires Java 17, or 21. The supported Java Runtime Environments are:

• Oracle Java 17
• Oracle Java 21
• Oracle GraalVM Enterprise Edition for Java 17
• Oracle GraalVM Enterprise Edition for Java 21

Note that GraphQL support requires GraalVM Enterprise Edition for Java 17 or later.

Please consult the documentation for the minimum supported Application Server versions for ORDS.

 

Support

• Supported by Oracle Support under your current Oracle Database Support license for Oracle REST Data Services production releases.
• Log Oracle REST Data Services bugs and issues using My Oracle Support.
  • For problems specific to SODA for REST, file a service request using "Oracle XML Developers Kit" as the product.
  • For all other problems, use "Oracle REST Data Services" as the product.

Note - Autonomous Database Shared Subscribers

If you are running a customer-managed ORDS for your Autonomous Transaction Processing, Autonomous Data Warehouse, or Autonomous JSON Database, you must upgrade your customer-managed ORDS to the version used in your Autonomous Database Shared environment. Failure to do so could lead to service disruptions.

To determine the version of ORDS in your Autonomous Database Shared database run this query:

select ords.installed_version from dual;

 

Documentation

General

• Documentation for this release is provided on the oracle.com web site. Click here to view the documentation and related information.
• Documentation on using SODA for REST is provided on the oracle.com web site. Click here, navigate to the documentation section and access the book titled 'SODA for REST'.

Getting Started

• A tutorial on getting started with developing RESTful Services is included in the ORDS product documentation, in the book titled 'Oracle REST Data Services Quick Start Guide'.

 

Known Issues

ORDS version 24.4, when in Standalone mode, enforces stricter URL redirection.

URIs with and without trailing slashes are considered distinct. Previously, where a 302 Temporarily Moved redirect was permitted, users may instead receive a 301 Moved Permanently response status code. ORDS 24.4 Standalone conforms to the HTTP specification found in RFC7230. ORDS customer-managed users and OCI users that consume ORDS resources should plan accordingly for this new behavior. You may review the specification here. 

 

Oracle Database may report 'ORA-01031: insufficient privileges' for queries that involve CURSOR expressions

In a number of cases, ORDS executes queries which include a CURSOR expression. An issue has been found executing these queries for some schemas in Oracle 18c and Oracle 19c databases. Depending on the roles and privileges involved, the issue does not occur for all schemas, which can give the impression that the issue is intermittent. Refer to RDBMS bug 29049673 for more information. The issue is manifest as follows in the exception returned:

ORA-00604: error occurred at recursive SQL level 1

ORA-01031: insufficient privileges

This is a problem with view-merging of nested cursors introduced in Oracle 18.1 database. Please use the following as a workaround:

alter system set "_fix_control"='20648883:OFF';

 

Oracle Database DATE and TIMESTAMP values

ORDS interprets Oracle Database DATE and TIMESTAMP values (which do not possess a time zone) into the time zone of ORDS. These values are then represented in the RFC3339 UTC format.

In a future release Oracle Database DATE and TIMESTAMP values will not by default be interpreted into any time zone. These values will be represented in the ISO 8601 "yyyy-mm-ddThh:mm:ss[.sss]" format. Oracle Database TIMESTAMP WITH TIME ZONE and TIMESTAMP WITH LOCAL TIME ZONE values will remain represented in the RFC3339 UTC format.

SQL Developer Web

• DATE, TIMESTAMP, TIMESTAMP WITH TIMEZONE values downloaded from the Worksheet Query Result in the JSON format are not presented in the Internet Datetime format.

JDBC Array values

ORDS passes array values to the Oracle Database in a number of cases, for example arrays are used to pass the request headers and form fields during PL/SQL Gateway calls. Oracle JDBC Driver 18.3 and later supports an improved mechanism for passing array values, however this feature is only supported on Oracle Database 12c and later. Thus ORDS uses existing deprecated and less efficient APIs for passing array values when connecting to 11G databases, and the improved mechanism when connected to 12c and later. Customers experiencing problems with passing large array sets (for example OutOfMemory exceptions) are encouraged to upgrade from 11G to a newer database version to mitigate these issues.

Autogenerated REST Endpoints

• AutoRest resources support the OAuth 2.0 Client Credentials flow only.

RESTful Services

• Application Express workspaces do not support first party authentication, and therefore do not support the /sign-in/ interactive sign in form. Accessing /sign-in/ in APEX workspaces will produce a 404 status.

Support For mod_plsql logmeoff

• The mod_plsql logmeoff mechanism is not supported reliably by modern browsers and it is not provided by ORDS. The only way to end a HTTP Basic Authentication session is to close the Browser.

 

Feedback

• At Oracle REST Data Services on oracle.com you will find links to forums and social media channels where you can discuss topics with the ORDS community around the world and leave feedback for the development team.
  • In the forums, be sure to use clear subject lines to initiate a thread. Provide a complete and clear description of the issue, including steps to reproduce the issue.
  • Try to avoid using old, unrelated threads for a new issue.

 

Important Concepts to Keep In Mind

Revised Command Line Interface and Configuration Directory Structure


Command Line Interface

The java commands serviced from the WAR file are no longer supported. Attempting to run the following:

java -jar ords.war standalone

Will result in an error message, referring you to the docs. Instead you would run:

ords --config /path/to/config serve

 

Installation & Configuration

The ORDS program or script in the bin directory can be used to perform installs, changes to your configuration, changing the database passwords for your connection pools, and for creating ORDS users. To see a list of commands:

ords --help

 

Configuration Files Directory Layout

If upgrading from a previous version of ORDS, your existing configuration directory for ORDS and the files contained therein will be migrated to a new layout for versions 22.1 and higher.

You may migrate your settings using the ORDS migrate command, or you may perform a 22.1 install which will prompt ORDS to migrate your existing ORDS configuration to the new mapping for you.

ORDS standalone and default pool configuration settings are in a settings.xml file in a global subdirectory.

Connection pools are in a databases subdirectory. The intital database pool is named 'default' and has a '/' mapping pattern.

Subsequent pools will created such that the name of the pool also defines the mapping pattern.

SQL Developer Web

SQL Developer Web (SDW) is an ORDS hosted web application giving Oracle Database users the SQL Developer desktop experience in their browser.

SQL Developer Web provides a development interface for building and maintaining your ORDS based REST APIs, AUTOREST Enabled database objects, OAuth3 Clients, ORDS Privileges and Roles, as well as a SODA for REST graphical interface. For the best possible experience developer REST APIs for ORDS, we recommend you use SQL Developer Web.

For consistent representation of date values in SQL Developer Web, ORDS should be run in the UTC timezone. This is set automatically when using the ords command line interface. When deploying ORDS to Apache Tomcat or WebLogic Server the user.timezone may have to be set explicitly before starting the container.

-Duser.timezone=UTC

 

SQL Developer Web requires the Database API be enabled.

SQL Developer Web's DBMS_SCHEDULER interface requires database version 12.2 or higher.

Upgrading ORDS in the database

If you have previously executed script, ords_installer_privileges.sql, to grant your administrator user privileges to perform the install or upgrade, then you must execute the script again on that same user that you provided because additional grants have been added to this script. Note: This script does not apply to the SYS user account.

 

Earlier Release Versions

For information on Issues Fixed and New Features introduced for earlier versions please refer to the release notes for those versions.