
How to Protect ORDS Endpoints with Privileges and Roles
Stop anonymous access to an ORDS API by mapping a privilege with a required role to its URLs.

Stop anonymous access to an ORDS API by mapping a privilege with a required role to its URLs.

Publish PL/SQL functions, procedures, and packages as POST endpoints, pass parameters as JSON, and read results and OUT values.

Serve query results as CSV from ORDS, and add the header row and download file name that the CSV source type leaves out.

Serve stored files over REST with the right MIME type, show images in the browser, and send downloads with a proper file name.

Receive files over REST in an ORDS PL/SQL handler, store them as BLOBs with their MIME type and name, and avoid reading :body twice.

Put related rows and JSON documents into one ORDS response with CURSOR expressions and JSON-typed columns, and avoid the traps.

Return JSON documents of your own design from ORDS, built with SQL/JSON functions and written out with HTP in pieces.

Return 400 errors with JSON messages and add your own response headers from ORDS PL/SQL handlers.

Let one resource URL answer GET, PUT, and DELETE, update and delete rows by the path parameter, and return the right status.

Read a JSON request body through bind variables, insert the row, and return 201 Created with the new resource and its URL.

Answer GET requests for one resource with a single JSON object, and let ORDS return 404 when the row does not exist.

Read values from the URL path and query string in ORDS handlers, and declare parameter types so bad input gets a clear error.

Group endpoints in a module, give them URL templates, and answer each HTTP method with a handler that runs your own SQL.

Read large ORDS collections page by page with limit and offset, follow next and prev links, and keep the order stable.

Ask an AutoREST collection for only the rows you need, with JSON filters for comparisons, patterns, lists, and sorting.

Publish a table as a full REST API with two ORDS calls, then read, insert, update, and delete rows over HTTP with real responses.

Register a schema with ORDS under a URL alias, check its status, browse its catalogs, and decide whether the catalog is public.

Read the query string, headers, and other request data in PL/SQL web procedures, and test them without a web server.