REST Enabling Your Oracle Database

Copyright © 2016, Oracle and/or its affiliates. All rights reserved. |
Developing RESTful
Services
w/Oracle REST Data Services (ORDS) &
Oracle SQL Developer

Copyright © 2014 Oracle and/or its affiliates. All rights reserved. |
whoami
 a tools geek since 2001
 blogs at thatjeffsmith.com tweets at @thatjeffsmith
 Product Manager for
 SQL Developer
 SQLcl
 SQL Developer Data Modeler
 Oracle REST Data Services

Safe Harbor Statement
The preceding is intended to outline our general product direction. It is intended for
information purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or functionality, and should not be relied upon
in making purchasing decisions. The development, release, and timing of any features or
functionality described for Oracle’s products remains at the sole discretion of Oracle.

Program Agenda
REST is Ubiquitous…What is REST?
Overview of ORDS (flexible, extensible, secure)
Automatic REST Feature for Tables: Examples
1
2
3
4
5

REST…What is it and why should we care?
REST has become a foundational part of web application stacks
5

REpresentational State Transfer (REST) is Everywhere
• REST is easy to grasp, easy to learn and easy to use
– Small uniform set of operations: GET, POST, PUT, DELETE etc that work similarly across all APIs
– Small set of uniform status codes: 200, 201, 404, 500, …
– URLs & hyperlinks encourage stateless behavior, easy to dive in and test out APIs
– Text based protocol with simple request/response model, easy to introspect and understand
– Accessible from any application platform or programming language
• Like HTTP, TCP & Unix, REST has become a foundational part of the computing world
6
REST APIs are the norm, and will continue to be for the foreseeable

Oracle REST Data Services (ORDS)
• ORDS Enables Developers With Database Skills to Develop REST and JSON
APIs for Oracle Database
– Just need SQL, PL/SQL, and Oracle Database knowledge
– Low code solution…
– …no need to learn Java!
• ORDS enables data access developers to
– Automatically generate REST APIs for basic functions on tables and views
• GET (query), PUT (insert), POST (update), etc.
– Write REST APIs that call custom SQL queries and PL/SQL procedures
7
So How Does ORDS Fit Into This?

What is ORDS?
• Java JEE mid tier application, e.g., WebLogic, Tomcat, Glassfish
– Also supports “Standalone” mode for development via embedded Jetty
• For input, maps/binds URI to SQL and PL/SQL
• For output, transforms results to JSON and other formats
8
Oracle REST Data ServicesHTTP(S) client Oracle Database
SQLMap & BindURI
JSON Transform to JSON SQL Result Set

• JavaScript Object Notation
– Derived from JS, but many languages have native support
• Lighter than XML
• Easy for humans to read/write
• Easy for machines to parse/generate
What is JSON? (JAY-sun)

Supports Multiple Oracle Data Stores
10
Oracle
REST Data Service
REST
Oracle NoSQL Database
Oracle Database 12c (Document Store)
Oracle Database (Relational)

Going from REST to the Database & Back
• Let’s review quickly how the Resource Collection Model works
• Sending data up to the database via ORDS and receiving data back relies on this model

The Resource Collection
A RESTful Design Pattern
12

Resource Collection Pattern
• MASTER RESOURCE: called the Collection URI:
A Table (or View)
https://site.com/ords/hr/employees/
• DETAIL RESOURCE; called the Item URI:
A Record in Said Table (or View)
https://site.com/ords/hr/employees/:id (:id => Primary
Key)
13

Example REST Resource
Resource has:
- tabular data
- nested data
- hyperlinks

Ok, Let’s Get to the Good Stuff!

ORDS is THE REST Solution for Oracle Database
• Custom SQL and PL/SQL
– Data binding or OWA Toolkit (HTP.P)
• Auto Table Enablement
– CRUD + Bulk Load
• Auto PL/SQL Enablement (RPC)
– Full to and from JSON support
• Full SQL Scripting
– sqldev/sqlcl library via REST
• Predefined OS Command
– Initially used in DBAAS Monitor
• Native Java Code
– Get Info directly from JDBC properties

AUTO REST for Tables
Examples
17

Auto enablement of RESTful request modules,
publishes these URI Handlers for Tables & Views
Requires ZERO code
• Table Metadata
• Get ( Select )
• Query ( Filtering )
• Insert
• Update
• Delete
• Bulk load
Auto Table/VIEW APIs/REST End Points

DECLARE
PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
ORDS.ENABLE_OBJECT(p_enabled => TRUE,
p_schema => 'HR',
p_object => 'DEPARTMENTS',
p_object_type => 'TABLE',
p_object_alias => 'depts',
p_auto_rest_auth => FALSE);
commit;
END;
GUI & PL/SQL APIs Available

Retrieve the Collection Metadata
METHOD : GET
RESPONSE: 200 OK
• JSON
• Collection (Schema)
• Canonical
• Describes (Table)
Screenshots demonstrate REST calls using POSTMAN

Retrieve the Collection (Table – All of the Rows)
21
200
JSON
METHOD : GET
RESPONSE: 200 OK
• JSON
• More?
• Next Page
• First Page
• Described By
• Self

Retrieve a Detail Resource (Table – A Specific Row)
22
METHOD : GET /:PK
RESPONSE: 200 OK
• JSON
• Self
• Described By
• Collection

Apply Predicates to Your Collection (Table – Where/Order)
METHOD : GET /?q={pred}
RESPONSE: 200 OK
• JSON
• More?
• Next Page
• First Page
• Described By
• Self
?q={"department_id": {
"$lt": 3}
}
…
WHERE DEPARTMENT_ID < 3
FULL Docs/Examples

Add a Row
24
METHOD : POST
REQUEST BODY : JSON
RESPONSE: 201 Created
• Location (Header)
• JSON (Body)

Update a Row
25
METHOD : PUT /:PK
REQUEST BODY : JSON
RESPONSE: 200 OK
• Location (Header)
• JSON (Body)

Delete a Row
METHOD : DELETE /:ID
RESPONSE: 200 OK
• JSON (Body)

Batch Load
METHOD : POST /batchload
REQUEST BODY : CSV
RESPONSE: 200 OK
• Text (Body)

A Quick Review…
DELETE
POST
GET
PUT
/some/collection/ ‘Read’ a Collection
/some/collection/:id ‘Update’ an Item
/some/collection/:id ‘Read’ an Item
/some/collection/ ‘Add’ an Item
/some/collection/:id ‘Delete’ an Item
GET

Database Resources available via REST/ORDS
• AUTO REST Tables and Views – Available TODAY
• SQL & PL/SQL Code Blocks – Available TODAY
• AUTO RPC Store Procedures

• Execute via POST
• Pass parameters via BODY {JSON}
• Output returned as {JSON}
– REFCURSORs? Check!
– Complex types, SDO_GEOMETRY,
Intervals, Custom types? Check!
Auto-Publish URI’s for PL/SQL Programs
Remote Procedure Call (RPC)
AUTO Support for PL/SQL Programs

Execute a Stored Procedure
METHOD : POST
REQUEST BODY : JSON
RESPONSE: 200 OK
• JSON (Body)

Oracle REST Data Services: RESTful Services
When AUTO is Not Enough
RESTful Services
• Execute any SQL or PL/SQL
• Module => Template(s) => Handler(s)
• PL/SQL API and GUI Support
• SECURE! Priv & Role Driven
• Supports OAUTH2
• Example (DOCS)

REST Development – in Oracle SQL Developer
Oracle SQL Developer version 4.2

REST Development – in Oracle SQL Developer

REST Development – CLI?

ALL APIs and No APPS Makes REST a Boring Boy…

Using Oracle JET with ORDS
Building rich web & mobile apps using REST APIs
37

Oracle JET & Oracle REST Data Services
• Both Oracle JET & Oracle REST Data Services comply with the Oracle REST
Standard, as do many other Oracle products that offer a REST API.
• The centrepiece of this standard is the Collection Resource Pattern we
discussed earlier
• Oracle JET provides rich functionality for interacting with REST Collections
• This makes it super-easy to wire JET UIs and ORDS APIs together
38
Meant to go together

Powered by Oracle JET, ORDS, REST, and the Oracle Public Cloud

REST API for the Database Itself
41

A customer asked for REST services that could be used to
• INSTALL Oracle
• CREATE DATABASE
PUT /database/ ?

• Take existing, internal APIs and ‘clean up’ for public consumption
• Consistent URIs for Cloud (across services) and On Premises
• Deploy via ORDS Updates
• ORDS Dev Calendar to Synch up with Cloud, Quarterly Updates
• Prioritize around Lifecyle Operations
• APIs will have Swagger style Oracle DOCs treatment
The Plan

Lifecycle Is Critical – Automate Everything
Operational ‘Buckets’
• VM
• Database
• Backup & Recovery
• Instance Management
• Security
• Performance
• Features

The ‘Buckets’
Security
Instance
VM
DB
Backup
Perf
State(start, stop, status), Shape(current, change), Image(copy, move,
drop, snapshot…
Params(list, change), State(create, drop, clone, start, stop, relocate,
plug, unplug…)
Locations(list, update), Windows(list, update), Backups(list, details),
Backup(now, backup to trace)…
Sessions(List, Kill, Trace), Pools(Flush), Logging(Current, Switch),
Storage(tblspc-add, edit, list)
Auditing(Trails, ChangeSettings, Delete), User(list, create, drop, list
privs, grant/revoke priv), Roles(list, create, drop…)
AWR, ADDM, ASH, SQL Tuning Advisor, RTSM

Automatic API Doc
Gen via Swagger
• Inventory REST API
• Descriptions
• Examples
• Test via Curl
• Oracle Docs Integration

Securing REST APIs
47

ORDS is Flexible - Security
Caveats
• Almost all dev/demo/blog is done with security off & with HTTP
• Always, always, always secure REST services and run with HTTPS

First Party Authentication
• Oracle REST Data Services specific solution
• Only available to the author of the API, application must be deployed on
same origin as API
• https://example.com/api & https://example.com/app ✓
• https://api.example.com & https://app.example.com ✗
• User enters credentials in sign-in form, ORDS issues cookie, cookie is only
validated by ORDS if the request is determined to originate from the from
the same origin as the REST Service.
49

About OAuth 2.0
• IETF standard for securing access to REST APIs
• Comes in two forms:
• Two Legged - For Business to Business, server to server applications
• Example: Sync HR data between internal applications
• Three Legged - For Business to Consumer, app to end-user applications
• Example: Share subset of HR data with external benefits provider after
employee approves access.
• Third party registers client, issued credentials, uses credentials to acquire
access token, uses access token with request to prove authorization
50

External Authentication
• Comes in many flavors, for example:
• Oracle Access Manager - SSO cookie at Oracle OHS server level
authenticates users stored in Oracle Identity Manager
• ORDS does not perform authentication, just authorization.
• Usually relies on HTTP cookies, need to restrict CORS allowed Origins to
avoid CSRF
51
APEX Authentication too (read users from a db table)

Learn More
About Oracle REST Data Services
oracle.com/rest
@OracleREST @cdivilly
@krisrice @thatjeffsmith

REST Enabling Your Oracle Database

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to REST Enabling Your Oracle Database

Similar to REST Enabling Your Oracle Database (20)

More from Jeff Smith

More from Jeff Smith (20)

Recently uploaded

Recently uploaded (20)

REST Enabling Your Oracle Database

Editor's Notes