# Oracle Platforms

> Oracle's cloud and enterprise platform APIs: the Oracle Cloud Infrastructure (OCI)
> control plane plus the PaaS and SaaS services that sit on it. This profile covers eight
> named API surfaces and carries six machine-readable contracts totalling 1,154 operations,
> all harvested verbatim from Oracle's own published specification index on 2026-08-27.

Generated by API Evangelist from https://github.com/api-evangelist/oracle-platforms.
Method: generated. Oracle publishes no llms.txt of its own — https://www.oracle.com/llms.txt
and https://docs.oracle.com/llms.txt both return 404, and https://developer.oracle.com/llms.txt
returns 200 with the site's HTML shell, which is a soft 404, not a document.

## What to know before calling anything

- **Authentication is request signing, not a bearer token.** Every OCI call is signed with an
  RSA key (HTTP Signatures draft) using a user OCID, tenancy OCID, key fingerprint and
  private key. No generic HTTP client works without a signing implementation, which is why
  the SDKs are effectively mandatory. None of the six contracts declares a securityDefinitions
  block — the auth model lives in prose and in the SDKs, not in the spec.
- **Everything is scoped by compartment.** `compartmentId` is the most-referenced field in
  every contract. IAM policy is written against compartments.
- **Every resource is an OCID**, formatted `ocid1.<resource-type>.<realm>...`, so an
  identifier tells you what it points at without a lookup.
- **A 2xx on a mutation is acceptance, not completion.** Asynchronous operations return
  `opc-work-request-id`; poll the work request for a terminal state.
- **Idempotency is `opc-retry-token`**, 24-hour lifetime, offered on 396 of 1,150 operations,
  with a dedicated `409 InvalidatedRetryToken` failure code.
- **Concurrency is `etag` + `if-match`**, failing with `412 NoEtagMatch`.
- **Pagination is an opaque cursor**: `limit` + `page` in, `opc-next-page` out. The listing
  is exhausted when that header is absent. There is no total count anywhere.
- **429 carries no retry hint.** Oracle documents no `Retry-After` and no `X-RateLimit-*`
  headers for the OCI control plane. Its published remediation is to add delays.
- **There is no sandbox and no dry-run.** Every write provisions real, billable
  infrastructure. `Terminate*` operations have no undo.

## Contracts

- [Core Services API](openapi/oracle-platforms-core-openapi.yml): 314 paths, 490 operations. Compute, block storage, networking.
- [Database Service API](openapi/oracle-platforms-database-openapi.yml): 319 paths, 444 operations. Autonomous Database, Exadata, DB systems.
- [Data Science API](openapi/oracle-platforms-data-science-openapi.yml): 100 paths, 159 operations. Models, deployments, jobs, pipelines.
- [Analytics API](openapi/oracle-platforms-analytics-openapi.yml): 19 paths, 29 operations.
- [Oracle Integration API](openapi/oracle-platforms-integration-openapi.yml): 19 paths, 22 operations.
- [Oracle Content Management API](openapi/oracle-platforms-content-management-openapi.yml): 7 paths, 10 operations.
- All six are Swagger 2.0, harvested from https://docs.oracle.com/en-us/iaas/api/specs/index.json — Oracle's own machine-readable index of 159 OCI service specifications.

## Runtime semantics

- [API conventions and reversibility](conventions/oracle-platforms-conventions.yml)
- [Error catalogue — 31 codes](errors/oracle-platforms-problem-types.yml)
- [Authentication — 7 schemes](authentication/oracle-platforms-authentication.yml)
- [Rate limits](rate-limits/oracle-platforms-rate-limits.yml)
- [Data model and entity graph](data-model/oracle-platforms-data-model.yml)
- [Lifecycle, versioning, status page](lifecycle/oracle-platforms-lifecycle.yml)
- [Conformance and domain standards](conformance/oracle-platforms-conformance.yml)

## Agent surfaces

- [MCP servers](mcp/oracle-platforms-mcp.yml) — Oracle ships both. Remote: the managed OCI
  Database Tools MCP Server (GA 2026-05-12) and the built-in Autonomous AI Database MCP
  endpoint, both tenancy-provisioned with no static public URL. Local stdio:
  `uvx oracle.oci-cloud-mcp-server@latest`, plus 32 reference servers at
  https://github.com/oracle/mcp.
- [Tool crosswalk](mcp/oracle-platforms-tool-crosswalk.yml) — Oracle's MCP server is
  reflective, not per-resource: five tools reach all 1,154 operations via
  `client_fqn` + `operation`, so there is no per-operation inputSchema to read ahead of
  time. Call `describe_oci_operation` before `invoke_oci_api`.
- [Agent skills](skills/_index.yml) — five, including Oracle's own AGENTS.md saved verbatim.
- No A2A agent card. `/.well-known/agent-card.json` and `/.well-known/agent.json` were
  probed on seven Oracle hosts on 2026-08-27; none returned one.
- No `/.well-known/` document of any kind is served — see
  [the probe record](well-known/oracle-platforms-well-known.yml). Oracle does serve OIDC
  discovery, but only per-tenancy from an IAM identity domain host.

## Events

- [Event surface](asyncapi/oracle-platforms-events.yml) — OCI Events emits CloudEvents.
  There is no AsyncAPI document. Webhook delivery to your own URL is indirect: route an
  event Rule to a Notifications topic, then subscribe with the HTTPS (Custom URL) protocol.

## SDKs and tools

- [Packages](packages/oracle-platforms-packages.yml) — 12 official libraries. `oci` on PyPI
  (2.185.0), `oci-sdk` on npm (2.140.0) and `github.com/oracle/oci-go-sdk/v65` (v65.124.0)
  all published 2026-08-25.
- [OCI CLI](cli/oracle-platforms-cli.yml) — `oci`, first-party, built on the Python SDK.

## Commercial

- [Plans](plans/oracle-platforms-plans-pricing.yml) — API calls are not priced. Free Tier
  (US$300 / 30 days plus permanent Always Free services), Pay As You Go, Annual Universal
  Credits, BYOL.
- [Trust and compliance](security/oracle-platforms-trust-center.yml) — 15 named
  certifications including SOC 1/2/3, ISO/IEC 27001/27017/27018/27701, PCI DSS, HIPAA,
  HITRUST, FedRAMP, IRAP and C5.
- [Vulnerability disclosure](security/oracle-platforms-vulnerability-disclosure.yml) —
  secalert_us@oracle.com, PGP-encrypted, credit in the Critical Patch Update. No bug bounty
  and no security.txt.

## Oracle's own pages

- Developer portal: https://developer.oracle.com/
- OCI API reference: https://docs.oracle.com/en-us/iaas/api/
- Spec index (machine-readable): https://docs.oracle.com/en-us/iaas/api/specs/index.json
- Status: https://ocistatus.oraclecloud.com/
- Service change announcements: https://docs.oracle.com/en-us/iaas/Content/servicechanges.htm
- Pricing: https://www.oracle.com/cloud/price-list.html
- Sign up: https://signup.oraclecloud.com/
- GitHub: https://github.com/oracle