nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Oracle Communities

Oracle Analytics and AI

Child Item

Access Tokens visible for Viewer users – purpose and can they be disabled?

JT_DC_2023

Hi all,

We are testing the new FAW/FDI HCM Viewer Role and noticed that Viewer users can still access Profile → Access Tokens.

The page states that these tokens can be used for:

API calls
Testing embedded content
Using an MCP server

My questions are:

Why are Access Tokens available and visible for users with only the FAW Licensed HCM Viewer Role?
What actions can a Viewer user actually perform with these tokens?
Do the tokens inherit only the Viewer permissions, or do they provide any additional capabilities?
Is there a supported way to disable e.g. Advanced, Mobile Access, Access Tokens, MCP Connect in the user profile?

We would like to better understand the security implications and recommended configuration.

Thanks in advance.

Find more posts tagged with

Analytics

FDI

Oracle analytics

Fusion AI Data Platform

FAIDP

Accepted answers

RVohra

@JT_DC_2023 , These are very relevant questions and let me try to answer.

Why are Access Tokens available and visible for users with only the FAW Licensed HCM Viewer Role?

Access Tokens are user authentication credentials, not administrative privileges. They are intended to allow a user to authenticate to Oracle Analytics APIs and related services without repeatedly entering their username and password. The UI is generally available to authenticated users because the token simply represents that user's identity.

2. What actions can a Viewer user actually perform with these tokens?

The token does not grant additional permissions. It can only perform operations that the authenticated user is already authorized to perform. For example, if the user only has the FDI HCM Viewer role, the token can typically View dashboards, Open workbooks, Execute analyses or Access REST endpoints that require only viewer privileges. The token cannot Create datasets, Create data flows, Manage users or Administer Oracle Analytics.

3. Do the tokens inherit only the Viewer permissions, or do they provide any additional capabilities?

Oracle Access Tokens are tied to the authenticated principal. When the token is presented to Oracle Analytics, Oracle evaluates Roles, Row-Level Security or atalog Permissions. The token is simply another authentication mechanism.

4. Is there a supported way to disable e.g. Advanced, Mobile Access, Access Tokens, MCP Connect in the user profile?

Here is the youtube video released by Oracle on MCP

MCP Server Initial Resources in Oracle Analytics Cloud

Hope it helps!

Thanks

Rajesh

All comments

Arindam Sadhukhan-Oracle

Hi JT,

For a Viewer user, the token can only be used against endpoints that accept that token and only within the scopes and permissions associated with that user. In practice, that usually means the token inherits the user’s underlying access boundaries rather than creating new business permissions. Access tokens are credentials used to access protected resources, and the token represents an authorization issued to the client.

Regards,

Arindam.