What does the catalina log show in tomcat when you look at the 403 errors? You should see the 'offending SQL' there
That's part of the problem. The 403 errors don't put anything into catalina.out so I don't know what to fix.
I can open https://localhost:8443/ords/pdb1/oli/_/db-api/stable/database/performance/top_sql_statements/maximums?q=%7B%7D in a tab and do multiple refreshes that all end in 403, but nothing goes into catalina.
That endpoint hits gv$sql, gv$sql_plan, gv$sql_monitor - does your 'oli' user have the ability to query those views?
grant select any dictionary to oli
Seems to have done the trick Thanks Jeff.