Prerequisites
A relevant subscription and an administrator with Manage API Accounts permission are necessary to create an STS Gen2 account. Define the intended integration and required venues before provisioning.
Use a dedicated account and minimum privileges
In Reporting and Analytics, open Administration > System > API Accounts and choose Simphony Transaction Services. Select Cloud, Local or Both as appropriate, and limit the location authorisation scope to the required outlets.
Document the account owner and avoid granting enterprise-wide access merely for convenience.
Exchange credentials securely
Oracle documents an OpenID/OAuth authentication flow. The venue and integrator should agree responsibility for credential storage, token refresh, account recovery and rotation.
Do not paste passwords, refresh tokens or secrets into ordinary email or support tickets. Use an approved secure vault or controlled transfer method and know how to disable access if needed.
Validate both success and denial
Confirm the test account can access the expected location and revenue centre, then verify that it cannot access excluded outlets. Run a controlled supported check workflow only after mapping and permissions are correct.
For failures, review account status, token validity, client scope and authorised locations before changing permissions.
Secure handover checklist
The authorised venue administrator should create or approve the integration account. Record its owner, purpose, authorised outlets and the secure channel for exchanging credentials. Agree how the account can be disabled when access is no longer needed.
For a pilot in one hotel restaurant, there is usually no reason to grant access to every outlet. Test both that the intended location is accessible and that an excluded location is not. Those outcomes establish availability and least-privilege enforcement.
- Identify the account owner and operational contact.
- Grant the minimum required outlet permissions.
- Never paste secrets into ordinary email or tickets.
- Document revocation and incident procedures before go-live.
Using the Rezervem integration
The existing Rezervem STS Gen2 connector can be assessed once venue-specific subscriptions and administrator permissions are confirmed. Begin with the version and access checklist.
Official Oracle references
Oracle Simphony integration programme · STS Gen2 API · API Accounts.
