BillLeoutsakosvl346 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026
diff --git a/apps/docs/components/icons.tsx b/apps/docs/components/icons.tsx
@@ -9500,7 +9500,7 @@ export function NewRelicIcon(props: SVGProps<SVGSVGElement>) {
   )
 }
 
-export function NetSuiteIcon(props: SVGProps<SVGSVGElement>) {
+export function OracleIcon(props: SVGProps<SVGSVGElement>) {
   return (
     <svg {...props} viewBox='0 0 93.9 59.4' xmlns='http://www.w3.org/2000/svg'>
       <path
@@ -9511,6 +9511,10 @@ export function NetSuiteIcon(props: SVGProps<SVGSVGElement>) {
   )
 }
 
+export function NetSuiteIcon(props: SVGProps<SVGSVGElement>) {
+  return <OracleIcon {...props} />
+}
+
 export function WizaIcon(props: SVGProps<SVGSVGElement>) {
   return (
     <svg {...props} viewBox='0 0 51 49' fill='none' xmlns='http://www.w3.org/2000/svg'>

diff --git a/apps/docs/components/ui/icon-mapping.ts b/apps/docs/components/ui/icon-mapping.ts
@@ -200,6 +200,7 @@ import {
   OktaIcon,
   OnePasswordIcon,
   OpenAIIcon,
+  OracleIcon,
   OtterIcon,
   OutlookIcon,
   PackageSearchIcon,
@@ -543,6 +544,8 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   notion: NotionIcon,
   notion_v2: NotionIcon,
   obsidian: ObsidianIcon,
+  oci: OracleIcon,
+  oci_events: NetSuiteIcon,
   okta: OktaIcon,
   onedrive: MicrosoftOneDriveIcon,
   onepassword: OnePasswordIcon,

diff --git a/apps/docs/content/docs/cli/credentials.mdx b/apps/docs/content/docs/cli/credentials.mdx
@@ -114,6 +114,11 @@ Update Credential (OAuth login or personal API key required)
 | `--auth-method <value>` | No | Provider authentication method. |
 | `--private-key <value>` | No | Write-only PEM private key. |
 | `--username <value>` | No | Provider run-as username. |
+| `--tenancy-ocid <value>` | No | OCI tenancy OCID. |
+| `--user-ocid <value>` | No | OCI user OCID. |
+| `--fingerprint <value>` | No | OCI API-key fingerprint. |
+| `--private-key-passphrase <value>` | No | Write-only OCI private-key passphrase. |
+| `--region <value>` | No | OCI home region. |
 | `--name <displayName>` | No | Alias for --display-name. |
 
 </CommandTable>

diff --git a/apps/docs/content/docs/cli/reference.mdx b/apps/docs/content/docs/cli/reference.mdx
@@ -547,6 +547,11 @@ sim credentials update <credentialId> [options]
 | `--auth-method <value>` | No | Provider authentication method. |
 | `--private-key <value>` | No | Write-only PEM private key. |
 | `--username <value>` | No | Provider run-as username. |
+| `--tenancy-ocid <value>` | No | OCI tenancy OCID. |
+| `--user-ocid <value>` | No | OCI user OCID. |
+| `--fingerprint <value>` | No | OCI API-key fingerprint. |
+| `--private-key-passphrase <value>` | No | Write-only OCI private-key passphrase. |
+| `--region <value>` | No | OCI home region. |
 | `--name <displayName>` | No | Alias for --display-name. |
 
 </CommandTable>

diff --git a/apps/docs/content/docs/integrations/meta.json b/apps/docs/content/docs/integrations/meta.json
@@ -185,6 +185,7 @@
     "notion",
     "notion-service-account",
     "obsidian",
+    "oci_events",
     "okta",
     "onedrive",
     "onepassword",

diff --git a/apps/docs/content/docs/integrations/oci_events.mdx b/apps/docs/content/docs/integrations/oci_events.mdx
@@ -0,0 +1,175 @@
+---
+title: OCI Events
+description: Discover and manage OCI event routing rules
+---
+
+import { BlockInfoCard } from "@/components/ui/block-info-card"
+
+<BlockInfoCard 
+  type="oci_events"
+  color="#FFFFFF"
+/>
+
+## Usage Instructions
+
+Manage OCI Events rules using a reusable OCI API signing-key credential. List and inspect rules, create routing to existing Notifications topics, Streaming streams or Functions, update conditions and enabled states, move rules, and delete rules. Conditions match events in the rule compartment and child compartments. Updates replace supplied actions and tag maps; omit fields to retain them and use an ETag to protect concurrent changes. IAM must permit rule management and the selected action destinations. Sim limits requests to 1 MiB, responses to 8 MiB and each JSON input to 10000 values, 32 nesting levels and 1 MiB of text. This integration manages routing configuration; it does not receive events or start Sim workflows. Topic subscriptions, stream consumption and function management belong to their respective services.
+
+
+
+## Actions
+
+### OCI Events List Rules
+
+List one page of OCI Events rules in a compartment
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `oauthCredential` | string | Yes | Reusable OCI API signing-key credential. |
+| `region` | string | No | OCI region override; omit to use the credential region. |
+| `opcRequestId` | string | No | Optional request identifier for OCI support correlation. |
+| `compartmentId` | string | Yes | Compartment OCID for listing or creating rules. |
+| `limit` | number | No | Maximum rules on this page: 1–50; defaults to 10. |
+| `page` | string | No | Opaque nextPage from the preceding list response. |
+| `displayName` | string | No | Rule display name; list operations apply the OCI displayName filter. |
+| `lifecycleState` | string | No | Filter: CREATING, ACTIVE, INACTIVE, UPDATING, DELETING, DELETED or FAILED. |
+| `sortBy` | string | No | Sort field: TIME_CREATED, ID or DISPLAY_NAME. |
+| `sortOrder` | string | No | Sort direction: ASC or DESC. |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | number | OCI HTTP response status |
+| `opcRequestId` | string | OCI request identifier |
+| `rules` | array | One page of rule summaries; actions require Get Rule |
+| `nextPage` | string | Opaque continuation token |
+
+### OCI Events Get Rule
+
+Get an OCI Events rule with its actions and ETag
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `oauthCredential` | string | Yes | Reusable OCI API signing-key credential. |
+| `region` | string | No | OCI region override; omit to use the credential region. |
+| `opcRequestId` | string | No | Optional request identifier for OCI support correlation. |
+| `ruleId` | string | Yes | Rule OCID, from List Rules or a previous rule response. |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | number | OCI HTTP response status |
+| `opcRequestId` | string | OCI request identifier |
+| `rule` | json | Rule configuration including its actions |
+| `etag` | string | ETag for conditional updates, moves or deletion |
+
+### OCI Events Create Rule
+
+Create an OCI Events rule routing matching events to existing action resources
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `oauthCredential` | string | Yes | Reusable OCI API signing-key credential. |
+| `region` | string | No | OCI region override; omit to use the credential region. |
+| `opcRequestId` | string | No | Optional request identifier for OCI support correlation. |
+| `compartmentId` | string | Yes | Compartment OCID for listing or creating rules. |
+| `displayName` | string | Yes | Rule display name; list operations apply the OCI displayName filter. |
+| `description` | string | No | Rule description, up to 1024 characters. An explicit empty string clears it on update. |
+| `isEnabled` | boolean | Yes | Whether the rule is enabled. Omit on update to keep the current state. |
+| `condition` | json | Yes | JSON filter object, for example \{"eventType":"com.oraclecloud.objectstorage.createbucket"\}. Explicit \{\} matches all compartment and child-compartment events. Replaces the condition on update. |
+| `actions` | json | Yes | Array of 1–10 actions. Each requires actionType, isEnabled and topicId \(ONS\), streamId \(OSS\) or functionId \(FAAS\); description is optional. Replaces all actions on update. No action IDs or lifecycle fields. |
+| `freeformTags` | json | No | Map of tag names to string values. Replaces all freeform tags on update; \{\} clears them. |
+| `definedTags` | json | No | Map of tag namespaces to tag-name/string-value maps. Replaces defined tags on update; \{\} clears them. |
+| `opcRetryToken` | string | No | Optional stable retry token, 1–64 characters. Reuse for retries of the same create or move request. |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | number | OCI HTTP response status |
+| `opcRequestId` | string | OCI request identifier |
+| `rule` | json | Rule configuration including its actions |
+| `etag` | string | ETag for conditional updates, moves or deletion |
+
+### OCI Events Update Rule
+
+Update rule settings and replace supplied conditions, actions or tags
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `oauthCredential` | string | Yes | Reusable OCI API signing-key credential. |
+| `region` | string | No | OCI region override; omit to use the credential region. |
+| `opcRequestId` | string | No | Optional request identifier for OCI support correlation. |
+| `ruleId` | string | Yes | Rule OCID, from List Rules or a previous rule response. |
+| `displayName` | string | No | Rule display name; list operations apply the OCI displayName filter. |
+| `description` | string | No | Rule description, up to 1024 characters. An explicit empty string clears it on update. |
+| `isEnabled` | boolean | No | Whether the rule is enabled. Omit on update to keep the current state. |
+| `condition` | json | No | JSON filter object, for example \{"eventType":"com.oraclecloud.objectstorage.createbucket"\}. Explicit \{\} matches all compartment and child-compartment events. Replaces the condition on update. |
+| `actions` | json | No | Array of 1–10 actions. Each requires actionType, isEnabled and topicId \(ONS\), streamId \(OSS\) or functionId \(FAAS\); description is optional. Replaces all actions on update. No action IDs or lifecycle fields. |
+| `freeformTags` | json | No | Map of tag names to string values. Replaces all freeform tags on update; \{\} clears them. |
+| `definedTags` | json | No | Map of tag namespaces to tag-name/string-value maps. Replaces defined tags on update; \{\} clears them. |
+| `ifMatch` | string | No | ETag from Get Rule; mutation fails if the rule changed since that read. |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | number | OCI HTTP response status |
+| `opcRequestId` | string | OCI request identifier |
+| `rule` | json | Rule configuration including its actions |
+| `etag` | string | ETag for conditional updates, moves or deletion |
+
+### OCI Events Delete Rule
+
+Delete an OCI Events rule, optionally matching an ETag
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `oauthCredential` | string | Yes | Reusable OCI API signing-key credential. |
+| `region` | string | No | OCI region override; omit to use the credential region. |
+| `opcRequestId` | string | No | Optional request identifier for OCI support correlation. |
+| `ruleId` | string | Yes | Rule OCID, from List Rules or a previous rule response. |
+| `ifMatch` | string | No | ETag from Get Rule; mutation fails if the rule changed since that read. |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | number | OCI HTTP response status |
+| `opcRequestId` | string | OCI request identifier |
+
+### OCI Events Change Rule Compartment
+
+Move an OCI Events rule to another compartment in the same tenancy
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `oauthCredential` | string | Yes | Reusable OCI API signing-key credential. |
+| `region` | string | No | OCI region override; omit to use the credential region. |
+| `opcRequestId` | string | No | Optional request identifier for OCI support correlation. |
+| `ruleId` | string | Yes | Rule OCID, from List Rules or a previous rule response. |
+| `destinationCompartmentId` | string | Yes | Destination compartment OCID in the same tenancy; moving changes event matching scope. |
+| `ifMatch` | string | No | ETag from Get Rule; mutation fails if the rule changed since that read. |
+| `opcRetryToken` | string | No | Optional stable retry token, 1–64 characters. Reuse for retries of the same create or move request. |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | number | OCI HTTP response status |
+| `opcRequestId` | string | OCI request identifier |
+
+
diff --git a/apps/docs/openapi-v2-resources.json b/apps/docs/openapi-v2-resources.json
@@ -13928,6 +13928,36 @@
             "type": "string",
             "minLength": 1,
             "maxLength": 255
+          },
+          "tenancyOcid": {
+            "description": "OCI tenancy OCID.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 255
+          },
+          "userOcid": {
+            "description": "OCI user OCID.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 255
+          },
+          "fingerprint": {
+            "description": "OCI API-key fingerprint.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
+          },
+          "privateKeyPassphrase": {
+            "description": "Write-only OCI private-key passphrase.",
+            "writeOnly": true,
+            "type": "string",
+            "maxLength": 4096
+          },
+          "region": {
+            "description": "OCI home region.",
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128
           }
         },
         "additionalProperties": false,

diff --git a/apps/sim/app/api/credentials/route.test.ts b/apps/sim/app/api/credentials/route.test.ts
@@ -345,4 +345,68 @@ describe('POST /api/credentials', () => {
       expect(dbChainMockFns.insert).not.toHaveBeenCalled()
     })
   })
+
+  it('forwards OCI API-key fields without returning secret material', async () => {
+    mockVerifyAndBuildServiceAccountSecret.mockResolvedValueOnce({
+      providerId: 'oci-api-key-service-account',
+      encryptedServiceAccountKey: 'encrypted-oci-blob',
+      displayName: 'ocid1.user.oc1..principal',
+      auditMetadata: {
+        principalKind: 'user',
+        principalId: 'ocid1.user.oc1..principal',
+      },
+      principal: { kind: 'user', id: 'ocid1.user.oc1..principal' },
+    })
+    queueTableRows(credential, [])
+    queueTableRows(credential, [])
+    queueTableRows(credential, [
+      {
+        id: 'credential-oci',
+        workspaceId: WORKSPACE_ID,
+        type: 'service_account',
+        displayName: 'ocid1.user.oc1..principal',
+        description: null,
+        unredacted: false,
+        providerId: 'oci-api-key-service-account',
+        accountId: null,
+        envKey: null,
+        envOwnerUserId: null,
+        encryptedServiceAccountKey: 'encrypted-oci-blob',
+        createdBy: 'user-1',
+        createdAt: new Date('2026-08-11T00:00:00.000Z'),
+        updatedAt: new Date('2026-08-11T00:00:00.000Z'),
+      },
+    ])
+
+    const response = await POST(
+      createMockRequest('POST', {
+        workspaceId: WORKSPACE_ID,
+        type: 'service_account',
+        providerId: 'oci-api-key-service-account',
+        tenancyOcid: 'ocid1.tenancy.oc1..tenant',
+        userOcid: 'ocid1.user.oc1..principal',
+        fingerprint: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff',
+        privateKey: '-----BEGIN PRIVATE KEY-----\nkey\n-----END PRIVATE KEY-----',
+        privateKeyPassphrase: ' exact passphrase ',
+        region: 'us-ashburn-1',
+      })
+    )
+    const body = await response.text()
+
+    expect(response.status).toBe(201)
+    expect(mockVerifyAndBuildServiceAccountSecret).toHaveBeenCalledWith(
+      'oci-api-key-service-account',
+      expect.objectContaining({
+        tenancyOcid: 'ocid1.tenancy.oc1..tenant',
+        userOcid: 'ocid1.user.oc1..principal',
+        fingerprint: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff',
+        privateKey: '-----BEGIN PRIVATE KEY-----\nkey\n-----END PRIVATE KEY-----',
+        privateKeyPassphrase: ' exact passphrase ',
+        region: 'us-ashburn-1',
+      })
+    )
+    expect(body).not.toContain('PRIVATE KEY')
+    expect(body).not.toContain('exact passphrase')
+    expect(body).not.toContain('encrypted-oci-blob')
+  })
 })
diff --git a/apps/sim/app/api/v2/credentials/[credentialId]/route.test.ts b/apps/sim/app/api/v2/credentials/[credentialId]/route.test.ts
@@ -121,6 +121,33 @@ describe('PATCH /api/v2/credentials/[credentialId]', () => {
     expect(body).not.toContain('MUST_NOT_LEAK_CIPHERTEXT')
   })
 
+  it('forwards a complete OCI rotation tuple with an omitted replacement passphrase', async () => {
+    const request = patchRequest({
+      tenancyOcid: 'ocid1.tenancy.oc1..tenant',
+      userOcid: 'ocid1.user.oc1..replacement',
+      fingerprint: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff',
+      privateKey: '-----BEGIN PRIVATE KEY-----\nreplacement\n-----END PRIVATE KEY-----',
+      region: 'us-ashburn-1',
+    })
+    const response = await PATCH(request, context)
+
+    expect(response.status).toBe(200)
+    expect(mocks.update).toHaveBeenCalledWith({
+      principal: auth.principal,
+      input: {
+        tenancyOcid: 'ocid1.tenancy.oc1..tenant',
+        userOcid: 'ocid1.user.oc1..replacement',
+        fingerprint: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff',
+        privateKey: '-----BEGIN PRIVATE KEY-----\nreplacement\n-----END PRIVATE KEY-----',
+        region: 'us-ashburn-1',
+        credentialId: CREDENTIAL_ID,
+        assertedWorkspaceId: WORKSPACE_ID,
+      },
+      request,
+    })
+    expect(JSON.stringify(await response.json())).not.toContain('PRIVATE KEY')
+  })
+
   it('clears a description with an explicit null and leaves an omitted field alone', async () => {
     await PATCH(patchRequest({ description: null }), context)