Oracle EPM Automate copyToSftp — Eliminate the Middleman: Direct Cloud-to-SFTP File Transfers!

If you've been running Oracle EPM Cloud automations for any length of time, chances are your file transfer workflow looks something like this: run a data export in EPM Cloud, download the file to an intermediary server using downloadFile, then use a third-party SFTP client (like WinSCP) to upload it to the destination SFTP server. It works — but it's clunky, introduces unnecessary dependencies, and creates security exposure by landing sensitive financial data on a local disk.

What if I told you there's a single command that sends files directly from EPM Cloud to any SFTP server — no local download, no third-party tools, no files touching intermediate servers?

Meet copyToSftp.

In this post, I'll walk through what copyToSftp does, the authentication methods it supports (including the newly introduced SSH key-based auth), the prerequisites, and — most importantly — the real-world lessons I learned while implementing it for a production FCCS-to-Adaptive integration at a client site.

 

The Problem: The Traditional 5-Step Relay

Before copyToSftp, a typical EPM-to-SFTP automation looked like this:

EPM Cloud ──downloadFile──▶ Local Server ──WinSCP──▶ SFTP Server

The full workflow:

1. epmautomate runDataRule — Generate the extract in EPM Cloud
2. epmautomate downloadFile — Download to local server inbox
3. Rename-Item — Rename with timestamp for versioning
4. WinSCP PutFiles() — Upload to destination SFTP
5. Move-Item — Archive locally

Dependencies required:

• WinSCP .NET assembly (WinSCPnet.dll)
• Stored SFTP credentials (sftp_credential.xml via DPAPI)
• Local inbox and Archive directories
• Network connectivity from local server to SFTP

 

 

The Solution: copyToSftp — One Command, Zero Intermediaries

The copyToSftp command copies a file directly from an EPM Cloud environment to an SFTP server. No downloading. No local staging. No third-party libraries.

 

EPM Cloud ──copyToSftp──▶ SFTP Server

 

The new workflow:

1. epmautomate runDataRule — Generate the extract in EPM Cloud
2. epmautomate copyToSftp — Send directly to SFTP ✅

That's it. Two steps.

 

 

 

 

Authentication Methods

As of the April 2026 update, copyToSftp supports three authentication methods:

 

Method 1: Username + Password

The simplest approach — provide SFTP credentials directly.

 

epmautomate copyToSftp sftp://myserver/dir/file.csv myFile.csv username=jDoe password=myPassword

  

Pros	Cons
Simple setup	Password in plain text on command line
No key management	EPM warns about clear-text passwords
Works with most SFTP servers	Less secure for automation

Method 2: Username + Private Key (Unprotected)

SSH key-based authentication without a passphrase — ideal for automated scripts.

epmautomate copyToSftp sftp://myserver/dir/file.csv myFile.csv username=jDoe privateKey=C:\keys\my_key.pem

Pros	Cons
No password transmitted	Key file must be secured on disk
Industry best practice	Unprotected key = risk if server compromised
Automation-friendly	Requires .pem format
No clear-text warning

Method 3: Username + Private Key + Passphrase

The most secure option — the private key itself is encrypted with a passphrase.

epmautomate copyToSftp sftp://myserver/dir/file.csv myFile.csv username=jDoe privateKey=C:\keys\my_key.pem passphrase=myPassPhrase

Pros	Cons
Highest security	Passphrase on command line (use -p param file)
Key + passphrase = two-factor	Slightly more complex setup
Meets compliance requirements

Command Syntax

epmautomate copyToSftp SFTP_SERVER_URL EPM_FILE_NAME

    username=USERNAME

    [password=PASSWORD]

    [privateKey=KEY_FILE]

    [passphrase=PASSPHRASE]

 

Parameter	Description	Required?
SFTP_SERVER_URL	Full SFTP URL including directory and target filename	Yes
EPM_FILE_NAME	Name of the file in EPM Cloud (outbox)	Yes
username	SFTP user account	Yes
password	SFTP password (if not using key auth)	Conditional
privateKey	Full local path to .pem private key file	Conditional
passphrase	Passphrase for encrypted private keys	Optional

 

Supported Cryptographic Algorithms

The SFTP server must support at least one algorithm from each category:

Category	Supported Algorithms
Ciphers	chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com, aes128-cbc, aes192-cbc, aes256-cbc
MACs	hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1
Key Exchange	curve25519-sha256, ecdh-sha2-nistp256/384/521, diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, and others
Host Key	ecdsa-sha2-nistp256/384/521, ssh-ed25519, rsa-sha2-256/512, ssh-rsa, and certificate variants

---

 

Prerequisites

Before using copyToSftp, ensure the following are in place:

 

1. EPM Automate Installed and Updated

• Latest version of EPM Automate CLI installed on your automation server
• Java Runtime Environment (JRE) configured

 

2. EPM Cloud Login

• Valid Service Administrator credentials
• Encrypted password file (pass.epw) recommended:

epmautomate encrypt YourPassword pass.epw AnyRandomKey

 

3. SFTP Server on Port 22

• copyToSftp supports port 22 only — non-standard ports are not supported

 

4. Private Key in .pem Format (for key-based auth)

• The key must be in PEM format (e.g., -----BEGIN EC PRIVATE KEY-----)
• Supported key types: RSA, ECDSA (nistp256/384/521), Ed25519
• The file must be stored locally on the machine running EPM Automate (not uploaded to EPM Cloud)

 

5. IP Allowlisting (if applicable)

• If the SFTP server has IP allowlisting enabled, add Oracle's outbound IP address for the OCI region hosting your EPM environment

 

6. Public Key on SFTP Server

• The corresponding public key must be added to the authorized_keys file on the SFTP server under the appropriate user account

 

Real-World Implementation: FCCS → Adaptive via SFTP

Here's where theory meets reality. I implemented copyToSftp for a production FCCS-to-Adaptive integration, replacing a WinSCP-based pipeline that had been running for months. Below are the actual findings, errors encountered, and solutions discovered.

 

The Setup

Component	Detail
Source	Oracle FCCS (Test Instance)
Destination	awssftp1.brooksautomation.com
Auth	ECDSA private key (-----BEGIN EC PRIVATE KEY-----)
Username	fccs
Files	DLR_Data_Extract_JE.csv, DLR_Data_Extract_AllEntities.csv

The private key file must reside on the local machine running EPM Automate. The command reads it locally and uses it for the SSH handshake.

 

 

• File Extension Must Be .pem

 

• Do NOT Include password= with Key Auth

When using key-based auth, the password= parameter must be omitted entirely. Including it — even with a dummy value — causes a parsing failure.

 

• PowerShell Mangles key=value Arguments in Scripts

 

Even after placing the .pem file in the correct directory, EPM Automate reported "File does not exist."

 

The Java process running EPM Automate operates under a different security context. The file existed but wasn't readable.

 

The Final Working Command

After all the troubleshooting, here's the exact command that works:

 

epmautomate copyToSftp sftp://awssftp.server.com/DLR_Data_Extract_JE.csv DLR_Data_Extract_JE.csv username=fccs privateKey=C:\Scripts\secure\privatekey-sftp.pem

 

 

Before vs. After Comparison

Metric	Before (downloadFile + WinSCP)	After (copyToSftp)
Steps per file	5	2
Dependencies	WinSCP DLL, credential XML, inbox/archive folders	None — EPM Automate only
Data on local disk	Yes	Never
Auth method	Password (DPAPI encrypted)	SSH key (.pem)
Security exposure	Password + files on intermediary server	Key-only, zero local data
Lines of PowerShell	~80 (SFTP section)	~10
Failure points	Download, rename, connect, upload, archive	Single copyToSftp call

---

 

Pipeline Alternative: No Script Needed

As of the September 2025 update, Oracle also introduced Copy to SFTP and Copy from SFTP as native Pipeline job types in EPM Cloud. This means you can configure the entire extract-and-push flow within the EPM Cloud UI — no PowerShell script required.

This is worth exploring if you want to move the orchestration entirely into EPM Cloud and eliminate the local server dependency altogether.

 

Quick Reference: Troubleshooting Checklist

Error	Cause	Fix
EPMAT-7: File does not exist	Wrong path, wrong extension, or permissions	Use full path, .pem extension, grant read access
EPMAT-7: Invalid or missing parameter: privateKey	Empty privateKey= value or space after =	No space: privateKey=C:\path\key.pem
EPMAT-7: Invalid or missing parameter: password	password= included with key auth	Remove password= entirely
Usage text dumps before error	PowerShell mangling key=value args	Use cmd /c or --% in scripts
EPMAT-7: Session is not authenticated	Not logged in before copyToSftp	Run epmautomate login first
EPMAT-1: File already exists	File from previous upload still in EPM	Run epmautomate deleteFile first
Connection timeout	IP not allowlisted on SFTP server	Add Oracle OCI outbound IP to SFTP allowlist

---

 

Conclusion

copyToSftp is one of those features that fundamentally simplifies your EPM automation architecture. It eliminates intermediary servers, third-party dependencies, and local data exposure — replacing a fragile 5-step relay with a single, secure, auditable command.

Combined with the April 2026 enhancement for SSH key-based authentication, it now meets enterprise compliance requirements for secure file transfers without compromising on automation capability.

 

Whether you're pushing FCCS extracts to Adaptive, sending reconciliation data to FloQast, or transferring reports to any SFTP endpoint — copyToSftp should be your default approach.

 

Key takeaways:

•  Use .pem format for private keys
•  Omit password= when using key auth
•  Use cmd /c in PowerShell scripts to avoid argument parsing issues
•  Grant file read permissions for the Java process
•  Allowlist Oracle's OCI outbound IP on your SFTP server
•  Consider Pipeline job types for fully cloud-native orchestration

Happy days on the Cloud!!! 

Oracle Cloud EPM : Two Long-Awaited Pipeline Features That Change Everything!

 The Oracle Cloud EPM May 2026 (26.05) update is packed with meaningful enhancements — from the mandatory Groovy engine upgrade to the new Environment Backup capability. But for those of us who live and breathe Data Integration Pipelines, two features stand out as absolute game-changers that the EPM community has been requesting for a long time:

 

1. Ability to Restart Pipelines from Failed Stages
2. Ability to Control Timing within Pipeline Jobs (Wait Job Type)

Oracle Cloud EPM August 2026 Update – Important Actions and Considerations

Oracle Cloud EPM August 2026 Update – Important Actions and Considerations

Introduction

 

Oracle Cloud EPM continues to evolve with security improvements, governance enhancements, Groovy validation updates, metadata handling changes, and upcoming permission model adjustments. Organizations using Planning, FCCS, EDMCS, PCMCS, EPCM, FreeForm, Tax Reporting, and Account Reconciliation should carefully review the latest Important Actions and Considerations to avoid operational disruptions.

This article provides a detailed enterprise-level explanation of the key updates announced for the Oracle Cloud EPM August 2026 release cycle.

 

Oracle EPM April 2026: New Migration REST APIs for Smarter Environment Lifecycle Management - Part 2

In Part 1, we discussed why migration is painful in real life — not because exporting/importing is difficult, but because we rarely know exactly what changed between environments. Oracle’s April 2026 update addresses this by introducing a set of Migration REST APIs designed for programmatic lifecycle management.

Part1 focused on the foundational capabilities:

• Discovering artifact categories
• Listing artifacts per category
• Exporting incremental category-level backups

 

Oracle EPM April 2026: New Migration REST APIs for Smarter Environment Lifecycle Management - Part 1

Oracle EPM April 2026: New Migration REST APIs for Smarter Environment Lifecycle Management

Part 1 – Understanding the Problem and the New Capabilities

Why This Matters More Than Ever

Managing Oracle EPM environments has never been simple. Most customers operate at least three environments – Development, Test, and Production. In many cases, there are additional environments for UAT, Training, or parallel initiatives. Traditionally, moving changes across these environments meant relying heavily on full snapshots, manual comparisons, and a fair amount of administrator intuition.

 

The biggest challenge was not moving artifacts, but understanding what actually changed:

• Which rules were modified since the last release?
• Which forms were impacted by a requirement change?
• What security or metadata moved unintentionally?

Break Glass – Putting You in Control of Access & Encryption in Oracle EPM.

 Oracle EPM April 2026: Break Glass – Putting You in Control of Access & Encryption

Why This Matters More Than Ever

 

One of the most common questions I hear from security teams, auditors, and CISOs is:

“Who from Oracle can access our EPM data, and how do we control it?”

With the April 2026 (26.04) update, Oracle has delivered a long‑awaited answer by introducing Break Glass for Oracle EPM Cloud — a governance‑first capability designed for organizations that care deeply about data sovereignty, compliance, and zero‑trust principles.

Break Glass is not just another toggle in the UI. It fundamentally changes the access model between Oracle Operations and your EPM environments.

 

Oracle EPM April 2026: Two Quiet Changes That Can Break Your Automations

The April 2026 (26.04) Oracle EPM update looks calm on the surface — but behind the scenes, two technical changes can impact almost every EPM technical team if they’re not spotted early.

This blog focuses on only two changes, but both are high‑risk if ignored:

1. EPM Automate – Windows installation path change
2. Groovy rules – HTTP (insecure) authentication now disallowed

Both are documented by Oracle, but neither will show up as a shiny UI banner. If you rely on automation, scripts, or Groovy‑based integrations, this blog is for you.

All About Oracle EPM FreeForm!!

 If you’ve ever tried to force a complex planning or reporting problem into a standard Planning application, you already know the pain: required dimensions that don’t fit, workaround hierarchies, and logic that feels “almost right”—but never quite clean.

That’s exactly the gap Oracle FreeForm apps were designed to fill.

FreeForm is not a lighter version of Planning, and it’s not just Essbase in the cloud. It’s Oracle EPM’s most flexible application type, built for scenarios where your business model should dictate the structure—not the other way around.                                   Refer Doc -[docs.oracle.com]

 

All about Advanced Predictions in Oracle EPM.

Advanced Predictions – Why This Feature Matters

Forecasting in the real world is rarely driven by a single number. Revenue is influenced by pricing, promotions, volume, market growth, seasonality, macro‑economic conditions, and many other factors. Until now, Oracle EPM’s Auto Predict and Predictive Planning features looked at only one measure at a time, which limited how realistic and explainable forecasts could be.

With the August 2025 Oracle Cloud EPM release, Oracle introduces Advanced Predictions – a significant shift toward driver‑based, machine‑learning forecasting that feels native to finance teams, not data scientists.

Unlocking EPM Power: Get User Variables with Oracle Planning REST APIs!

Retrieving User Variables in Oracle EPM Using REST APIs

If you’re building integrations with Oracle Enterprise Performance Management (EPM), sooner or later you’ll run into User Variables. They are everywhere—driving form personalization, security filters, default selections, and even calculation behavior.

The good news? Oracle EPM provides powerful REST APIs that let you retrieve user variable values programmatically.

In this blog, we’ll break down two commonly used REST APIs:

• GetUserVariablesForUser
• GetUserVariablesForUserAndMember

You’ll learn:

• What user variables are and why they matter
• When to use each API
• How to call them
• What the response looks like
• Common real‑world use cases

All examples and explanations are provided with reference 

 

What Are User Variables in Oracle EPM?

User Variables are configurable placeholders that dynamically resolve to dimension members based on the logged‑in user. They are widely used across Planning, FreeForm, FCC, and other EPM modules to personalize the experience.

Typical use cases include:

• Default Entity, Version, or Scenario for a user
• Security‑driven data access
• Dynamic filtering in forms and dashboards
• Personalized calculations and rules

From a technical perspective, user variables help avoid hardcoding dimension members and allow applications to scale across users with different responsibilities. [docs.oracle.com]

 

Why Retrieve User Variables via REST APIs?

While user variables are usually set and managed through the UI, integrations often need them programmatically. Common scenarios include:

• External applications that need to respect EPM personalization
• AI agents or middleware dynamically resolving context
• Audit and validation of user setup
• Mass analysis of user configurations
• Integration testing and automation

Oracle addresses these needs through the User Variable Values REST APIs available in Planning REST API v3. [docs.oracle.com]

 

API #1 - What This API Does

This API retrieves ser variable values set for all users and for all user variables defined for the application.

 

REST Endpoint

GET {{BASE_URL}}/HyperionPlanning/rest/v3/applications/EPBCS/uservariablevalues

Response

API #2 - What This API Does

To retrieve user variable values set for all users for a user variable with a specific name.

REST Endpoint  

GET {{BASE_URL}}/ /HyperionPlanning/rest/v3/applications/EPBCS/uservariablevalues/Asset - Buy

API #3 - What This API Does

GET {{BASE_URL}}//HyperionPlanning/rest/v3/applications/EPBCS/uservariablevalues?q={"userName":"dayalan.example@example.com"}

to retrieve user variable values for one or more users.

Example Use Case

• An external planning portal needs to open with the same defaults as EPM
• A batch job validates that users have all mandatory variables assigned
• AI‑driven workflows resolve default dimension context before executing rules

 

 

Security and Access Considerations

• Service Administrators can retrieve variables for any user
• Regular users can retrieve only their own variables
• APIs follow standard EPM REST authentication (Basic Auth or OAuth2)

Oracle also enhanced these APIs in recent releases to allow retrieving multiple users’ variables in a single request, improving performance for administrative use cases. [docs.oracle.com]

 

Real‑World Integration Patterns

Here’s how these APIs are commonly used in modern EPM architectures:

• AI agents translating natural language into EPM actions
• Data pipelines aligning user context across systems
• Automated testing validating environment consistency

If you’re building an EPM Control Center, middleware, or AI‑driven workflow, user variables are often the first API call you make.

 

Final Thoughts

User variables may look simple on the surface, but they are foundational to personalization and security in Oracle EPM. Oracle’s REST APIs make it easy to retrieve them in a clean, scalable, and secure way.

 

If you’re building advanced integrations or AI‑powered solutions on Oracle EPM, mastering these APIs is a must.

 

 Happy days on the cloud!