# Oracle EBS FND_USER_PKG Script Generator: API to Create User, Add Responsibility and Reset Password

> Source: https://netray.co/tools/oracle-ebs-fnd-user-pkg-script-generator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Generates four FND_USER_PKG blocks for Oracle EBS R12 (CREATEUSER, ADDRESP, CHANGEPASSWORD, DELRESP) plus SQL to verify the user and responsibility rows.

## Category

developer

## Erp

Oracle E-Business Suite

## Audience

- EBS administrator
- Oracle Apps technical consultant
- Security administrator

## Tool

**Kind:** template

**Output:** code

**Language:** sql

**Fields:**

#### User name

**Key:** user_name

**Type:** text

**Default:** JSMITH

#### Initial / new password

**Key:** password

**Type:** text

**Default:** Welcome#2026

**Help:** Must meet your SIGNON_PASSWORD_LENGTH, SIGNON_PASSWORD_HARD_TO_GUESS and related profile rules.

#### Email address

**Key:** email

**Type:** text

**Default:** jsmith@example.com

#### Employee PERSON_ID (or NULL)

**Key:** person_id

**Type:** text

**Default:** NULL

**Help:** PER_ALL_PEOPLE_F.PERSON_ID, unquoted. Leave NULL for non-employees.

#### Start date

**Key:** start_date

**Type:** date

**Default:** 2026-10-22

#### Responsibility application short name

**Key:** resp_app

**Type:** text

**Default:** INV

#### Responsibility key

**Key:** resp_key

**Type:** text

**Default:** XX_INV_INQUIRY

**Help:** FND_RESPONSIBILITY.RESPONSIBILITY_KEY, not the display name.

#### Security group key

**Key:** sec_group

**Type:** text

**Default:** STANDARD

#### Assignment description

**Key:** resp_desc

**Type:** text

**Default:** Added by script, ticket CHG-1042

#### End date for removal (Block 4)

**Key:** end_date

**Type:** date

**Default:** 2026-12-31

**Help:** Used only in the commented ADDRESP call in Block 4 for a future end date; DELRESP itself end-dates as of today.

**Blocks:**

#### Block 1: create the user

**Body:** BEGIN
  FND_USER_PKG.CREATEUSER(
    x_user_name            => UPPER('{{user_name}}'),
    x_owner                => NULL,
    x_unencrypted_password => '{{password}}',
    x_start_date           => TO_DATE('{{start_date}}', 'YYYY-MM-DD'),
    x_email_address        => '{{email}}',
    x_employee_id          => {{person_id}});
  COMMIT;
END;
/

#### Block 2: add a responsibility

**Body:** BEGIN
  FND_USER_PKG.ADDRESP(
    username       => UPPER('{{user_name}}'),
    resp_app       => '{{resp_app}}',
    resp_key       => '{{resp_key}}',
    security_group => '{{sec_group}}',
    description    => '{{resp_desc}}',
    start_date     => TO_DATE('{{start_date}}', 'YYYY-MM-DD'),
    end_date       => NULL);
  COMMIT;
END;
/

#### Block 3: reset the password

**Body:** SET SERVEROUTPUT ON
DECLARE
  l_ok BOOLEAN;
BEGIN
  l_ok := FND_USER_PKG.CHANGEPASSWORD(
            username    => UPPER('{{user_name}}'),
            newpassword => '{{password}}');
  IF l_ok THEN
    COMMIT;
    DBMS_OUTPUT.PUT_LINE('Password changed');
  ELSE
    ROLLBACK;
    DBMS_OUTPUT.PUT_LINE('Password change failed: ' || FND_MESSAGE.GET);
  END IF;
END;
/

#### Block 4: end-date a responsibility

**Body:** -- DELRESP end-dates the assignment (it does not delete the row)
BEGIN
  FND_USER_PKG.DELRESP(
    username       => UPPER('{{user_name}}'),
    resp_app       => '{{resp_app}}',
    resp_key       => '{{resp_key}}',
    security_group => '{{sec_group}}');
  COMMIT;
END;
/

-- To end-date on a future date ({{end_date}}) instead, call ADDRESP again with end_date set:
-- FND_USER_PKG.ADDRESP(username => UPPER('{{user_name}}'), resp_app => '{{resp_app}}', resp_key => '{{resp_key}}',
--   security_group => '{{sec_group}}', description => '{{resp_desc}}',
--   start_date => TO_DATE('{{start_date}}', 'YYYY-MM-DD'), end_date => TO_DATE('{{end_date}}', 'YYYY-MM-DD'));

#### Verification SQL

**Body:** SELECT u.user_id, u.user_name, u.start_date, u.end_date, u.email_address,
       u.employee_id, u.password_date, u.last_logon_date
FROM   fnd_user u
WHERE  u.user_name = UPPER('{{user_name}}');

SELECT u.user_name, r.responsibility_key, r.responsibility_name,
       d.start_date, d.end_date
FROM   fnd_user_resp_groups_direct d
JOIN   fnd_user u
       ON u.user_id = d.user_id
JOIN   fnd_responsibility_vl r
       ON  r.responsibility_id = d.responsibility_id
       AND r.application_id    = d.responsibility_application_id
WHERE  u.user_name = UPPER('{{user_name}}')
ORDER  BY r.responsibility_name;

**Notes:** Run as APPS in a session that is not inside a running request. Confirm parameter names with SELECT object_name, argument_name, position FROM all_arguments WHERE owner = 'APPS' AND package_name = 'FND_USER_PKG' AND object_name IN ('CREATEUSER','ADDRESP','CHANGEPASSWORD','DELRESP'). Whether the user is forced to change the password at next login depends on PASSWORD_DATE; check it with the verification SQL rather than assuming.

## Content

**Intro:** This generator writes the FND_USER_PKG calls Oracle E-Business Suite administrators use to script user maintenance: create a user, add a responsibility, reset a password and end-date a responsibility, with SQL to check the result. It targets EBS 12.1 and 12.2.

**Sections:**

#### How to use it

**Body:** Enter the user name, a password that satisfies your password profiles, email and, for employees, the HR PERSON_ID (unquoted, or NULL). For responsibilities, enter the application short name and RESPONSIBILITY_KEY, which differs from the display name; find it with SELECT responsibility_key, responsibility_name FROM fnd_responsibility_vl WHERE responsibility_name LIKE '...'. The security group is STANDARD unless you run security groups. Run only the blocks you need, then the verification SQL. Keep the script in your change ticket rather than editing users ad hoc.

**Bullets:**

- CREATEUSER fails if the user name already exists
- ADDRESP on an existing assignment updates its dates and description
- Never paste production passwords into shared scripts; use a one-time password

#### Why the API and not table inserts

**Body:** A user and their responsibilities are stored in FND_USER and FND_USER_RESP_GROUPS_DIRECT, but the API also maintains what the tables do not show: the encrypted password, and the Workflow directory roles and user role assignments that drive menus, notifications and approvals. Inserting rows directly leaves the Workflow directory out of step, so users see missing responsibilities or broken worklists, and Oracle Support will not help with it. FND_USER_PKG goes through the same code path as the Define User form, so audit columns, password rules and directory synchronisation are handled.

#### Worked example and checking the result

**Body:** With the defaults, Block 1 creates JSMITH starting 22 October 2026 with an email and no employee link. Block 2 adds the XX_INV_INQUIRY responsibility under INV in the STANDARD security group. The first verification query shows the FND_USER row with START_DATE, EMPLOYEE_ID and PASSWORD_DATE; the second lists the direct responsibility assignments with their dates. After Block 4, the same row shows END_DATE set to today, and the user loses the responsibility at their next sign-on or responsibility switch. Indirect responsibilities granted through roles in User Management are not in FND_USER_RESP_GROUPS_DIRECT and are not touched by DELRESP.

#### Gotchas and audit

**Body:** Run as APPS. User names are stored in upper case, so the blocks apply UPPER. Password rules come from profiles such as Signon Password Length and Signon Password Hard to Guess; CHANGEPASSWORD returns FALSE when a rule fails. EBS stores passwords encrypted and there is no supported way to read one back, so reset rather than look up. EBS does not support deleting users: end-date them (FND_USER_PKG.DISABLEUSER) to keep history. For audit, enable Sign-On: Audit Level and keep the ticket number in the assignment description.

**Cta:** If you want access requests checked against your EBS roles and drafted as scripts for an administrator to approve, running on your own servers, we can set that up.

**Faq:**

#### What is the API to create a user in Oracle EBS R12?

**Answer:** FND_USER_PKG.CREATEUSER. Pass x_user_name, x_owner (NULL or 'CUST'), x_unencrypted_password, x_start_date, x_email_address and optionally x_employee_id, then COMMIT. It creates the FND_USER row with an encrypted password and synchronises the Workflow directory, which a direct insert would not.

#### What is the API to add a responsibility to a user?

**Answer:** FND_USER_PKG.ADDRESP with username, resp_app (application short name), resp_key (RESPONSIBILITY_KEY), security_group (usually STANDARD), description, start_date and end_date. Calling it again for an existing assignment updates the dates, which is also how you set a future end date.

#### How do I reset an Oracle Apps user password from the backend?

**Answer:** Call FND_USER_PKG.CHANGEPASSWORD(username, newpassword), check the BOOLEAN result and COMMIT if TRUE. If it returns FALSE, read FND_MESSAGE.GET for the rule that failed. There is no supported query that returns the current password; reset it instead.

#### How do I end-date a responsibility with the API?

**Answer:** FND_USER_PKG.DELRESP(username, resp_app, resp_key, security_group) end-dates the direct assignment as of today; it does not delete it, so history and audit stay intact. For a future date, call ADDRESP with the end_date you want.

## Search terms

api to create user in oracle ebs r12, oracle apps api to reset password, oracle apps api to add responsibility to user, oracle ebs responsibility end date api, how to create user in oracle ebs, fnd_user_pkg.createuser example, fnd_user_pkg.addresp, oracle apps reset user password query

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json