Flow Runtime Node Reference
Review available nodes for managed IoT flows in Oracle Cloud. Learn how to configure node connections and understand the messages nodes can send and receive.
Using the Managed Node Catalogue
The Flow Runtime editor provides standard Node-RED nodes, Oracle Database nodes and OCI integrations. Oracle Fusion Cloud SCM nodes are available as an add-on from the managed module list. Select a node to read its help and open its editor to configure it. The tables identify palette labels and, where different, the saved node type.
The Oracle Database, OCI and Fusion Cloud SCM node packages require Node-RED 2.0 or later. In a managed IoT Flow Runtime, follow the service announcement and update the Flow Runtime software to obtain the supported node packages.
Enabled nodes are available for use. An installed module can also contain Disabled nodes. Certificate and Vault Secret are installed but disabled by default because they retrieve sensitive material into messages. A collapsed category only hides palette entries; it does not disable nodes.
For existing runtimes, follow the service announcement and update the Flow Runtime software to obtain the updated nodes. Existing flow definitions migrate with the update. Reopen the editor and check the flows and node configuration after the update. Category changes do not change saved node types.
Use the managed module list for permitted add-ons. OCI manages the runtime and its node packages. Do not run the sample repository's standalone npm or Node-RED installation commands in a managed Flow Runtime.
Connections, Permissions, and Error Handling
Before deploying, create the destination resources, configure the required connection, and grant the identity used by that connection permission to perform the intended operation. Resource Principal authentication uses the Flow Runtime identity. Device MQTT and Fusion, ORDS OAuth connections use their separately configured identities.
Editor access does not authorize access to a target service, database object or Fusion business record; use the target environment's documentation release when reviewing database, ORDS and Fusion permissions.
For Resource Principal authentication, an administrator adds the Flow Runtime to a dynamic group and grants that group access to the resources used by the flow. In the policy examples below, replace <fr-dynamic-group> with the name of that dynamic group. Replace <target-compartment> with the name of the compartment containing the target queue, stream, function, metrics, log, digital twin, certificate or secret. Replace the complete placeholders, including the angle brackets; they are not environment variables or values filled in automatically. Resources in different compartments require the corresponding compartment names in their policies.
Files in the runtime's local file system can be lost during deactivation or activation.
Connect a scoped catch node to handle reported failures. OCI, ORDS, Fusion HTTP action and message-triggered database nodes report processing failures through this path. Preserve the message properties needed for recovery. Inspect the specific operation's status and result rather than assuming that every remote request completed when a message left the node.
A timeout or lost response can occur after a remote write was accepted. Check the outcome before retrying a write. Database rollback does not reverse external service side effects. Design consumers to tolerate replay, and acknowledge or commit only after the required downstream work succeeds.
Use OCI credential references in supported credential fields when the flow only needs to authenticate a connection. Avoid placing resolved secrets, private keys, authorization headers or runtime commit tokens in Debug output or logs.
Shared Configuration Nodes
For OCI Config and API Request, review the OCI IAM policy reference for the operations and resources called by the flow.
Configuration nodes hold connection settings and are selected from the related node's editor. They are additional to the palette action and source nodes listed below.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| DB Connection Type: | Shared Oracle Database connection for the database nodes. Set the connection descriptor or alias, authentication and driver mode; configure a wallet when required. Use the managed IoT domain connection where appropriate. | The connection is selected by database nodes. Preserve the managed connection's service-provided settings. Custom database connections need their own access and network configuration. |
| OCI Config Type: | Shared OCI request-signing identity and region. Prefer the Flow Runtime Resource Principal with only the required IAM permissions. Other available authentication choices require their corresponding credentials. | Used by OCI SDK/REST nodes, including Send Command and Get Content. Default Compartment OCID supplies the fallback metric compartment for Monitoring Publish/Query; other services use their own resource IDs. |
| IoT Device Type: | MQTT device connection, separate from OCI Config. Set Device Host, Client ID and device Basic or certificate authentication. OCI IoT uses MQTTS port 8883. | Used by Telemetry and Subscribe. Configure credentials for the device identity; OCI request-signing credentials do not replace them. |
| Queue Config Type: | OCI Config, Queue OCID and the queue-specific HTTPS Messages endpoint. | Shared by Queue Out, Queue In and Queue Ack. Select the same queue for receive and acknowledgement. |
| Streaming Config Type: | OCI Config, Stream OCID and the stream's native HTTPS Messages endpoint. | Shared by Streaming In and Out. Native Streaming uses a different connection from Kafka. |
| Kafka Config Type: | Bootstrap broker host:port entries and the managed Kafka SASL/SCRAM username/password. Connections use TLS with SCRAM-SHA-512. | Shared broker settings for Kafka Producer and Consumer. Keep the broker hostname for TLS validation. |
| ORDS Config Type: | ORDS Base URL, HTTPS Token URL, OAuth Client ID/Secret and optional scope. Configure request timeout and polling concurrency limits. | Shared by ORDS Request/Poll. Relative paths remain below the Base URL. Provision domain OAuth access separately; OCI Config is not an OAuth configuration. |
| SCM Server Type: | Fusion hostname without a protocol/path, REST API version, HTTPS OAuth Token URL, Client ID/Secret and Scope. Configure a proxy only when required. | Shared by Fusion HTTP action/lookup/event nodes. The credential must have access to the target Fusion operation and business data. |
Network Nodes
These nodes are enabled. Configure the destination connection and ensure that the Flow Runtime can reach it.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| http request | Send an HTTP request. Set the URL, method, authentication and response format. | The request uses the incoming message; the response is returned in msg.payload with HTTP response information. |
| mqtt in | Receive messages from an MQTT broker. Select the broker, subscription topic and QoS. | Emits received content in msg.payload and its topic in msg.topic. |
| mqtt out | Publish messages to an MQTT broker. Select the broker, destination topic and QoS. | Sends msg.payload to the configured topic or the topic supplied by the message. |
Function Nodes
These nodes are enabled. Function code runs in the managed Graal sandbox with restricted resource access and no external-library access.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| function | Run JavaScript to transform or route messages. | Return the message or messages for downstream processing. |
| switch | Route messages by rules on a message or context property. | Sends the message to matching outputs. |
| change | Set, replace, move or delete message and context properties. | Forwards the changed message. |
| range | Map a numeric value from one range to another. | Updates the selected numeric property. |
| template | Build text using a template and message values. | Places the rendered result in the configured property. |
| delay | Delay messages or limit their rate. | Forwards messages according to the delay or rate configuration. |
| trigger | Send a configured value and an optional later value after an interval. | Use the configured reset behavior to cancel or restart the sequence. |
| filter Type: | Suppress unchanged values or values within a configured change threshold. | Forwards messages that meet the configured change rule. |
Common Nodes
These nodes are enabled.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| inject | Start a flow manually or on a schedule. | Creates a message with configured properties. |
| debug | Inspect selected message properties in the Debug sidebar. | Choose a limited property; avoid displaying credentials or private data. |
| complete | React when a selected node reports that it has finished handling a message. | Completion reflects the node's completion notification. |
| catch | Handle errors reported by nodes in its configured scope. | Emits the failed message with msg.error for a recovery path. |
| status | Observe status changes reported by selected nodes. | Emits status information for a monitoring flow. |
| link in | Receive messages from linked flows. | Forwards messages received through the virtual connection. |
| link call | Call a linked flow and wait for its return. | Use a returning Link Out node and configure a suitable timeout. |
| link out | Send messages to another linked flow or return from a Link Call. | Select the appropriate destination or return mode. |
| comment | Add explanatory text to the flow workspace. | Provides documentation within the flow. |
Sequence Nodes
These nodes are enabled. Preserve sequence metadata when a downstream node needs to reconstruct a sequence.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| split | Divide a string, array, object or buffer into messages. | Adds sequence metadata to each emitted message. |
| join | Combine a message sequence into one value. | Choose automatic sequence reconstruction or a configured manual join. |
| sort | Sort an array or message sequence. | Select the property and ordering used for comparison. |
| batch | Group messages by a configured count, interval or sequence rule. | Emits grouped message sequences. |
Parser Nodes
These nodes are enabled.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| csv | Convert between CSV text and structured values. | Configure columns, delimiters and the desired output representation. |
| html | Extract elements from an HTML document. | Select elements with the configured selector and output mode. |
| json | Convert between a JSON string and a JavaScript object. | Select the property to convert and the required representation. |
| xml | Convert between XML text and a JavaScript object. | Configure the property and conversion options. |
| yaml | Convert between YAML text and a JavaScript object. | Configure the property and conversion direction. |
Storage Nodes
These nodes are enabled. Local Flow Runtime files are ephemeral. Use a configured File Storage mount or another persistent service for files that must survive deactivation and activation.
See Updating Flow Runtime Software for file preservation before an update.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| write file Type: | Write or append message content to a file. | Set the path, encoding and write behavior; restrict message-supplied paths. |
| read file Type: | Read file content into a flow. | Set the path and text or binary output format. |
| watch | Monitor configured files or directories for changes. | Emits a message when a watched change is detected. |
Oracle Database Nodes
Review Oracle Database privileges for the connected user's SQL and object access, following the managed domain's database access and delegation guidance.
Review the AQ queue privileges and security model for enqueue and dequeue access, preserving the managed domain's existing grants.
These nodes are enabled. Select a DB Connection configuration for database operations. Database commit or rollback does not undo an OCI service call or a Fusion transaction performed by another node.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| enqueue | Add messages to an Oracle AQ queue. Configure queue name, payload type and recipients when needed. | Uses the configured payload or msg.payload; successful output can include msg.count. Transactional mode joins the managed transaction; Auto-commit performs an independent committed write. |
| dequeue | Read Oracle AQ messages. Configure queue, subscriber, payload type, processing mode and optional database-side condition. | Emits each dequeued record in msg.payload and msg.dequeued. Continuous mode commits before downstream processing; use a managed transaction when rollback must protect removal. |
| sql | Run SQL using configured SQL/bind mappings or msg.sql and msg.binds. | Returns row objects in msg.payload and execution metadata in msg.dbResult. Use Begin/End Transaction for DML that must commit together. |
| begin transaction Type: | Start a managed database transaction using the selected DB Connection. | Preserve msg._dbTransaction through the processing path. The reference belongs to the running runtime. |
| end transaction Type: | Commit or roll back the managed database transaction. | Send one completion path after all transaction work finishes. Roll back failed work; a restart invalidates runtime-local transaction references. |
OCI IoT Nodes
Review IoT policies and permissions for Send Command, Get Content and Update Relationship access; MQTT Telemetry and Subscribe use the configured device authentication.
These nodes are enabled. MQTT nodes use IoT Device configuration; REST nodes use OCI Config. Configure only command types, adapters and endpoints supported by the target IoT service build.
Replace the dynamic-group and compartment placeholders with values from your tenancy. Add only the policies for the operations your flow uses.
Allow dynamic-group <fr-dynamic-group> to read iot-digital-twin-instance in compartment <target-compartment>Allow dynamic-group <fr-dynamic-group> to use iot-digital-twin-relationship in compartment <target-compartment>| Node | Configuration and Use | Messages and Results |
|---|---|---|
| send command Type: | Send a command through the OCI IoT REST API. Select OCI Config, digital twin instance OCID, exact request endpoint and optional response endpoint/durations. | Uses msg.payload as command data. Returns API response and, when supplied by the service, msg.commandStatusLocation, msg.recordId and msg.opcRequestId. API acceptance is not proof of device execution. |
| telemetry Type: | Publish telemetry using IoT Device configuration. Set the topic, QoS and optional timestamp behavior. | Uses msg.payload, with msg.topic when Topic is blank. Prefer a sample timestamp from the device or upstream flow. |
| get content Type: | Read digital twin instance content using OCI Config and an instance OCID. | msg.digitalTwinInstanceOcid overrides the target; legacy msg.digitalTwinOcid remains supported. Returns content in msg.payload and response metadata. |
| update relationship Type: | Update existing relationship content. Select OCI Config and the IoT domain; supply a relationship key and content object. | Uses msg.relationshipKey and msg.content, payload equivalents or configured defaults. Resolves the relationship before updating it; does not create twins or provide full relationship CRUD. |
| subscribe Type: | Receive device commands through an MQTT request endpoint. Select IoT Device, topic and QoS. | Starts the subscription on deployment, with no input trigger. Emits msg.payload, msg.topic and msg.topicSuffix. |
OCI Messaging Nodes
Review Queue policies for Queue Out producer access, Queue In/Ack consumer access and any separate connection-test access.
Review Notifications policies for publishing to the intended topic.
These nodes are enabled. Queue nodes use Queue Config; Notification uses OCI Config. Create the destination resources and grant the runtime access before deploying the flow.
Replace the dynamic-group and compartment placeholders with values from your tenancy. Add only the policies for the operations your flow uses.
Allow dynamic-group <fr-dynamic-group> to use queue-push in compartment <target-compartment>Allow dynamic-group <fr-dynamic-group> to use queue-pull in compartment <target-compartment>For example, if your Flow Runtime's dynamic group is IoTFlowRuntimes and the queue is in FactoryMessaging, the Queue Out policy is:
Allow dynamic-group IoTFlowRuntimes to use queue-push in compartment FactoryMessagingThe names are illustrative; replace them with your own dynamic-group and compartment names.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| notification Type: | Publish to an OCI Notifications topic. Set Topic OCID and optional title/body. | msg.topicOcid and msg.title can override configured values; body falls back to msg.payload. A publish result does not establish delivery to each subscriber. |
| queue out Type: | Send messages using Queue Config. | msg.payload supplies one message; msg.ociQueue.messages supplies an explicit batch of 1–20 entries. Returns service results in msg.ociQueue. |
| queue in Type: | Poll a queue on deployment. Configure batch limit, output mode, poll/visibility timeouts and optional channel/group. | Emits decoded payload and msg.ociQueue receipt metadata. Does not delete messages; process successfully before Queue Ack. |
| queue ack Type: | Delete successfully processed queue messages using the same Queue Config. | Preserve msg.ociQueue.receipt or aligned batch records. Partial batch failures need selective retry of failed receipts, not deletion of the whole batch again. |
OCI Services Nodes
Review Object Storage policies for bucket-scoped upload and download access.
Review Functions policies for invocation access to the selected function.
Review ORDS secure REST access for OAuth client access to protected resources, using the managed domain's ORDS OAuth setup.
API Request, Object Storage, Functions Invoke and ORDS Request/Poll are enabled. Certificate and Vault Secret are installed but disabled by default; their individual entries describe the additional handling needed for retrieved material.
Replace the dynamic-group and compartment placeholders with values from your tenancy. Add only the policies for the operations your flow uses.
Allow dynamic-group <fr-dynamic-group> to use fn-invocation in compartment <target-compartment>| Node | Configuration and Use | Messages and Results |
|---|---|---|
| object storage Type: | Upload or download objects. Select OCI Config, operation, namespace, bucket and object name. | Upload uses msg.payload, or a file when payload is absent. Download returns text/binary content and metadata. Buffered downloads default to a 16 MiB response limit; local file writes can overwrite files. |
| api request Type: | Send a signed HTTPS request to an OCI API. Configure OCI Config, full endpoint, method and response format. | Supports msg.method, msg.ociPath, msg.ociQuery and msg.ociHeaders. Returns payload, status, headers and request/work-request IDs when present. Does not automatically follow redirects or retrieve later pages. |
| ords request Type: | Send one OAuth-authenticated ORDS request. Select ORDS Config, method and a relative Custom path or an available preset. | Supports query, headers and record-ID overrides. Returns msg.payload, msg.statusCode, msg.ordsUrl and response headers. Use paths actually supported by the domain; a preset is not a feature-availability guarantee. |
| ords poll Type: | Poll ORDS until a configured condition is met. Select ORDS Config, a supported path/record and interval/deadline. | Returns polling outcome and attempt metadata. Use Custom polling for an approved endpoint/condition. Validate Command Status mode's raw-command path against the service before using it for structured commands. |
| functions invoke Type: | Invoke an OCI Function. Set OCI Config, function OCID, invoke base endpoint and synchronous or detached mode. | Uses msg.payload as input and returns the response. Detached acceptance does not confirm completion. Successful buffered responses default to a 16 MiB limit. |
| certificate Type: Disabled by default | Disabled by default. Retrieve a certificate, certificate-authority or CA bundle using OCI Config, resource OCID and optional version. | msg.payload contains certificate material. Private-key retrieval is off by default and needs corresponding permission. Fetching a bundle does not configure or refresh another node's TLS connection. |
| vault secret Type: Disabled by default | Disabled by default. Retrieve a Vault secret using OCI Config, Secret OCID, version and text/JSON/binary return mode. | Places decoded secret content in msg.payload. Retrieves per input; does not create or rotate secrets. Keep output out of Debug, logs and persistent context. |
You do not need to enable certificate and vault secret retrieval nodes for digital twin instance authentication. Instead, it's recommend to configure the digital twin instance authentication using mTLS certificate authentication for production, or using the secret authentication workflow for testing.
OCI Streaming Nodes
Review Streaming policies for publishing, consuming and committing consumer-group positions on the selected native stream.
Review Kafka SASL/SCRAM setup and Kafka ACLs for cluster setup and Kafka client authorization, separately from OCI API signing.
These nodes are enabled. Native Streaming uses Streaming Config. Kafka uses Kafka Config with TLS and SASL/SCRAM credentials.
Private Kafka hostname resolution through a Flow Runtime's secondary network interface is a known limitation. Keep broker hostnames and TLS certificate verification enabled; substituting an IP address can fail certificate hostname validation.
Replace the dynamic-group and compartment placeholders with values from your tenancy. Add only the policies for the operations your flow uses.
Allow dynamic-group <fr-dynamic-group> to use stream-push in compartment <target-compartment>Streaming In and Streaming Commit:
Allow dynamic-group <fr-dynamic-group> to use stream-pull in compartment <target-compartment>These policies apply to the native Streaming nodes. Kafka Producer and Consumer use the configured Kafka credentials and ACLs described above.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| streaming in Type: | Consume a native OCI stream on deployment. Set consumer group, start position, output mode, batch limit and commit mode. | Emits msg.payload and msg.ociStreaming metadata. Automatic commits record delivery, not successful downstream work. Manual mode waits for Streaming Commit. |
| kafka producer Type: | Publish to a Kafka topic using Kafka Config. | Uses msg.payload and optional msg.kafka topic/key/partition/header properties. Returns delivery metadata in msg.kafka.result. |
| kafka commit Type: | Commit a Kafka Consumer delivery in Manual mode. | Preserve msg.kafka.commitToken and consumerNodeId. Commit a batch only after every record succeeds; the commit covers the partition through its final offset. |
| streaming commit Type: | Commit a native Streaming delivery in Manual mode. | Preserve msg.ociStreaming.commitToken and consumerNodeId. One batch token covers the complete batch. Stale runtime tokens cannot be reused. |
| streaming out Type: | Publish records using Streaming Config. | msg.payload supplies one record, including an array as one JSON record; msg.ociStreaming.messages supplies an explicit batch. Partial errors reach Catch; retrying accepted records can duplicate them. |
| kafka consumer Type: | Consume one Kafka topic on deployment. Set consumer group, starting behavior, commit mode and individual/batch output. | Emits msg.payload and msg.kafka metadata. Existing committed offsets take precedence. Manual commits follow downstream success; restart or rebalance can replay uncommitted work. |
OCI Observability Nodes
Review Monitoring policies for metric publishing and querying in the required compartment and namespace.
Review Logging policies for publishing to the selected custom log.
Review Log Analytics policies for uploads and required log-group, source or entity access.
These nodes are enabled and use OCI Config. Grant access to the target metrics or logging resources. Explicit flow log publishing is separate from configuring the Flow Runtime's own logs.
Replace the dynamic-group and compartment placeholders with values from your tenancy. Add only the policies for the operations your flow uses.
Monitoring Publish and Monitoring Query:
Allow dynamic-group <fr-dynamic-group> to use metrics in compartment <target-compartment>Allow dynamic-group <fr-dynamic-group> to use log-content in compartment <target-compartment>Allow dynamic-group <fr-dynamic-group> to {LOG_ANALYTICS_LOG_GROUP_UPLOAD_LOGS} in compartment <target-compartment>| Node | Configuration and Use | Messages and Results |
|---|---|---|
| monitoring publish Type: | Publish a custom metric. Configure compartment, namespace, metric name, dimensions and timeout. | msg.payload supplies a number or a metric object containing value. Inspect failedMetricsCount; a rejected point routes through Catch. A timed-out submission might already have been accepted. |
| monitoring query Type: | Query metric series with Monitoring Query Language. Set compartment, namespace, MQL and time range. | msg.metricQuery can override query settings. Returns metric streams/data points in msg.payload. |
| log analytics Type: | Upload events to OCI Log Analytics. Configure namespace, log group, log source and payload mappings or msg.payload. | Returns response metadata. Resource onboarding and IAM access are required in addition to configuring the node. |
| logging Type: | Send application records to an OCI Custom Log. Configure Log OCID, source/type and payload mappings or msg.payload. | Supports selected message overrides and returns request/status metadata. Avoid sending secrets in the log content. |
Oracle Fusion Cloud SCM Nodes
Review Fusion SCM security setup and Fusion SCM REST privileges for the integration identity's roles, REST privileges and business-data access for the selected operation.
These add-on nodes are enabled in the catalogue. Install only a module offered by the managed editor's existing list. Except for the local Smart Operations transformer, they use SCM Server configuration and permissions for the selected Fusion REST operation.
For mapped action nodes, choose Mapped fields or Entire msg.payload. Mapped fields uses configured rows; an empty mapping does not automatically use the incoming payload. Direct payload mode requires the supported JSON object for the selected operation. Fusion resource IDs differ from displayed work-order numbers and operation sequences.
| Node | Configuration and Use | Messages and Results |
|---|---|---|
| create installed base asset Type: | Create an installed base asset. | Map required asset fields or select the complete msg.payload object; returns the Fusion response. |
| fusion request Type: | Send a supported Fusion transaction or a Custom REST request. | Choose operation, method and payload source. Custom targets stay under the configured Fusion REST resource root. |
| manage maintenance work order details Type: | Manage maintenance operations, materials, resources or cost transactions. | Select resource/action and the required work-order/operation/child IDs; map Create/Update fields. |
| manage manufacturing work order details Type: | Manage manufacturing operations, components, resources, serials or progress. | Select resource/action and the required work-order/operation/child IDs; map Create/Update fields. |
| smart operations event Type: | Submit a structured Smart Operations event. | Uses msg.smoEvent or msg.payload containing entityCode, eventTypeCode, eventTime and data. Successful submission does not establish downstream event acceptance. |
| maintenance work order Type: | Create or update a maintenance work-order header. | Choose Create/Update, supply the work-order resource ID for Update and map the required Fusion fields. |
| smart operations transformer Type: | Transform one object into a Smart Operations event; no server connection is needed for the transformation. | Map entity, time and event data. Writes msg.smoEvent by default. Split batches first; composite fragments are held in memory with configured bounds. |
| manufacturing production transaction Type: | Report operation completion/rejection/scrap, material issues/returns or product output. | Select the reporting mode and supply one logical detail object. The node adds the Fusion wrapper; do not prewrap the input. |
| scm lookup Type: | Look up a supported Fusion resource or perform a Custom GET. | Select lookup type and business keys, or configure a permitted endpoint/query. Use returned resource IDs for child operations. |
| manufacturing work order Type: | Create or update a manufacturing work-order header. | Choose Create/Update, supply the work-order resource ID for Update and map the required Fusion fields. |
| get organization id Type: | Find an inventory organization by name. | Supply the configured query or msg.organizationName; returns the Fusion response. |
| create meter reading Type: | Submit an asset meter reading. | Map the asset, meter, reading and other fields required by the Fusion setup. |
| subinventory quantity transfer Type: | Submit a staged inventory transfer between subinventories. | Map source/destination and required item/quantity data. Submission does not confirm that subsequent Fusion processing completed the transfer. |
| get installed base asset Type: | Look up an installed base asset by serial number. | Supply the configured query or msg.serialNumber; returns the Fusion response. |
| delete scm record Type: | Delete a Fusion record using a supported resource type or permitted Custom endpoint. | Supply the record identifier; msg.resourceId overrides the editor value. Verify the resource and authorization before sending. |
| get meter reading Type: | Read meter history for an asset and meter. | Supply Asset Number and Meter Code, or msg.assetNumber and msg.meterCode; returns the matching history. |
| miscellaneous transaction Type: | Submit a miscellaneous or account-alias inventory receipt/issue. | Select mode and map the quantity and other required fields. Use the sign and alias required by the Fusion configuration. |
Certificate and Vault Secret Retrieval
The Certificate and Vault Secret nodes are disabled by default because the preferred digital twin instance authentication workflows reference a secret or certificate by OCID, without retrieving its contents into a flow message. You do not need to enable certificate and vault secret retrieval nodes for digital twin instance authentication. Instead, it's recommend to configure the digital twin instance authentication using mTLS certificate authentication for production, or using the secret authentication workflow for testing.
Review Certificates policies for the selected bundle type, including private-key access when requested.
Review Vault and Secret Management policies for secret-bundle retrieval access to the selected secret.
Replace the dynamic-group and compartment placeholders with values from your tenancy. Add only the policies for the operations your flow uses.
Allow dynamic-group <fr-dynamic-group> to read cabundles in compartment <target-compartment>Certificate: leaf certificate bundle:
Allow dynamic-group <fr-dynamic-group> to read leaf-certificate-bundles in compartment <target-compartment>Vault Secret and Vault credential references:
Allow dynamic-group <fr-dynamic-group> to read secret-bundles in compartment <target-compartment>Use the certificate policy for the bundle type selected by the node. These policies grant retrieval access; they do not enable a disabled node. For credential references and private-key or certificate-authority bundle access, see Grant Access to the Referenced Resources.
The disabled retrieval nodes are intended for a workflow that explicitly needs secret or certificate content in a message. They are not required to resolve OCI references in another node's credential fields. Check the installed node state in the managed editor before using them.
vault secret accepts a configured Secret OCID, or msg.secretId when the field is blank. Select a version stage or explicit version number and text, JSON or binary output. The configured OCID takes precedence. JSON output requires valid JSON secret content.
certificate accepts a configured resource OCID, or msg.certificateResourceId when the field is blank. Select certificate, CA bundle or certificate authority. Enable private-key retrieval only when the workflow needs it and the connection identity has the required permission. The output bundle depends on the selected resource type.
Both nodes provide concurrency, queue and timeout controls. Their default settings are four active requests, 100 queued messages and a 30-second timeout covering waiting and request processing. Pending work is held in memory. Retrieval does not rotate the source resource, refresh an existing TLS connection or automatically retry a failed request.
Node-RED Guides for Building Flows
These official Node-RED guides explain the editor and flow-building features used by the nodes in this reference. Apply the managed Flow Runtime's module, sandbox and storage restrictions when following them. External-library loading and runtime configuration examples in upstream documentation do not change the managed service's supported options.
| Guide | When to Use It |
|---|---|
| Using the Node-RED Editor | Find the palette, workspace, node help and configuration controls. |
| Working with Messages | Understand message properties, payload types and how to inspect selected values. |
| Handling Errors | Use Catch and Status nodes to build error-handling paths. |
| Writing Functions | Transform messages and preserve the properties that downstream nodes need. |
| Working with Context | Understand node, flow and global context scopes. |
| Developing Flows | Organize, document and reuse flows and design consistent messages. |