title: Secure every endpoint ending with */private in Oracle REST-Data-Services
body: <p>I am using Oracle Rest-Data-Services to export several PL/SQL-APIs as webservice using REST. Therefore every PL/SQL-Package is an ORDS-Module and should have a template ending with <code>*/private</code> that has to be secured so only admin users can call it.</p>
  <p>I tryed to create the following privilege.</p>
  <pre><code>DECLARE
    l_roles_arr    OWA.vc_arr;
    l_patterns_arr OWA.vc_arr;
    l_modules_arr  OWA.vc_arr;
  BEGIN
    ORDS.create_role(p_role_name =&gt; 'private_role');
    l_roles_arr(1)    := 'private_role';
    l_patterns_arr(1) := '*/private';
    --  select name bulk collect into l_modules_arr from user_ords_modules;
    ORDS.define_privilege (
      p_privilege_name =&gt; 'private_priv',
      p_roles          =&gt; l_roles_arr,
      p_patterns       =&gt; l_patterns_arr,
      --p_modules        =&gt; l_modules_arr,
      p_label          =&gt; 'private',
      p_description    =&gt; 'private');
    COMMIT;
  END;
  </code></pre>
  <p>This has no effect and unauthorized calls to <code>*/private</code> are still possible. When I uncomment the commented lines then all calls even to the other endpoints has to be authorized.</p>
  <p>Is it posible to define a privilege pattern like this?</p>