Public Safety and Security FAQ

Find out how Public Safety and Security instances are created, accessed, and managed.

What is a Public Safety and Security instance?

A Public Safety and Security instance is the OCI resource that represents a managed environment and provides an API service endpoint and a user-interface endpoint for Oracle Radio. See Public Safety and Security Instances.

Who is responsible for securing Public Safety and Security resources and devices?

Oracle protects the OCI infrastructure. Your organization securely configures its resources, grants users only the access they need, and limits physical access to devices used with Oracle Public Safety and Security, including Oracle Radio mobile devices. See security responsibilities.

How do I create a Public Safety and Security instance?

Follow Step 2: Create a Public Safety and Security Instance for complete Console, CLI, and API instructions, or see Creating a Public Safety and Security Instance for the operation details. In the CLI, supply the initial administrator Identity Domain user OCID with --admin-user-id.

What must I prepare before creating a Public Safety and Security instance?

Prepare the target compartment, an active Identity Domain and initial-administrator user, their required identifiers, and the Public Safety and Security service policy. Create the required service policy in the tenancy's root compartment, even if the instance is in a child compartment. Follow setup steps. Use pss as the service principal for production customers and replace the Identity Domain OCID in both statements.

Why must I enable access to the Identity Domain signing certificate?

Oracle Radio reads the domain's public signing keys to validate token signatures. Enable Configure client access under Access signing certificate so this validation doesn't require signing in first. This doesn't grant anonymous access to Radio. Follow the setup steps.

What format does the Identity Domain URL use?

Use the Identity Domain HTTPS origin only, such as https://idcs-<unique-id>.identity.oraclecloud.com. Copy the actual Domain URL from the Identity Domain details. An explicit default HTTPS port, :443, is accepted. Don't include credentials, a non-default port, a path, a query, or a fragment.

Can an ACTIVE instance have restricted access?

Yes. Subscription restrictions don't change the instance lifecycle state. Successful sign-in doesn't mean that a subscription restriction has cleared. Review lifecycleDetails in the instance get or list response and follow the subscription guidance before retrying a blocked operation.

Is a Public Safety and Security subscription restriction the same as a Radio channel subscription?

No. A Public Safety and Security service subscription restriction can block instance access. Follow the restriction guidance. A WebSocket subscription joins the current connection to a Radio channel; a saved subscription persists independently. Neither removes a service subscription restriction.

How many Public Safety and Security instances can I create?

The default max-instance-count limit is 2 Public Safety and Security instances per tenancy in each region. Check the limit that applies to your tenancy and region. See service limits for limit-increase guidance. Public Safety and Security is currently available in these regions:

Where do I find an instance and its work request during a compartment move?

After the move is accepted, the instance reports the destination compartment while it is UPDATING. The work request remains in the source compartment. Monitor the work request to determine whether the move completed.

When should I use REST instead of WebSocket?

Use REST for individual requests to read information or change saved state. Use WebSocket for live channel messages, presence events, push-to-talk, and audio. An integration can use both; the APIs don't provide matching operations for every task. See the Overview's API comparison.

Does the OCI Python SDK for Public Safety and Security include Oracle Radio clients?

No. oci.pss.InstanceClient manages Public Safety and Security instances and work requests. No supported Oracle Radio SDK is currently distributed; use the published REST and WebSocket APIs directly. See the developer overview and API setup.

Which Public Safety and Security instance endpoint do I use?

Wait for the instance to become ACTIVE, then copy the complete endpoint values from its instance details. The returned endpoints use the same Public Safety and Security instance origin, with different paths for each interface:

• Radio app: Open uiEndpoint in a browser.

  https://<unique-id>.pss.<region>.oci.oraclecloud.com/ui/

• REST API: Assign the complete serviceEndpoint value, including /api/, to PSS_SERVICE_ENDPOINT. Append only the remaining operation path.

  https://<unique-id>.pss.<region>.oci.oraclecloud.com/api/

• WebSocket API: Derive the URL from serviceEndpoint by changing https to wss and replacing /api/ with /ws/radio. This URL isn't a separate field in the instance details.

  wss://<unique-id>.pss.<region>.oci.oraclecloud.com/ws/radio

These patterns illustrate the relationship between the endpoints; use your returned values instead of constructing a hostname from the instance OCID, display name, or raw API Gateway hostname. Don't add :443 or another port number. Preserve a port in the derived WebSocket URL only if the returned endpoint explicitly includes one.

See Overview's instance endpoints explanation and the API quick start.

Find answers about viewing and interpreting Public Safety and Security metrics.

Does permission to manage Public Safety and Security instances also let me view metrics and events?

No. Ask your IAM administrator for the applicable read policies. Reading Public Safety and Security metrics requires Monitoring access; viewing Events rules requires Events access; reading Audit records requires Audit access. These policies are also separate from Oracle Radio application permissions.

Does viewing an Events rule let me read the events it delivers?

No. Reading a rule lets you view its configuration, not delivered event payloads. Access to the rule's destination depends on that destination's policies. Audit records use a separate policy. See event access.

Why do different Public Safety and Security metrics use different intervals?

Radio request and connection metrics are available at request completion or one-minute boundaries. For more information, view the statistic and interval metrics listed in Public Safety and Security Metrics including:

• API Gateway byte metrics use closed one-minute source windows
• CPU allocation uses five-minute source observations
• Storage usage uses hourly source observations

Find out how work requests report progress and failures for asynchronous instance operations.

How do I monitor Public Safety and Security instance creation?

Use the work request returned by the create operation. Follow Step 3: Monitor the Work Request for Console, CLI, and API instructions. If the operation fails, review its errors and log entries. See Public Safety and Security Work Requests.

Which status confirms that a work request was canceled?

The API and CLI return CANCELED. Continue monitoring the original work request after requesting cancellation; acceptance of the cancellation request alone doesn't establish the final outcome. See canceling requests.

Find answers about the initial administrator and handing off Oracle Radio administration.

What is the initial administrator?

The initial administrator is the active Identity Domain user selected when a Public Safety and Security instance is created. This user receives initial administrative access to Oracle Radio for the new instance.

What happens to the initial administrator during provisioning?

Public Safety and Security verifies that the selected Identity Domain user exists and is active, enables the corresponding Radio user, and adds that user to the seeded Radio Administrators group.

Does Public Safety and Security modify the Identity Domain user?

No. Public Safety and Security reads the Identity Domain user to validate identity and status. It manages the corresponding user enablement and group membership within Oracle Radio, but doesn't modify the Identity Domain user account.

How do I hand off administration to another user?

If needed, have your Identity Domain administrator create an active replacement user in the instance's Identity Domain. Enable the replacement user's Radio access, add that user to Radio Administrators, and have the replacement sign in independently to verify administration access. Don't remove or disable the last verified administrator. The user marked Super administrator remains protected even after another administrator joins. See administrator handoff.

Can Oracle Radio have multiple administrators?

Yes. Add enabled Radio users to Radio Administrators to grant that group's administrative permissions. Membership doesn't transfer the Super administrator designation or replace the initial administrator recorded for the Public Safety and Security instance.

Can I delete a Radio group?

Yes, if it isn't a system group and you have radio.group.manage. Deletion permanently removes the group and its membership and permission assignments, but leaves users and the available permissions. Members retain permissions from other groups. The action can't be undone; verify required access first. Follow the deletion steps.

Why can't I edit or delete a system group?

Oracle manages the names, status, and permissions of Radio Administrators and Radio Member. You can manage membership, but the designated super administrator must remain enabled and in Radio Administrators. See protected access.

Can I disable the designated super administrator after adding another administrator?

No. Radio rejects disabling that user or removing their Radio Administrators membership. Adding another administrator doesn't transfer the designation. Routine upgrades with an unchanged designation don't restore removed Radio access or memberships. If the protected account must be replaced, contact Oracle Support; don't bypass protection by deleting or disabling the Identity Domain account. See recovery guidance.

Can I replace the initial administrator by updating the Public Safety and Security instance?

No. The Public Safety and Security instance update operation changes supported instance properties, such as its display name or tags; it doesn't replace the initial administrator. Follow Handing Off Oracle Radio Administration to transfer Radio access safely.

Who should I contact if all Radio administrator access is lost?

Ask your Identity Domain administrator to restore account or domain access first. If no authorized Radio administrator remains, or restoring the account doesn't restore Radio access, contact Oracle Support for recovery. Creating a new user or updating the instance doesn't automatically grant administrator access. See recovery steps.

Find answers about authentication for supported Oracle Radio clients.

Which authentication method do I use for each Public Safety and Security or Oracle Radio API?

Use OCI authentication to manage Public Safety and Security instances and work requests. The supplied Radio browser application manages its session and CSRF protection. Supported mobile clients obtain user access tokens through OAuth with PKCE, send them in REST authorization headers, and use AUTH after opening a WebSocket connection. Command-line, custom-browser, and server authentication contracts are not currently supported. See the authentication steps.

Why did Radio return me to browser sign-in?

The browser application can return you to sign-in when its session must be renewed. Complete Identity Domain sign-in, then verify the connection and intended channel before resuming work. Don't treat the navigation alone as a service outage. See browser steps.

Does successful API authentication grant access to Oracle Radio operations?

No. Authentication verifies the caller. Oracle Radio separately requires the principal to map to an enabled Radio user with the required Radio permission and any applicable channel access.

Why can an authenticated Radio REST request return 404 NotAuthorizedOrNotFound?

An HTTP 401 means that Radio didn't accept the request's authentication. After authentication, operations that use 404 NotAuthorizedOrNotFound intentionally don't distinguish an authorization failure from a missing or unavailable resource. Verify the requested identifier and have an authorized administrator verify the Radio user's enablement, permissions, and channel access. Don't use the response to infer whether the resource exists. See REST Errors.

Do I configure the Radio mobile OAuth callback, grants, scopes, or offline access?

No. Public Safety and Security provisions and maintains the supported mobile OAuth configuration. The installed Radio mobile application owns its callback URI, and the registration QR value supplies the mobile client ID and Radio authorization scope. The Public Safety and Security instance update operation doesn't change these settings. Creating a separate Identity Domain OAuth application is not part of this supported setup; do not use one to work around the current client-authentication boundaries.

What does the OAuth authorization request return?

After successful sign-in and any required consent, the browser redirects to the supported mobile callback with an authorization code and the original state. The application validates the callback and state, then exchanges the code with its original PKCE verifier at the Identity Domain token endpoint. Use the returned access_token, not the callback code or id_token, for Radio requests. See the token example and exchange help.

Do I use the same method tab for every quick-start step?

Choose the available method for each numbered procedure. Console, CLI, and API tabs retrieve the Public Safety and Security instance endpoints; they don't perform Radio OAuth sign-in. Radio app and REST API tabs cover enabling users and creating or completing registration. The REST check provides cURL and PowerShell examples, and the live connection provides Radio app and WebSocket API steps. The supported mobile application handles OAuth, registration completion, and connection messages for its user. See the API quickstart and API comparison.

Are a browser CSRF value, an Identity Domain access token, and a Radio talk token interchangeable?

No. The CSRF value protects applicable requests made with a gateway-managed browser session. An Identity Domain access token authenticates a supported native or API Radio client. A Radio talk token is only a short-lived floor-control grant for transmitting on a channel; it isn't an authentication credential.

For visual guidance, see the API task diagram, REST saved-subscription flow, and WebSocket workflow diagram. The diagrams distinguish saved state from live connection membership; detailed operation references remain authoritative for request fields and responses.

Can I manage geofences or report location through REST?

Yes. Use the four geofence operations to read or replace channel boundaries, and updateLocation to report your authenticated user's position. Check each returned action status; HTTP success doesn't mean all subscription actions succeeded or that the live connection joined the channel.

Can I check Radio connectivity before signing in?

Yes. The public health and ping GET endpoints require no authentication. Successful diagnostics don't establish user access or dependency readiness. There is no public readiness endpoint.

Why doesn't the registration list show every grant?

listDeviceRegistrations returns a bounded page. Continue while hasMore is true, increasing offset by the returned count. Keep the same usageMode filter and limit.

Can one registration QR code enroll multiple installations?

A reusable QR code can enroll multiple installations for its intended user until expiry or revocation. Each completion creates a separate device record, even with the same advertising ID. One-time use remains the default; targeted re-registration remains one-time.

Does revoking a reusable QR code remove registered devices?

No. It prevents future enrollment with the code. Existing records remain in device inventory. Revoke the grant separately from any required device deletion.

Can I manage Radio users through an API?

Yes. Use the four user operations to list or inspect directory users, enable or disable Radio access, and replace Radio group memberships. They require radio.user.manage and don't modify Identity Domain accounts. Directory lookup and status changes use the directory user ID; group replacement uses the separate Radio user ID.

Where are the device registration and management API requests?

The REST reference groups all eleven device operations under registration grants, device inventory, and mobile registration. The browser administration tasks link to the corresponding API operation.

Why is userId absent from my saved-subscription response?

Self-service subscription operations act on the authenticated user and omit userId. See the request and response example.

Does saving a REST subscription join a WebSocket channel?

No. A saved subscription records a durable channel selection. To join the current WebSocket connection, send the subscription message and verify its result as described in Joining a Channel.

Where can I follow a complete API workflow?

Use the workflow guide to choose mobile enrollment or recovery, saved subscriptions, or live WebSocket communication. For saved channel selections, follow the subscription workflow using Radio App, REST API (cURL), or REST API (PowerShell); the REST tabs share illustrative response examples. These documentation workflows are ordered instructions, not an application menu option.

Does Join in the Radio app save the same subscription as REST?

Yes. Join saves your channel selection through the self-service REST operation. The browser also starts listening to the channel; a REST add request alone does not connect a live client. Follow the verification steps to check the saved state before repeating an uncertain add request.

Why does my profile request fail after sign-in succeeds?

The profile request also requires an enabled Radio user and radio.channel.list. Ask a Radio administrator to verify the user's permissions.

Do I use the channel name or channel ID in REST request paths?

The channel list returns both channel and channelId. Use the returned channel name for the {channel} path parameter, encoded as one URL path segment.

Can I recover a registration code by listing registrations?

No. The registration list returns grant metadata, including expiration and consumption state, but doesn't return the code or QR value. Have an authorized administrator create a new grant or reissue registration for the existing device.

Find answers about live Oracle Radio WebSocket sessions and channel operations.

Which WebSocket message discovers available channels?

Use LIST_ALL_CHANNELS to discover channels visible to your user. LIST_CHANNELS lists only the channels subscribed by the current connection. An empty subscription list doesn't mean that no channels are available. See the channel procedures.

Can I perform the same tasks in the Radio app and the APIs?

Many real-time tasks overlap, but the methods aren't interchangeable. Use the Radio app, WebSocket API, and REST API tabs in channel tasks, push-to-talk, sending messages, and channel activity to choose a method. REST saved subscriptions are separate from live WebSocket subscriptions. Each tab links to the related permissions; a tab explains when this guide has no corresponding procedure.

How do I construct the Radio WebSocket URL?

Use wss with the hostname managed by Public Safety and Security and any explicitly supplied port from serviceEndpoint, and set the path to /ws/radio. Don't append that path to /api/. A mobile registration descriptor's radioBaseUrl already supplies the origin. See URL construction and the connection example.

Why does the Radio WebSocket API use message operations instead of HTTP methods?

The HTTP request upgrades the connection to WebSocket. After the upgrade, the client sends typed JSON messages for operations and receives direct responses and asynchronous events on the same stateful connection. Binary WebSocket messages carry audio only during an active transmission. See Oracle Radio WebSocket Message Families.

When does a native Radio WebSocket client send its access token?

Open the WebSocket without relying on the upgrade Authorization header. Then send the Identity Domain access token in AUTH and wait for AUTH_SUCCESS before sending Radio operations. Only PING is permitted before authentication. A later AUTH can renew the session only for the same principal. See WebSocket authentication.

Why do I send RELEASE_TALK after END?

END finishes the current audio transmission, but a still-valid talk token continues to hold the talk floor. Send RELEASE_TALK after END so that the channel becomes available. See Workflow: Transmitting Audio by Using the Oracle Radio WebSocket API.

Do Radio WebSocket channel subscriptions survive a reconnect?

The public contract doesn't define automatic restoration of live channel membership after reconnecting. Don't assume that either a previous live membership or a separate saved channel subscription restores that membership. Send SUBSCRIBE for each required channel and verify the response on the new connection. See Workflow: Managing an Oracle Radio WebSocket Session.

Can I safely retry a Radio WebSocket text message?

Include a client-generated clientMessageId and match it in the success or error response. Reusing an identifier can replay a cached success or error without another send, even if the request body changes. After correcting a confirmed validation or authorization rejection, use a new identifier for a deliberate new attempt. If delivery is uncertain, don't automatically switch identifiers; retain the original identifier if retrying the unchanged request. No fixed retry-protection period or guarantee across reconnects or service restarts is established. See the message reference.

Why doesn't a text-message error identify the missing permission or channel?

For an authenticated access or resource-absence failure, TEXT_MESSAGE returns ERROR with NotAuthorizedOrNotFound. The response deliberately omits the channel and reason so it doesn't reveal resource or access state. Use the supplied clientMessageId to identify the failed request, then follow message troubleshooting.

Does a denied talk request prove that the channel exists?

No. An ACL_DENIED response to REQUEST_TALK can mean that channel talk access was denied or that the channel is unavailable. Have an authorized administrator verify the channel identifier and access. Don't transmit without GRANTED; see talk guidance.

Should my client send service diagnostic message types?

No. Service diagnostic message types aren't part of the customer API. Send only the operations listed in Client-to-Server Message Families, and use customer-visible responses for troubleshooting.

What should I do when a client request no longer matches the Radio contract?

Identify the API surface and operation, compare the request with the current published schema, remove undocumented fields or legacy assumptions, and retry only when the operation is safe to repeat. See Resolve a Contract Conflict.

Find answers about channel activity, messages, recordings, and transcripts.

Does Download full transcript export all retained history?

No. It exports the currently loaded entries without automatically retrieving additional history pages. Select Load older activity first to include earlier entries; clear Find before loading, then search again. The initial history request retrieves up to 100 entries; this isn't a retention limit or a fixed export maximum. Summarize also uses loaded entries: it counts them, identifies voice transmissions without transcripts, and includes up to three latest text entries. It isn't an AI-generated summary. See channel activity.

Why does a completed transmission show Processing recording?

Radio is waiting for the final transcript after the live transmission ended. It checks channel history for the final result and resumes after reconnecting. This doesn't mean that another transmission is in progress or that a transcript is ready. If it reports Processing is taking longer than expected, select Try again. For an access error or a result that remains unavailable, follow the processing guidance.

Can I turn off transcription without turning off recording?

Yes. In the browser, open Settings, select Audio, and turn off Transcribe my transmissions. The preference applies to server-generated transcripts of your voice transmissions; recording and playback continue. Client-supplied text can still appear, and existing transcripts aren't removed. See Radio settings.

Can I translate Radio transcripts in the Browser App?

No. Transcript translation and Translation settings aren't available in the Browser App. Use the original transcript or authorized recording. Changing the interface language doesn't translate message content. See channel activity and translation guidance.

How long can a channel handle be?

Up to 64 letters, numbers, hyphens, or underscores. Radio normalizes the handle to lowercase; the browser also trims surrounding spaces. This is the handle, not the display name. See channel creation.

Can I listen to a recording if its transcript is missing?

Use the recording's Play control when audio is available under your authorization. No transcript available means that no text is displayed, not that the audio is necessarily unavailable. A visible transcript doesn't guarantee that its recording remains available. See recording guidance.

Find answers about Oracle Radio access, mobile workflows, and application settings.

Can I read or update my Radio settings through an API?

Use getMySettings and updateMySettings for your account's settings document. These REST operations don't select browser devices or change browser appearance or location-sharing permission. See REST settings. Use the documented canonical version 1 settings.radio fields for playback volume, transmission gain, chirps, talk and channel shortcuts, and browser channel order. The public REST contract doesn't currently define canonical translation-preference fields. Updates merge top-level keys by default, not nested objects. There is no corresponding WebSocket settings operation.

How do I reach a table's action button with the keyboard?

Move to its cell with the arrow keys, then press Enter or F2 to reach controls inside it. Press Escape to return to cell navigation. See keyboard navigation.

Where do I configure channel and talk shortcuts?

In the browser app, open Radio, select Settings, and use Hotkey. Change the talk key with Change and Save. Enable, disable, or remap channel keys there, or select Restore 1–9 shortcuts. Use a different talk key from the channel keys. These preferences save to your Radio account. See shortcut settings.

Does a channel shortcut start a transmission?

No. A channel key opens its workspace. Shift plus that key selects a channel you have joined and are listening to as the transmit target. Use the separate talk shortcut, initially Shift+T, or the talk button to request the floor, and wait for Transmitting before speaking. Keys follow the first nine positions in your saved channel order. Shortcuts don't run while focus is inside a form or dialog; return focus to the Radio workspace first. See channel shortcuts and shortcut guidance.

How do I sign out of Radio?

Select Sign out in the Radio header and allow the redirects to finish before closing the window. Verify You are signed out; select Sign in again only when you want to return. Sign out ends the browser session and its Identity Domain session. See the sign-out steps.

How do I change Radio's interface language?

Open Settings, select Language, and choose Browser language or an available language. Browser language follows supported browser preferences, with English as the fallback. The selection is saved in this browser, not your account, and doesn't translate messages or transcripts. See language settings.

Can I talk while viewing Locations or administration pages?

Yes, when the floating Radio control is enabled by your administrator and in your Appearance settings, you have talk permission, and you are listening to a channel. Compact or touch-enabled browsers initially show a launcher; select Show Radio control to open it. Select its transmit target before speaking. It doesn't extend to unrelated applications or browser tabs. See floating controls.

Where are the administration actions?

In browser channel, user, and device tables, open the row's Actions menu. Card layouts can also show action buttons directly. Available actions depend on your permissions and the record's state. See administration.

Do selected channel members stay selected on another result page?

Yes. In Manage members, Previous and Next retain your selections across pages. Running a new search clears them. Review the selection before adding users. See channel members.

Does Radio remember my transmit channel?

The browser saves the selected transmit channel to your account and restores it when it is joined and listening. This doesn't reserve the talk floor or start audio. Radio also reconciles externally added or removed saved memberships while the app is open and when you return focus to it. A removal can change the available transmit target. Verify the displayed target before speaking, especially after a membership change, leaving a channel, or restoring the connection. See channel steps.

Why can I see channels I haven't joined?

Open normal channels can appear in discovery before you join them. Explicitly denied channels remain concealed. Visibility doesn't grant permission to transmit or perform every channel action, and creating a channel doesn't automatically join you. See channel creation and channel discovery.

Does an empty user list mean that a REST request failed?

No. HTTP 200 with "users": [] means the returned page has no users. Check the filter and continuation value. A user's "groupIds": [] means no Radio group memberships, not a missing directory account. See List Users.

Does signing out disable my Radio user or leave saved channels?

No. It ends the browser session, not your Radio access, group assignments, or saved subscriptions. Separate bearer-token clients are unaffected. Browser Leave removes membership for one channel and stops listening to it; it doesn't sign you out. See channel actions.

Why does my Radio application look different from this guide?

The mobile instructions describe the Oracle-provided app. Your permissions, organization configuration, application, and screen size affect the available controls and layout. Browser and mobile interfaces need not be identical. See application choices. If an operation is denied after sign-in, follow the access guidance.

How do I identify the icons in Radio?

Use the Radio Icons reference to identify the navigation and action icons. Relevant app procedures also show an icon beside the first navigation cue. Expand the sidebar with the navigation menu icon to see navigation labels. The available administration pages depend on your Radio permissions.

Where are the Radio channel actions?

In the browser, select a channel in Radio, and open the Channel actions menu (three dots) next to the member count. Use Find to filter loaded entries by sender or message text. The menu, main channel button, and channel list provide Join for an unjoined channel or Leave for a joined one. See Actions.

Can I listen to several channels and talk to just one?

Yes, in the browser. Join saves membership and starts listening to each channel; Transmit chooses one voice target. Opening a workspace does not change the transmit channel. Leave stops listening and removes saved membership for that channel. Check the target before speaking, including after leaving a channel or restoring the connection. See channel steps.

What does Leave do in the browser?

Leave removes the channel's saved membership and stops listening to it. Other listening channels stay connected. To return, select Join. There is no separate browser stop-listening control that preserves saved membership. Stopping a voice transmission only releases the floor; it doesn't leave the channel. See channel actions.

How do I find a channel instead of a message?

Use Search channels in the Channels header to filter the channel list. Clear the text to restore the list. Find in a channel's menu searches loaded activity instead. See channel search.

Can I inspect activity without joining a channel?

Yes, when your authorization allows it. Selecting an unjoined channel loads an available activity snapshot without changing your membership. It doesn't subscribe you to live updates. See channel activity.

Why is there no editable message area?

In the browser, Not joined means you must use Join in the channel workspace, channel list, or menu before composing a message. The message area has no separate Join button. Wait for Joining… to finish; messaging is also unavailable while leaving. For Messaging unavailable or Could not join channel, see messaging guidance.

Does Find search all channel history?

No. Find filters only entries already loaded in the selected channel and ignores capitalization. Clear the search text or select Close find to show all loaded entries again. See Reviewing Oracle Radio Channel Activity.

Can I talk without holding the browser button?

Yes. In Settings, under Audio, set Talk mode to Tap to talk. Press once to request the floor and again to stop; releasing the button doesn't stop transmission. This account preference applies to the Browser App's Radio page, floating control, and talk shortcut. The default Push to talk mode still uses hold and release. The iPhone Dynamic Island control uses press-and-hold behavior. See talk settings.

Can I listen and talk when my iPhone is locked?

Yes, with background reception enabled and a connected, signed-in, on-duty Radio session. In Settings, select Background Reception, allow microphone access, enable reception, and review the status and intended channel. You can also use Pocket Mode in the expanded Radio connection row. On an iPhone with Dynamic Island, select the blue system Push-to-Talk indicator from the lock screen, then press and hold Talk. See iPhone Background PTT.

Does closing the iOS app stop background reception?

Not necessarily. Turn off Pocket Mode or Background Reception to disconnect the background session. This also disables Bluetooth talk and the lock-screen Action Button, but retains Bluetooth pairing. Turning reception on again doesn't automatically enable those hardware controls. See reception settings.

Does denying microphone access stop all iOS Radio audio?

No. Foreground listening remains available while Oracle Radio is open. Microphone access is required to transmit and to use Background Reception or Pocket Mode. Denying notifications separately prevents visible system alerts, not sign-in or foreground Radio listening. See reception help.

How do I recover missing background audio on iOS?

Restore connectivity, keep Oracle Radio open, and check that you are signed in, on duty, and have microphone access. Use Reconnect Pocket Mode in the expanded Radio connection row or Reconnect Background Reception in Settings. An enabled switch doesn't confirm delivery. See recovery steps.

Can I change the iOS app's appearance?

In Settings, select Appearance, then choose System, Light, or Dark. System follows the device's appearance. The choice applies only to Oracle Radio on this device. See appearance settings.

What if iOS re-enrollment says the radio is still disconnecting?

Keep Oracle Radio open, wait, and try Re-enroll Device again. Don't clear app data as a workaround. After successful re-enrollment, review background reception and hardware controls before using them again. See the iOS steps.

When can I start speaking after requesting the floor?

Wait until Radio shows Transmitting. In Push to talk mode, keep holding the control while speaking and release it to stop. In Tap to talk mode, select Tap to stop when finished. See the talk steps.

Can I interrupt a speaker with Priority Talk?

If you have the required permission on a busy connected channel, use Hold to interrupt and talk in Push to talk mode or Tap to interrupt and talk in Tap to talk mode. Priority Talk can interrupt a lower-priority transmission, but you must still wait for Transmitting. It affects the current channel, not multiple channels. See Priority Talk.

Why don't I see a Priority Talk control?

The control appears only when another user holds the floor on your connected channel and the server reports that you can use Priority Talk. Its Hold or Tap label depends on your talk mode. A group or role name alone doesn't establish this capability. Ask a Radio administrator to check your permissions, or follow the talk guidance.

Does opening Settings leave my current Radio page?

No. Settings opens over the current page. Select Done to close it and return to the same page.

Where can I find the Radio UI version?

Open Settings, select About, and read Version. You can also select Show version in the expanded sidebar. Include this value when reporting a browser problem.

Why can a user sign in but not use Oracle Radio?

Identity Domain authentication and Radio authorization are separate. Also check the instance details for subscription restrictions, which can block Radio access even after sign-in succeeds. Verify that the Identity Domain user is active, the corresponding Radio user is enabled, the user has the required Radio group permissions, and any applicable channel access rules allow the operation. See access guidance.

Find answers about location sharing, visibility, and history in Oracle Radio.

Why does my Android member map change between light and dark?

The map follows the Android app's Light, Dark, or System appearance setting. System follows your device's appearance. This is separate from the browser's Dark mode setting. See map appearance.

How do I share or stop sharing this browser's location?

In Settings, select Location and change Share this browser's location. Sharing also requires browser location permission. The choice applies to this browser, not all your devices. Turning it off stops new reports from this browser; it doesn't delete previously reported positions. See browser sharing.

What does a transmitting map marker mean?

Radio reports the person transmitting on a channel shown in the view. It doesn't prove that the displayed location is current or that someone received the audio. Check the position's update time. See Locations.

Does mobile location tracking work the same on Android and iOS?

No. Android requires precise and background location permissions for tracking. iOS uses When In Use authorization and doesn't track location in the background. These permissions are separate from receiving background communication. See mobile permissions.

Should I check location sharing when using a shared Android device?

Yes. The app can retain the device's sharing choice across users. Review it before going on duty. Your own agreement acceptance, valid authenticated on-duty session, and device permissions are still required. Turning sharing off or going off duty stops new reports; it doesn't delete previously reported positions. See mobile location sharing.

Does centering the map on my location prove that others can see me?

No. A browser coordinate can center the map without establishing that a personnel location was accepted or is visible to other users. Check the Location settings status and follow the sharing guidance.

Does selecting a geofence center on the map save the boundary?

No. Map selection updates the latitude and longitude in the editor. Review the remaining values and save the definition. Dragging or zooming the map doesn't select a center. See geofence administration.

How do I view personnel locations?

Open the navigation menu and select Locations under Applications. Use Live for available current positions and History for one person's recorded positions. See Locations.

Can I view locations without leaving a channel?

Yes. Select the channel's member count and open the Locations tab. Select a Member and a History range, then select Show history. Clear removes the displayed trail, not the stored records. See channel locations.

Does pausing live updates stop location sharing?

No. Pause live updates pauses automatic refreshes in the Locations page. It doesn't stop devices from reporting positions or disable configured geofence actions. Select Resume live updates to refresh automatically again.

Where do I create a channel geofence?

In Radio, select Channels, open the channel's Actions menu, and select Add geofence. For an existing boundary, select Manage geofence. See geofence administration.

Can I display distances in miles?

In the browser app, open Settings, select Units, and choose Miles. Choose Server default to follow your administrator's instance default. This changes displayed distances, not stored values. Enter a geofence radius in the unit shown in the form; the geofence REST API still uses meters. See Radio settings.

Where are the Android map legend and automatic channel details?

On the full-screen channel member map, select Map Info. Expand the bottom drawer as needed; swipe it down, select outside it, or use Android Back to dismiss it. See map information.

Does disabling or removing a geofence remove channel subscriptions?

No. Disabling stops evaluation while retaining the definition. Removing deletes the configured boundary. Neither action removes existing saved subscriptions. See geofence administration.

Can I use the prefilled geofence location and domain?

Verify each value for your deployment. Enter the intended boundary center and radius and the Identity Domain OCID for its eligible Radio users. The preview doesn't confirm that those values are appropriate or saved.

Why did my channel subscription change automatically?

When configured, a geofence can automatically add a saved subscription on entry or remove it on exit based on reported locations. Automatic subscriptions still require permission and channel access. Automatic removal on exit can also remove a manually added subscription; it doesn't preserve a separate manual subscription. See geofence behavior.

Does a geofence membership notification mean I can transmit?

No. MEMBERSHIP_CHANGED reports an applied saved-subscription change, not a talk grant or confirmation of the current connection's live membership. Check the connection and follow the talk procedure. Integrations should review geofence events.

Does hiding geofences disable automatic subscriptions?

No. Show geofences only shows or hides boundaries on the map. Ask a Radio administrator to review an unexpected automatic subscription, and follow geofence troubleshooting.

Why isn't a person available in Locations?

The view depends on its available channels and the location data returned for their members. An empty person list doesn't establish that no history exists. Check the channel filter and follow the location guidance.

Does the history range guarantee a complete trail?

No. The range selects which available records to request. Neither the range nor the displayed count guarantees a complete history or a retention period. See Locations.

Find answers about Oracle Radio devices and registration.

How do I register a Radio device?

Follow Step 8: Register a Radio Mobile Device for the administrator procedure, or use Workflow: Enroll an Oracle Radio Mobile Application for the complete administrator, authentication, registration, heartbeat, and connection flow.

What does Radio device registration record?

It records one installation of the Radio mobile application and associates it with an intended enabled Radio user and an opaque client-supplied advertising ID. Neither the advertising ID nor the Radio device ID authenticates the person or the physical device. See Managing Oracle Radio Devices.

Does the registration QR value or Radio device ID authenticate a user?

No. The QR value is short-lived and can be used only once to register the application installation. It supplies public client configuration but doesn't contain the application's callback URI, a client secret, or OAuth tokens. The Radio device ID is installation state. The user must still sign in to the Identity Domain, and the mobile application must send a valid bearer access token on every Radio REST request. For WebSocket, send the access token in AUTH when authenticating or renewing the session.

How does the Radio mobile application authenticate?

The public OAuth client provisioned by Public Safety and Security uses Authorization Code with S256 PKCE. The application requests openid, offline_access, and the Radio resource scope supplied in the QR value. After the user signs in and the browser returns through the installed application's supported callback, the application sends the Identity Domain bearer access token to Radio and uses its refresh token to renew access. It also sends its Radio device ID when opening a mobile WebSocket connection. See Authenticate and Register the Radio Mobile Application.

What happens after the application data is reset or the application is reinstalled?

If the installation no longer has its Radio device ID, a Radio administrator must create a new registration or re-register the existing device. The intended enabled Radio user then scans the new QR value and signs in. See Workflow: Re-enroll an Oracle Radio Mobile Application.

Why can a Radio device appear online briefly after the application disconnects?

The mobile application sends periodic authenticated heartbeats. Radio derives a best-effort online state from the most recent heartbeat, so the state can remain online briefly after the application stops or loses its connection.

Does an online device or PONG response mean mobile audio is ready?

No. Device heartbeat, connection checks, and audio readiness are separate. A device-bound mobile connection reports AUDIO_READINESS and renews it using the values in AUTH_SUCCESS. See audio readiness and readiness help.

Why did a device's existing WebSocket session close?

Completing re-enrollment closes sessions for the replaced registration. A new connection from a different user on the same registered installation closes older sessions for the prior user. Confirm the intended user and current registration, then restore authentication, live subscriptions, and audio readiness. See session recovery.

Find answers about Oracle Radio mobile setup, channel controls, background operation, and session recovery.

Why did the Android or iOS app switch from tap-to-talk to hold-to-talk after an upgrade?

Each app switches its on-screen PTT mode to hold once on upgrade. Hold the button while speaking and release it to stop. To use tap-to-toggle again, open Settings, select Radio & Voice, and turn on Tap to toggle talking under Screen PTT Button. Later choices persist; resetting settings restores hold mode. Each installation's choice is separate from browser controls. See Android settings and talk steps, or iOS settings and talk steps.

Where are the Android channel subscription controls?

Use Join and Leave in the channel controls. Check the active channel and live connection before speaking; Saved, but unavailable does not mean that you are connected. See Android channels.

Where do I start with Oracle Radio on iPhone?

Follow the quick start to install and enroll, select a channel, complete a radio check, send a message, and review Pocket Mode and duty status. Ask your administrator for an enrollment code and an authorized test channel. These are iPhone controls, not browser or Android instructions.

Do I enroll again whenever my mobile session expires?

No. The app renews access with a valid saved refresh token and retries temporary failures. Restore connectivity and allow recovery. Both Android and iOS return to sign-in when refresh credentials are missing, expired, or definitively rejected. Sign in again as the intended user. Registration recovery is separate; follow session recovery first.

Does canceling Android re-enrollment restore my session?

No. After you confirm Re-enroll in Settings, your current session ends. Cancel or Back returns to signed-out Login. Replacing the server configuration requires a separate confirmation after scanning the replacement QR code. See the Android steps.

Can I receive mobile communication when the app isn't open on the screen?

Android and iOS support Inbox and Critical Alert receipt in the foreground, background, and while the device is locked. Stay signed in, on duty, and connected, and allow notifications for visible system alerts. On iOS, foreground Radio listening remains available if notifications are denied; background Radio reception separately requires microphone access and enabled Background Reception or Pocket Mode. This isn't an immediate-delivery guarantee. See receiving prerequisites.

Does clearing Inbox delete server history?

No. Read flags and deletion are local to the Android or iOS installation. History refresh can restore cleared entries. On iOS, saved read markers are restored for the same server and account on this installation, not synchronized between devices. See mobile Inbox.

Why does Android say that Inbox history is limited?

The app recovers a bounded set of history, not a complete archive. The notice distinguishes confirmed additional history from cases where more history might be available or couldn't be confirmed. Review browser activity when the notice recommends it. A limited result doesn't establish server deletion or a retention period.

Why can an iOS Inbox entry remain unread when its audio has expired?

Received voice playback becomes unavailable after eight hours, but its entry and transcript can remain among the newest 500 Inbox entries. Opening the entry marks it read even without playback. This app rule doesn't apply to sent recordings and isn't the service's retention policy. See mobile Inbox.

How do I join or leave a channel in the iOS app?

Open Channels, select Join Channel, find the intended channel, and select Join. Check for Joined, then select your active talk channel under Joined Channels. To leave, swipe the channel row and select Leave; select another active channel first if necessary. Joining doesn't start a transmission, and leaving doesn't delete the channel. See iOS channels.

Is Critical Alert the same as a critical text message?

No. Mobile Critical Alert requests urgent voice and attempts a separate location update when available. Critical text uses the message composer and doesn't transmit audio or location. iOS uses a hold control; Android asks for confirmation. See Critical Alert.

Why does Critical Alert continue when I try to finish?

On Android and iOS, Critical Alert captures at least 10 seconds of audio after transmission starts. An earlier attempt to finish leaves the alert active and displays the remaining capture time. Wait for that minimum, then follow the app's transmission controls to finish. See Critical Alert and alert help.

Does mobile sign-out end every Identity Domain session?

Don't assume so. The app clears its local session and attempts remote logout; another browser or device can have a separate session. Going off duty keeps you signed in. See mobile sign-out.

Are phone and tablet instructions different?

Use the instructions for Android, iOS, or the browser you are using. Window width and text size can change layout; a browser on a tablet doesn't become the installed app. Follow the named mobile controls.

Does a successful text send guarantee that the message is in history?

No. TEXT_MESSAGE_SENT confirms the send and delivery result, not durable history storage. Retry protection isn't guaranteed across service restarts or replicas. See text responses.

How long can a WebSocket talk token be used?

The current grant lasts 30 seconds. Follow its returned expiresAt, and stop on TOKEN_EXPIRED. See talk grants.

Why is someone absent from All visible personnel?

The browser workspace loads at most 25 saved channels and only people with returned coordinates from that set. It isn't an inventory of every accessible user. Location History also requires radio.message.history and active shared-channel membership. See Locations.

Can the initial administrator recover a forgotten password?

If your organization still controls the Identity Domain, its administrator can recover the existing initial administrator's account. This doesn't change the Public Safety and Security initial-administrator OCID or restore damaged Radio access. If Radio administration remains unavailable after account recovery, contact Oracle Support. See account recovery.

Can an administrator add users to a channel?

Yes. In the browser, open Channels and select Manage members for the channel to add users. Eligible users have active Identity Domain accounts and enabled Radio access, and aren't already subscribed. This saves their channel selections; it doesn't start calls or grant permissions.

Why doesn't the member count include everyone added to a channel?

The count shows live participants, not saved subscriptions. A user must have an active WebSocket session on that channel to appear. The user can remain online through another session after leaving this channel. See presence help.

Must I reload Radio after creating a channel?

No. The browser adds the new channel to the Radio workspace without reloading the page. Creation doesn't automatically join or connect you; follow the channel steps.