In 12c, the OWSM security policy configuration is saved to a separate file called wsm-assembly.xml In order to update values in wsm-assembly.xml, the service needs to use the <policySet>. e.g. A configuration plan is required to change both a HTTP port number, and the csf-key used by the oracle/wss_username_token_client_policy OWSM policy. Replacement without configuration plan: Open wsm-assembly.xml file and add below code <?xml version='1.0' encoding='windows-1252'?> <orawsp:wsm-assembly xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" xmlns:mds="http://xmlns.oracle.com/mds"> <sca11:policySet xmlns:sca11="http://docs.oasis-open.org/ns/opencsa/sca/200912" name="policySet" appliesTo="SCA-REST-REFERENCE()" attachTo="REFERENCE('Get_Service_Now')" orawsp:highId="2" xml:id="SCA-REST-REFERENCE__REFERENCE__Get_Service_Now__">