How to setup Oracle JD Edwards

August 17, 2026

Connect JD Edwards to Unified.to

Administrator guide — How to configure your JD Edwards EnterpriseOne environment so Unified.to can securely read data through the Application Interface Services (AIS) Server REST API.

Audience: JDE / CNC administrator · Applies to: EnterpriseOne 9.2 · Access level: Read-only

Overview

Unified.to connects to JD Edwards the same way any external REST client does — through the Application Interface Services (AIS) Server, the lightweight JSON-over-REST gateway that ships with EnterpriseOne. Nothing is installed inside your JD Edwards environment. Unified.to makes outbound HTTPS calls to your AIS Server, signs in with a JD Edwards user account you provide, and reads data using the standard AIS services. Every request is authenticated by EnterpriseOne and constrained by that user's security.

This guide walks a JDE or CNC administrator through the one-time setup: confirming the AIS Server, securing it, creating a dedicated service account, granting the right access, opening the network path, and verifying the connection before handing the sign-in details to Unified.to.

Unified.to  ──HTTPS──▶  AIS Server (/jderest)  ──E1 auth──▶  EnterpriseOne
(external client)       (token & data services)             (apps, security, data)

Before you begin

• An AIS Server is deployed and running. AIS is managed in Server Manager as part of your EnterpriseOne Tools installation.
• EnterpriseOne Tools Release 9.2.4 or later. This is the minimum release documented for the AIS Server REST API.
• The AIS Server is configured with a Security Server. From Tools 9.2.2.2 onward, an AIS Server must be associated with an EnterpriseOne Enterprise (Security) Server.
• You can create users and assign roles in the EnterpriseOne security tools, and you can reach Server Manager.
• You know which environment and role the integration should sign in to (for example a reporting or production environment).

Step 1 — Confirm the AIS Server and note its URL

In Server Manager, open your AIS Server instance and confirm it is started. AIS exposes its services under a base URL of the form:

https://<ais-host>:<port>/jderest

Record this base URL — Unified.to needs it. Individual services live beneath it (for example the token request and data services), so the host and port are all you supply.

Note: If AIS sits behind a reverse proxy or load balancer, use the externally reachable URL that terminates TLS, not the internal application-server address.

Step 2 — Require HTTPS

Configure the AIS Server (or the proxy in front of it) to use SSL/TLS so all traffic is over HTTPS. The AIS Server supports SSL configuration through Server Manager and the application server it runs on.

• Install a certificate signed by a trusted public authority so Unified.to can validate it.
• Avoid self-signed certificates for production; they cause TLS validation failures for external clients.

⚠ Important: Credentials are sent on every sign-in. Do not expose the AIS Server over plain HTTP.

Step 3 — Enable the authentication method in AIS security settings

In Server Manager, open the AIS Server's Application Interface Services Security Settings. The login type used by the client must be enabled there for that client to authenticate. Enable standard EnterpriseOne username/password authentication.

Confirm the AIS Server's Security Server host and port are defined so it can validate sign-ins against EnterpriseOne.

Note: These settings are shared by all AIS clients. Changing them affects every application that uses this AIS Server, so review them with your CNC team before saving.

Step 4 — Create a dedicated service account

Create a JD Edwards EnterpriseOne user reserved for this integration rather than reusing a person's login. A dedicated account keeps the integration's activity auditable and easy to revoke.

• Assign it a role scoped to read/inquiry access for the data the integration should see.
• Set the default environment and role it signs in with, or plan to supply them explicitly.
• Apply your standard password policy; use a strong, unique password.

✓ Best practice: Because Unified.to reads data, a role with inquiry-level access is sufficient. Grant no more than the integration needs.

Step 5 — Grant the account access

Two layers govern what the service account can do — make sure both allow the data you intend to share:

• AIS access. Per your Tools release, grant the user access to the AIS Server — for example by adding it to the AIS user allowlist or assigning the appropriate AIS role — so it is permitted to authenticate as an AIS client.
• EnterpriseOne security. AIS requests honor EnterpriseOne security. Use Security Workbench to ensure the user's role has access to the applications and data the integration reads, and review any row and column security that would hide records or fields.

Note: If the integration returns fewer records or fields than expected, security on the role is the usual cause — the account can only ever see what EnterpriseOne security permits.

Step 6 — Open the network path

Unified.to's servers must be able to reach your AIS Server over HTTPS.

• Allow inbound HTTPS to the AIS host/port through your firewall — restricted to Unified.to's egress IP addresses listed in the appendix below.
• If you expose AIS through a gateway or DMZ proxy, forward the /jderest path to the AIS Server.
• The AIS Server's allowed origins (CORS) setting governs browser-based callers. Server-to-server calls are not subject to browser CORS, but confirm no other network policy blocks the caller.

Step 7 — Review the session timeout

When a client signs in, the AIS Server issues a session token that expires after an idle period you control in Server Manager. The default is short; keep it reasonable so routine syncs don't expire mid-request, while still meeting your security policy.

Note: Unified.to re-authenticates automatically when a token expires, so no coordination on exact timing is required — this is just to avoid an unusually aggressive timeout.

Step 8 — Verify the connection

From a machine that can reach the AIS Server, request a token with the service account. A successful response confirms the URL, TLS, security settings, and account are all working together:

# Request an AIS session token
curl -X POST -H "Content-Type: application/json" \
  https://<ais-host>:<port>/jderest/v2/tokenrequest \
  -d '{ "username": "<service-user>", "password": "<password>",
        "environment": "<env>", "role": "<role>", "deviceName": "unifiedto" }'

A JSON response containing user information and a token means the account can authenticate. An error points to the layer to revisit — see the table below.

Troubleshooting

Hand off to Unified.to

Once the token test succeeds, provide these values to Unified.to when creating the connection. Share the password through a secure channel.

References

• Managing the AIS Server through Server Manager
• Application Interface Services (AIS) Server and AIS Client Security
• REST API for the JD Edwards EnterpriseOne AIS Server — Authentication
• REST API for the JD Edwards EnterpriseOne AIS Server — Quick Start
• JD Edwards EnterpriseOne Tools: Application Interface Services Server Reference Guide

Appendix — Unified.to egress IP addresses

Unified.to calls your AIS Server from the fixed IP addresses below. Allow inbound HTTPS from these addresses to the AIS host/port in your firewall or reverse proxy (Step 6). Allowlisting all three keeps the connection working regardless of which Unified.to region serves it.

44.199.69.244
3.65.142.239
13.239.151.208

Note: Allow these addresses inbound to your AIS Server. They are the source addresses of Unified.to's outbound calls — no changes to your own outbound firewall rules are required. If your Unified.to connection uses a single region, you may allowlist only that region's address, but permitting all three avoids breakage if the serving region changes.

This guide describes standard JD Edwards EnterpriseOne administration using Oracle's published documentation. Exact menu labels and available settings vary by Tools Release; consult the references above for your version. Verify each step in a non-production environment first.