--- title: "How to setup Oracle JD Edwards" img: https://unified.to/images/logo.svg date: 2026-08-17T01:48:00.000Z tag: Guides description: "Administrator guide — How to configure your JD Edwards EnterpriseOne environment so Unified.to can securely read data through the Application Interface..." url: "https://unified.to/blog/how_to_setup_oracle_jd_edwards" --- # How to setup Oracle JD Edwards ------ _August 17, 2026_ # Connect JD Edwards to [Unified.to](http://unified.to/) **Administrator guide** — How to configure your JD Edwards EnterpriseOne environment so [Unified.to](http://unified.to/) can securely read data through the Application Interface Services (AIS) Server REST API. > **Audience:** JDE / CNC administrator · **Applies to:** EnterpriseOne 9.2 · **Access level:** Read-only --- ## Overview [Unified.to](http://unified.to/) connects to JD Edwards the same way any external REST client does — through the **Application Interface Services (AIS) Server**, the lightweight JSON-over-REST gateway that ships with EnterpriseOne. **Nothing is installed inside your JD Edwards environment.** [Unified.to](http://unified.to/) makes outbound HTTPS calls to your AIS Server, signs in with a JD Edwards user account you provide, and reads data using the standard AIS services. Every request is authenticated by EnterpriseOne and constrained by that user's security. This guide walks a JDE or CNC administrator through the one-time setup: confirming the AIS Server, securing it, creating a dedicated service account, granting the right access, opening the network path, and verifying the connection before handing the sign-in details to [Unified.to](http://unified.to/). ```plain text Unified.to ──HTTPS──▶ AIS Server (/jderest) ──E1 auth──▶ EnterpriseOne (external client) (token & data services) (apps, security, data) ``` --- ## Before you begin - [ ] **An AIS Server is deployed and running.** AIS is managed in Server Manager as part of your EnterpriseOne Tools installation. - [ ] **EnterpriseOne Tools Release 9.2.4 or later.** This is the minimum release documented for the AIS Server REST API. - [ ] **The AIS Server is configured with a Security Server.** From Tools 9.2.2.2 onward, an AIS Server must be associated with an EnterpriseOne Enterprise (Security) Server. - [ ] **You can create users and assign roles** in the EnterpriseOne security tools, and you can reach Server Manager. - [ ] **You know which environment and role** the integration should sign in to (for example a reporting or production environment). --- ## Step 1 — Confirm the AIS Server and note its URL In Server Manager, open your AIS Server instance and confirm it is started. AIS exposes its services under a base URL of the form: ```plain text https://:/jderest ``` Record this base URL — [Unified.to](http://unified.to/) needs it. Individual services live beneath it (for example the token request and data services), so the host and port are all you supply. > **Note:** If AIS sits behind a reverse proxy or load balancer, use the externally reachable URL that terminates TLS, not the internal application-server address. --- ## Step 2 — Require HTTPS Configure the AIS Server (or the proxy in front of it) to use SSL/TLS so all traffic is over HTTPS. The AIS Server supports SSL configuration through Server Manager and the application server it runs on. - Install a certificate signed by a trusted public authority so [Unified.to](http://unified.to/) can validate it. - Avoid self-signed certificates for production; they cause TLS validation failures for external clients. > **⚠ Important:** Credentials are sent on every sign-in. Do not expose the AIS Server over plain HTTP. --- ## Step 3 — Enable the authentication method in AIS security settings In Server Manager, open the AIS Server's **Application Interface Services Security Settings**. The login type used by the client must be enabled there for that client to authenticate. Enable standard EnterpriseOne username/password authentication. Confirm the AIS Server's Security Server host and port are defined so it can validate sign-ins against EnterpriseOne. > **Note:** These settings are shared by all AIS clients. Changing them affects every application that uses this AIS Server, so review them with your CNC team before saving. --- ## Step 4 — Create a dedicated service account Create a JD Edwards EnterpriseOne user reserved for this integration rather than reusing a person's login. A dedicated account keeps the integration's activity auditable and easy to revoke. - Assign it a role scoped to **read/inquiry access** for the data the integration should see. - Set the default **environment** and **role** it signs in with, or plan to supply them explicitly. - Apply your standard password policy; use a strong, unique password. > **✓ Best practice:** Because [Unified.to](http://unified.to/) reads data, a role with inquiry-level access is sufficient. Grant no more than the integration needs. --- ## Step 5 — Grant the account access Two layers govern what the service account can do — make sure both allow the data you intend to share: - **AIS access.** Per your Tools release, grant the user access to the AIS Server — for example by adding it to the AIS user allowlist or assigning the appropriate AIS role — so it is permitted to authenticate as an AIS client. - **EnterpriseOne security.** AIS requests honor EnterpriseOne security. Use Security Workbench to ensure the user's role has access to the applications and data the integration reads, and review any **row** and **column** security that would hide records or fields. > **Note:** If the integration returns fewer records or fields than expected, security on the role is the usual cause — the account can only ever see what EnterpriseOne security permits. --- ## Step 6 — Open the network path [Unified.to](http://unified.to/)'s servers must be able to reach your AIS Server over HTTPS. - Allow inbound HTTPS to the AIS host/port through your firewall — restricted to [Unified.to](http://unified.to/)'s egress IP addresses listed in the [appendix](https://app.notion.com/p/unified-to/bf8154eb04f84537b972c6170fb94a79?v=e7df13bafc244e839a8b60b15ec0f96d&p=3bf6207b838480c78091fc0cb6d883de&pm=s#appendix--unifiedto-egress-ip-addresses) below. - If you expose AIS through a gateway or DMZ proxy, forward the `/jderest` path to the AIS Server. - The AIS Server's **allowed origins** (CORS) setting governs browser-based callers. Server-to-server calls are not subject to browser CORS, but confirm no other network policy blocks the caller. --- ## Step 7 — Review the session timeout When a client signs in, the AIS Server issues a session token that expires after an idle period you control in Server Manager. The default is short; keep it reasonable so routine syncs don't expire mid-request, while still meeting your security policy. > **Note:** [Unified.to](http://unified.to/) re-authenticates automatically when a token expires, so no coordination on exact timing is required — this is just to avoid an unusually aggressive timeout. --- ## Step 8 — Verify the connection From a machine that can reach the AIS Server, request a token with the service account. A successful response confirms the URL, TLS, security settings, and account are all working together: ```bash # Request an AIS session token curl -X POST -H "Content-Type: application/json" \ https://:/jderest/v2/tokenrequest \ -d '{ "username": "", "password": "", "environment": "", "role": "", "deviceName": "unifiedto" }' ``` A JSON response containing user information and a token means the account can authenticate. An error points to the layer to revisit — see the table below. --- ## Troubleshooting | Symptom | Likely cause | Where to look | | ---------------------------- | --------------------------------------------------- | ------------------------------------------------------------------- | | Connection refused / timeout | Network path or TLS not reachable from outside. | Firewall rules, proxy, AIS host/port (Step 6), HTTPS (Step 2). | | Certificate error | Self-signed or untrusted certificate. | Install a publicly trusted certificate (Step 2). | | 401 Unauthorized | Bad credentials, or login type not enabled. | Service account and AIS security settings (Steps 3–4). | | 403 / access denied | User not permitted as an AIS client. | AIS access / allowlist or AIS role (Step 5). | | Signs in, no data | EnterpriseOne security hides the records or fields. | Security Workbench: application, row, and column security (Step 5). | | Works, then fails later | Session token expired. | AIS session timeout (Step 7). | --- ## Hand off to [Unified.to](http://unified.to/) Once the token test succeeds, provide these values to [Unified.to](http://unified.to/) when creating the connection. Share the password through a secure channel. | Field | Value | | ------------------ | --------------------------------------------------------------------------------- | | **AIS Server URL** | The base HTTPS URL, e.g. `https://jde.example.com:9302` | | **Username** | The dedicated service account you created | | **Password** | That account's password | | **Environment** | _Optional_ — the environment to sign in to (defaults to the AIS Server's setting) | | **Role** | _Optional_ — the role to sign in with (defaults to the AIS Server's setting) | --- ## References - [Managing the AIS Server through Server Manager](https://docs.oracle.com/en/applications/jd-edwards/interoperability/9.2.x/eoiis/managing-the-ais-server-through-server-manager.html) - [Application Interface Services (AIS) Server and AIS Client Security](https://docs.oracle.com/en/applications/jd-edwards/administration/9.2.x/eotsc/application-interface-services-ais-server-and-ais-client.html) - [REST API for the JD Edwards EnterpriseOne AIS Server — Authentication](https://docs.oracle.com/en/applications/jd-edwards/cross-product/9.2/rest-api/Authentication.html) - [REST API for the JD Edwards EnterpriseOne AIS Server — Quick Start](https://docs.oracle.com/en/applications/jd-edwards/cross-product/9.2/rest-api/QuickStart.html) - [JD Edwards EnterpriseOne Tools: Application Interface Services Server Reference Guide](https://docs.oracle.com/en/applications/jd-edwards/interoperability/9.2.x/eoiis/) --- ## Appendix — [Unified.to](http://unified.to/) egress IP addresses [Unified.to](http://unified.to/) calls your AIS Server from the fixed IP addresses below. Allow inbound HTTPS from these addresses to the AIS host/port in your firewall or reverse proxy (Step 6). Allowlisting all three keeps the connection working regardless of which [Unified.to](http://unified.to/) region serves it. ```plain text 44.199.69.244 3.65.142.239 13.239.151.208 ``` | IP address | Region | | ---------------- | ------------------------ | | `44.199.69.244` | United States | | `3.65.142.239` | European Union | | `13.239.151.208` | Australia / Asia-Pacific | > **Note:** Allow these addresses **inbound** to your AIS Server. They are the source addresses of [Unified.to](http://unified.to/)'s outbound calls — no changes to your own outbound firewall rules are required. If your [Unified.to](http://unified.to/) connection uses a single region, you may allowlist only that region's address, but permitting all three avoids breakage if the serving region changes. --- _This guide describes standard JD Edwards EnterpriseOne administration using Oracle's published documentation. Exact menu labels and available settings vary by Tools Release; consult the references above for your version. Verify each step in a non-production environment first._