How do you connect to Oracle Primavera Cloud from Foundry?

Ask the Community
,
1

How do you connect Foundry to Oracle Primavera Cloud? What are potential approaches?

2

You can set up a data connection from Foundry to Oracle Primavera Cloud using its OPC REST API. You can write an external transform in code repositories to query the API.

How the API authenticates

Oracle Primavera Cloud uses OAuth 2.0 Bearer token authentication. There is no permanent API key. The flow is two steps:

  1. Request a token. You send your username and password (Base64-encoded as Basic Auth) to the primediscovery token endpoint, which returns a short-lived OAuth access token. The response also includes your tenant code (primeTenantCode).
  2. Call the API. You pass that access token as a Bearer token on the Authorization header of every subsequent request to the resource API.

Access tokens expire after one hour, so any long-running integration needs to re-request a token periodically.

There are three setup components: (1) configuration inside Oracle Primavera Cloud, (2) configuration of the data connection / source, and (3) the query logic in your transforms.

1. Setup required in Oracle Primavera Cloud

  • Enable API access. Follow Oracle’s “Configure API Access” instructions: an application administrator goes to Main Menu → Global Admin → Privacy & Security → Security tab, and in the API and Gateway section selects Allow access.
    • https://docs.oracle.com/en/industries/construction-engineering/primavera-cloud/rest-api/D207871.html
  • (Optional) Restrict by IP. In the same API and Gateway section you can restrict access to specific IP addresses. If you want to restrict it to Foundry IPs, an administrator can find your enrollment’s specific egress IPs in Control Panel → Network egress → “What IPs do connections from Foundry come from?”
  • Set up a dedicated Integration User account (recommended). Oracle recommends a dedicated integration user rather than a shared/personal account, to track data modified through integrations and avoid breakage from account lockouts or staff turnover. The account is created in your identity domain (Admin Console → Users → Add Users), then added to the owning company in Primavera Cloud.
    • https://docs.oracle.com/en/industries/construction-engineering/primavera-cloud/rest-api/D254388.html
  • Grant the Integration User the right permissions so it can access the Workspaces and Projects you want to integrate.
  • Verify by logging in as the Integration User to confirm it can actually see the expected Workspaces and Projects before you wire up the connection.

2. Setup required in Data Connection

  • Create a new Source in Data Connection for the Oracle Primavera Cloud REST API. See the REST API connector instructions:
    • https://www.palantir.com/docs/foundry/available-connectors/rest-apis/
  • Domain base URL: the URL of your Oracle Primavera Cloud instance, e.g.:
    • https://primavera.oraclecloud.com
    • This is the same host you see in your browser when logged into OPC (everything before the application path).
  • Authentication: None (the token exchange is handled in code — see component 3).
  • Create two additional secrets on the source to store the Integration User’s credentials. Never store credentials in plaintext in code:
    • username
    • password

3. Use External Transforms to query the API

Refer to the Foundry REST API docs for more detail: https://www.palantir.com/docs/foundry/available-connectors/rest-apis/#external-transforms-in-code-repositories

Below is a shortened version focused on Oracle Primavera Cloud connection.

Step 1 — Request an access token

POST https://{DOMAIN_URL}/primediscovery/apitoken/request?scope=http://{DOMAIN_URL}/api

This request uses Basic Authentication. Build the header from the stored source secrets (do not hardcode credentials). The value is the Base64 encoding of the credentials in the format youremail@company.com:yourpassword

Authorization: Basic <BASE_64_ENCODED_CLIENT_CREDENTIALS>

The response body contains the access_token and your primeTenantCode.

Step 2 — Call the resource API

Include the access token on the Authorization header of every request. Tokens expire after one hour.

Authorization: Bearer <access_token>

Depending on your tenant configuration, the resource API may also require these headers — if you get unexpected auth or routing errors, add them:

x-prime-tenant-code: <primeTenantCode>

Step 3 — Test the connection

GET https://{DOMAIN_URL}/api/restapi/util/testConnection

A successful response confirms auth is fully wired up.

Additional Troubleshooting Notes:

The unfiltered project endpoint:

GET https://{DOMAIN_URL}/api/restapi/project

tries to return projects across scopes your user may not have global access to, and for a regular (non-admin) user it commonly fails with:

You do not have the required privileges to access the requested page. (PRM-000001004)

This is a privilege/scope issue, not an auth failure (your token is fine). Instead, query projects scoped to a workspace, which works at a regular user’s access level:

GET https://{DOMAIN_URL}/api/restapi/project/workspace/{workspaceId}

Pulling all projects

To get every project, you have two options:

  1. Single transform: call the workspace endpoint (/api/restapi/workspace) to get all workspace IDs, then loop and call /project/workspace/{id} for each.
  2. Two transforms: output a dataset of workspaces in one transform, then read that dataset back in as an input to a second transform that queries projects per workspace. Reading the dataset as an input requires “Enable exports” to be toggled on for the source.

If you hit PERMISSIONS_DENIED (Exports:ExportControlMarkingsViolated), check which markings exist on the input data. Most datasets carry an organization marking — ensure the Source has those markings listed and add any that are missing.