# How do you connect to Oracle Primavera Cloud from Foundry? **URL:** \ **Category:** Ask the Community\ **Tags:** code-repositories, data-connection\ **Created:** [July 21, 2026, 3:06pm UTC](https://community.palantir.com/t/how-do-you-connect-to-oracle-primavera-cloud-from-foundry/6972 "2026-07-21T15:06:50Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![yix](https://avatars.discourse-cdn.com/v4/letter/y/3da27b/32.png) [@yix](https://community.palantir.com/u/yix)\ **Post date:** [July 21, 2026, 3:06pm UTC](https://community.palantir.com/t/how-do-you-connect-to-oracle-primavera-cloud-from-foundry/6972/1 "2026-07-21T15:06:50Z")
How do you connect Foundry to Oracle Primavera Cloud? What are potential approaches? ---
**Author:** ![yix](https://avatars.discourse-cdn.com/v4/letter/y/3da27b/32.png) [@yix](https://community.palantir.com/u/yix)\ **Post date:** [July 21, 2026, 3:10pm UTC](https://community.palantir.com/t/how-do-you-connect-to-oracle-primavera-cloud-from-foundry/6972/2 "2026-07-21T15:10:51Z")
You can set up a data connection from Foundry to Oracle Primavera Cloud using its OPC REST API. You can write an external transform in code repositories to query the API. ## How the API authenticates Oracle Primavera Cloud uses **OAuth 2.0 Bearer token** authentication. There is no permanent API key. The flow is two steps: 1. **Request a token.** You send your username and password (Base64-encoded as Basic Auth) to the primediscovery token endpoint, which returns a short-lived OAuth access token. The response also includes your tenant code (primeTenantCode). 2. **Call the API.** You pass that access token as a Bearer token on the Authorization header of every subsequent request to the resource API. Access tokens **expire after one hour** , so any long-running integration needs to re-request a token periodically. There are three setup components: **(1)** configuration inside Oracle Primavera Cloud, **(2)** configuration of the data connection / source, and **(3)** the query logic in your transforms. * * * ## 1. Setup required in Oracle Primavera Cloud - **Enable API access.** Follow Oracle’s “Configure API Access” instructions: an application administrator goes to **Main Menu → Global Admin → Privacy & Security → Security tab** , and in the **API and Gateway** section selects **Allow access**. - - https://docs.oracle.com/en/industries/construction-engineering/primavera-cloud/rest-api/D207871.html - **(Optional) Restrict by IP.** In the same **API and Gateway** section you can restrict access to specific IP addresses. If you want to restrict it to Foundry IPs, an administrator can find your enrollment’s specific egress IPs in **Control Panel → Network egress → “What IPs do connections from Foundry come from?”** - **Set up a dedicated Integration User account (recommended).** Oracle recommends a dedicated integration user rather than a shared/personal account, to track data modified through integrations and avoid breakage from account lockouts or staff turnover. The account is created in your identity domain (Admin Console → Users → Add Users), then added to the owning company in Primavera Cloud. - - https://docs.oracle.com/en/industries/construction-engineering/primavera-cloud/rest-api/D254388.html - **Grant the Integration User the right permissions** so it can access the Workspaces and Projects you want to integrate. - **Verify by logging in as the Integration User** to confirm it can actually see the expected Workspaces and Projects before you wire up the connection. * * * ## 2. Setup required in Data Connection - **Create a new Source** in Data Connection for the Oracle Primavera Cloud REST API. See the REST API connector instructions: - - https://www.palantir.com/docs/foundry/available-connectors/rest-apis/ - **Domain base URL:** the URL of your Oracle Primavera Cloud instance, e.g.: - - https://primavera.oraclecloud.com - This is the same host you see in your browser when logged into OPC (everything before the application path). - **Authentication:** None (the token exchange is handled in code — see component 3). - **Create two additional secrets** on the source to store the Integration User’s credentials. Never store credentials in plaintext in code: - - username - password * * * ## 3. Use External Transforms to query the API Refer to the Foundry REST API docs for more detail: https://www.palantir.com/docs/foundry/available-connectors/rest-apis/#external-transforms-in-code-repositories Below is a shortened version focused on Oracle Primavera Cloud connection. ### Step 1 — Request an access token ```bash POST https://{DOMAIN_URL}/primediscovery/apitoken/request?scope=http://{DOMAIN_URL}/api ``` This request uses **Basic Authentication**. Build the header from the stored source secrets (do **not** hardcode credentials). The value is the Base64 encoding of the credentials in the format youremail@company.com:yourpassword ```bash Authorization: Basic ``` The response body contains the access\_token and your primeTenantCode. ### Step 2 — Call the resource API Include the access token on the Authorization header of every request. Tokens expire after one hour. ```bash Authorization: Bearer ``` Depending on your tenant configuration, the resource API may also require these headers — if you get unexpected auth or routing errors, add them: ```bash x-prime-tenant-code: ``` ### Step 3 — Test the connection ```bash GET https://{DOMAIN_URL}/api/restapi/util/testConnection ``` A successful response confirms auth is fully wired up. ### Additional Troubleshooting Notes: The unfiltered project endpoint: ```bash GET https://{DOMAIN_URL}/api/restapi/project ``` tries to return projects across scopes your user may not have global access to, and for a regular (non-admin) user it commonly fails with: ```markdown You do not have the required privileges to access the requested page. (PRM-000001004) ``` This is a **privilege/scope** issue, not an auth failure (your token is fine). Instead, query projects **scoped to a workspace** , which works at a regular user’s access level: ```bash GET https://{DOMAIN_URL}/api/restapi/project/workspace/{workspaceId} ``` ### Pulling all projects To get every project, you have two options: 1. **Single transform:** call the workspace endpoint (/api/restapi/workspace) to get all workspace IDs, then loop and call /project/workspace/{id} for each. 2. **Two transforms:** output a dataset of workspaces in one transform, then read that dataset back in as an input to a second transform that queries projects per workspace. Reading the dataset as an input requires **“Enable exports”** to be toggled on for the source. > If you hit PERMISSIONS\_DENIED (Exports:ExportControlMarkingsViolated), check which markings exist on the input data. Most datasets carry an organization marking — ensure the Source has those markings listed and add any that are missing. ---
**Author:** ![system](https://yyz1.discourse-cdn.com/palantir/user_avatar/community.palantir.com/system/32/3_2.png) [@system](https://community.palantir.com/u/system)\ **Post date:** [October 20, 2026, 11:10pm UTC](https://community.palantir.com/t/how-do-you-connect-to-oracle-primavera-cloud-from-foundry/6972/3 "2026-10-20T23:10:57Z")
This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.