Caddi connects to Elite 3E Cloud using an OAuth 2.0 client-credentials flow through Elite ID. Your IT team registers an application in your own Microsoft Entra ID, then supplies the credentials along with your 3E instance ID and APIM subscription key.
This is a server-to-server connection. There is no user sign-in step and no consent screen, so https://app.trycaddi.com/oauth-callback is not used anywhere in the Elite 3E setup.
All 3E API calls run as the 3eappintegrationuser account and respect 3E process-level security. Granting that user access to the right 3E processes is a required step, not an optional one.
On-premises 3E uses Windows Authentication rather than OAuth and requires 3E User Interface 2.8.1 or later. This guide covers 3E Cloud. Contact Caddi support if you are on-premises.
Before you start
You'll need:
3E Cloud, migrated to Elite ID authentication
An administrator who can create an App Registration in your firm's Microsoft Entra ID — or a Thomson Reuters support case to have credentials issued
A 3E administrator who can grant process access to
3eappintegrationuserOwner or Admin access to your Caddi organization
Thomson Reuters will not issue 3E API credentials to Caddi directly. They must come from your firm.
Step 1: Register the application in Microsoft Entra ID
Thomson Reuters KB article E-21152 documents this process; your TR customer portal is the authoritative source. In summary:
In the Microsoft Entra admin center, go to App registrations → New registration.
Name it something identifiable, for example
Caddi 3E Integration.Create a client secret on the registration and copy the value immediately — Entra shows it only once.
Record the Application (client) ID and the Directory (tenant) ID.
Note the client secret's expiry date. Entra secrets expire, commonly after 24 months, and the integration will stop when they do.
Alternatively, open a case through the Thomson Reuters customer portal (KB 000005694) and ask TR Support to issue API credentials for your account.
Step 2: Collect your instance ID and subscription key
Open the 3E Cloud Management Tool and go to the Tenants page to read the Instance ID for the environment you want to connect.
Retrieve the Subscription Key for the API gateway from the Elite developer portal.
If you are connecting the Elite preview environment rather than live, note that too.
Step 3: Grant 3E process access to the integration user
This is the step firms most often miss. A valid token is not enough — every 3E API call runs as 3eappintegrationuser and is checked against process-level security.
Have your 3E administrator grant
3eappintegrationuseraccess to each 3E process your loops need to read or write.Grant only the processes required. There is no need to give the integration user administrative rights.
If a loop returns permission errors despite a working connection, this is almost always the cause.
Step 4: Configure Elite 3E in Caddi
This step must be completed by a Caddi organization owner or admin.
In Caddi, open Integrations in the left sidebar, then click the Integration Setup tab at the top of the page. This tab is only visible to organization owners and admins.
Find Elite 3E in the list and click Configure.
Enter the following values:
Client ID — the Entra Application (client) ID
Client Secret — the Entra client secret value
Tenant ID — the Entra Directory (tenant) ID
Instance ID — your 3E instance ID, sent as the
X-3E-InstanceIdheaderSubscription Key — your APIM subscription key, sent as the
x-subscription-keyheaderPreview Environment — leave off for live. Enable only to connect the Elite preview environment.
Click Save Configuration. Caddi validates the credentials immediately — if something is wrong you'll see an error right away, and nothing is stored until validation passes.
How the connection behaves
One shared identity. All Caddi activity in 3E runs as
3eappintegrationuser. 3E audit records attribute actions to that account, not to individual Caddi users.Access is governed by 3E process security, not OAuth scopes. To widen or narrow what Caddi can do, change the integration user's process access in 3E.
Revoking access. Delete the client secret or the app registration in Entra ID, or remove the integration user's process access in 3E.
Client secrets expire. Entra secrets have a maximum lifetime set by your tenant policy. Record the expiry date at creation and rotate ahead of it.
There is no Thomson Reuters integration sandbox. Plan first-time rollouts carefully, or use the Elite preview environment if your firm has access to one.
Troubleshooting
Token requests succeed but every API call returns a permission error
3eappintegrationuser has not been granted access to the 3E processes your loop needs. This is the single most common Elite 3E setup failure — have your 3E administrator grant process access.
invalid_client or unauthorized_client on the token request
Check the Tenant ID and Client ID for transcription errors, then confirm the client secret hasn't expired in Entra ID.
Calls reach 3E but return a 401 from the gateway
The Subscription Key is missing or wrong. Retrieve it again from the Elite developer portal.
The integration worked for a year or two and then stopped
Your Entra client secret expired. Create a new secret and update the configuration in Caddi.
Caddi reaches the wrong 3E environment
Check the Instance ID and the Preview Environment toggle. Each 3E environment has its own instance ID.
Still stuck? Contact Caddi support with the exact error message you're seeing and the time it occurred.
Automation ideas
Law Firms
Meeting or call → 3E time entry
Caddi reads meeting duration and participants, drafts a narrative that meets your firm's billing guidelines, and posts the time entry to the right 3E matter.
New matter request → 3E matter setup
Caddi takes an approved new-business form and creates the client and matter records in 3E with the correct rates, billing attorney, and matter type.
Vendor invoice → 3E disbursement
Caddi reads an incoming invoice, extracts the amount and matter reference, and creates the disbursement entry for approval.
Pre-bill cycle → attorney review packs
Caddi assembles each attorney's unbilled time and disbursements from 3E into a review pack, flags entries that fail client billing guidelines, and routes them for edit before release.