Connecting Oracle Fusion ERP and Oracle EDM to Caddi

As of Sep 25, 2026

This guide sets up a connection between your Oracle environment and Caddi, so Caddi can work with the Oracle REST APIs on each user's behalf.

There are two parts. Steps 1 to 6 are done once, by an administrator, and register Caddi with your Oracle environment. After that, each person who wants to use the integration connects their own Oracle account - a single click, covered in Step 7. Caddi acts as that person, with their permissions, and never with more.

The one-time setup takes about 20 minutes and happens mostly in the OCI Console. The same steps cover Oracle Fusion ERP (Financials) and Oracle EDM; where they differ, both are shown.

Steps 1 to 6 need one person with administrator access to the OCI Identity Domain that fronts your Oracle environment — specifically the ability to create an application under Integrated applications and to edit the Fusion or EDM resource application. In most organisations this is an Oracle or IAM administrator, not a Fusion functional lead.

Your end users need nothing from this section. They do not need OCI Console access, and they are not involved until Step 7, where each of them connects their own Oracle account.

One value comes from Caddi rather than Oracle — the redirect URL you register in Step 2:

If you run separate production and test environments, treat them as two separate exercises. Oracle scopes a token to one environment, so each one needs its own application and its own connection in Caddi.

Five values. The steps below produce them in this order, and you enter all five into one form at the end.

The identity domain host and the Fusion or EDM host are different servers. One issues tokens, the other serves the API. Mixing them up is the most common setup mistake, so Step 5 covers both explicitly.

This is the server that will issue tokens to Caddi.

It looks like https://idcs-abc123.identity.oraclecloud.com.

Caddi wants the host only, so drop the https:// and any trailing slash when you enter it later. Record it as:

Stay on this domain for Steps 2 to 4.

Still in your identity domain:

Then set these, exactly:

Save, then copy the Client ID and Client Secret. The secret is shown once - store it somewhere safe before leaving the page.

Finally, make sure the application is activated. A newly created application is often left deactivated, and a deactivated application rejects every sign-in.

Both grants, not just one. Oracle's own Fusion documentation says Authorization code is "the only grant type required for this flow". That is true for signing in once, but not for staying connected. Without Refresh token and Allow token refresh, your connection authorises successfully and then stops working about an hour later with no way to renew it. This is the single most common cause of a connection that works on Monday and is dead on Tuesday.

The redirect URL must match exactly. Oracle compares it character for character. A trailing slash, http instead of https, or a different subdomain will all fail at sign-in. Paste it, do not retype it. Oracle also rejects relative URLs, and plain http:// addresses are refused unless an administrator has explicitly allowed them.

The application now exists, but it cannot reach Fusion or EDM until you grant it the right resource.

Save.

That last point catches people out: Allow token refresh has to be enabled in two places - on the client application you created in Step 2, and on the resource you just added here. Enabling only one of them produces the same symptom as enabling neither.

The scope tells Oracle which environment the token is for. Copy it from the console rather than typing it. It is one continuous string that looks like two joined together, and adding a space where the seam appears will break the connection.

It looks like this — note there is no space in the middle:

It looks like this:

Whichever product you are on, add one space and the word offline_access to the end. That single word is what allows Caddi to renew the connection without asking your users to sign in again every hour.

The finished value, for Fusion ERP:

The only space in that string is the one before offline_access. If you see another space anywhere, the value has been mistyped or reflowed by a text editor — copy it again.

This is the address of the environment itself, not the identity domain. It is the host you see when you sign in to Fusion or EDM in a browser.

Take the host from your Fusion URL, without https:// and without any path:

Take the host from your EDM URL, without https:// and without the /epm/rest or /epmcloud path. Two shapes are in circulation depending on when your environment was provisioned:

Either is fine — use whichever matches your environment.

If you have both production and test, note that these are different hosts and need separate Caddi connections. A token issued for one will not work against the other.

In Caddi, open the connector - Oracle Fusion ERP or Oracle EDM - and fill in the five fields:

Save. Caddi checks the scope at this point and will refuse it if offline_access is missing, so a save that goes through means that part is right.

That completes the one-time setup. The connector is now available to your team, but nobody is connected to it yet.

This part is done by every person who wants to use the integration, including the administrator who did Steps 1 to 6. It takes one click.

Each person's connection is separate and carries their own Oracle permissions. Caddi can see and change exactly what that person could see and change in Fusion or EDM directly — no more. Two people using the same Caddi workspace may legitimately get different results, because Oracle is applying their individual roles.

Nobody needs OCI Console access for this step, and nobody needs the client ID, client secret or scope. Those were entered once in Step 6 and are not shown to users.

One timing note: Oracle's authorisation code expires after three minutes. If you start signing in, get distracted, and come back later, it will fail. Start again and complete it in one go.