Connect IFS Cloud: verify IAM credentials and list projections

Fill your IFS Cloud URL, IAM Client ID, Client Secret and IAM Token URL into Integration and test: the system exchanges a token and lists projections to prove the credentials work. This connection verifies connectivity only and does not sync orders, customers or inventory.

The IFS Cloud connector verifies one thing: that an IFS Cloud IAM client (service account) with API access can sign in from this system. A passed test means the system exchanged your Client ID and Client Secret for an access token at your IAM Token URL and listed projections from your IFS Cloud instance. It does not pull orders, does not pull customers, does not read or push inventory, and does not sync any other document — IFS business projections differ by customer version and customisation, so no document sync runs on this connection. Use it to prove the credentials and the instance address before any document work is set up for your specific projections.

Prerequisites#

• An IFS Cloud instance you can reach, and its base address, for example https://myserver:48080. There is no default address to copy.
• An IFS Cloud IAM client (service account) with API access, and access to that client configuration so you can read its Client ID, Client Secret and token endpoint.
• The token endpoint of your own IAM, taken from that IAM client configuration. Every deployment is different, so the value must come from your own configuration.
• If your deployment uses a tenant, the tenant value; if it does not, you will leave that field empty.

Get your credentials#

1. Open the configuration of the IFS Cloud IAM client (service account) that has API access. The Client ID and Client Secret for this connection come from that client.
2. Copy the Client ID exactly as shown in that IAM client configuration.
3. Copy the Client Secret of the same IAM client. Keep it private: anyone holding it can request tokens as that service account.
4. In the same IAM client configuration, copy the token endpoint and use it as the token_url value. It follows an openid-connect token form, but the exact address is specific to your deployment — do not copy an endpoint from another company or from an example.
5. Note your IFS Cloud base address at the same time, and the tenant value if your deployment uses one.

Fill it into Integration#

1. Open Integration → Connector Marketplace → IFS → New connection.
2. base_url — required, IFS Cloud URL: your IFS Cloud base address, for example https://myserver:48080.
3. tenant — optional, Tenant: fill it only if your deployment uses a tenant, for example TENANT1; otherwise leave it empty.
4. client_id — required, IAM Client ID: the Client ID of the IAM client (service account) with API access. It is stored as a secret.
5. client_secret — required, IAM Client Secret: the Client Secret of the same IAM client. It is a password-type field and is stored as a secret.
6. token_url — required, IAM Token URL: the token endpoint copied from your own IAM client configuration. There is no default endpoint, so this value must come from your own IFS Cloud IAM.

Test the connection#

Click Test connection. The test runs two real steps. First it uses the OAuth2 client credentials flow at the token_url you filled in, exchanging client_id and client_secret for an access token. Then it calls your instance with that token to list projections — GET {base}/main/ifsapplications/projection/v1/AllProjections.svc/Projections?$top=1 — which proves both that the token works and that projections can be discovered on your instance. A 200 response counts as a pass. If base_url is missing, the test stops with MISSING_BASE_URL; if client_id or client_secret is missing it stops with MISSING_CREDENTIALS, and if token_url is missing it stops with MISSING_CONFIG, without sending a request. The test allows 12 seconds before it reports TEST_TIMEOUT.

Mapping / pick a template#

There is no document mapping to pick for this connection yet. IFS business projections are named per customer version and customisation, so this connection does not offer an order, customer or inventory mapping and does not run a template that syncs documents. What you can check after a passed test is the projection list itself: it shows which projections your instance exposes, which is the starting point if document work is later set up against your specific projections. Do not expect a mapping choice to make orders or inventory flow — on this connection, they do not.

Activate#

Activate the connection only after the test has passed. Activation saves this verified connection — the instance address, the optional tenant and the IAM credentials — so the connectivity check can be run again at any time, for example after an IAM client is rotated or the instance address changes.

What activation does not start: no orders, customers, inventory or any other documents are pulled or pushed by this connection, at activation or on a schedule. If you need document sync with IFS, that work has to be set up against the actual business projections of your instance, starting from the projection list the test returns.

FAQ#

Test stops with MISSING_BASE_URL, MISSING_CREDENTIALS or MISSING_CONFIG

A required field is empty, and the test does not send a request until all of them are present. MISSING_BASE_URL means base_url is empty, MISSING_CREDENTIALS means client_id or client_secret is empty, and MISSING_CONFIG here means token_url is empty.

Fill in base_url, client_id, client_secret and token_url from your own IAM client configuration and instance, save, and test again. Add tenant only if your deployment uses one.

Test fails with INVALID_CREDENTIALS or AUTH_FAILED

Your IAM refused the exchange: the token endpoint answered, but it did not accept the Client ID and Client Secret, or it returned no access token. The usual cause is a secret copied from a different IAM client, a rotated secret, or a token_url that belongs to a different IAM than the client.

Open that one IAM client configuration again and copy client_id, client_secret and token_url together from the same place, so all three belong to the same client and the same IAM. Paste them again in full and retest.

Test fails with INVALID_TOKEN

A token was obtained, but your IFS Cloud instance did not accept it on the projection list call. That points to a mismatch between the IAM that issued the token and the instance in base_url — for example a token_url from a different deployment, or a base_url that points at another IFS Cloud instance.

Check that base_url is the address of the same IFS Cloud deployment whose IAM issued the credentials, and that token_url was copied from that deployment IAM client configuration. Correct the mismatched value and retest.

Test fails with MISSING_SCOPE

The token works, but the service account behind the IAM client is not allowed to access projections on the instance, so the projection list call is refused.

In IFS Cloud, grant that IAM client (service account) access to the projections, then test again with the same values. Do not switch to a personal user account to work around it — this connection is meant to run as the service account.

Test reports TEST_TIMEOUT or CONNECTION_FAILED

The request did not finish. TEST_TIMEOUT means no complete answer arrived within 12 seconds; CONNECTION_FAILED means the network request to the token endpoint or the instance failed. With a self-hosted address this is often a base_url or token_url that cannot be reached from outside, or a port that is not open.

Open the base_url and the token_url host from a browser to confirm both answer, check the port in the address (for example :48080) is reachable, then test again. If both answer in the browser and the test still times out, check with your IFS administrator whether outside access to the projection endpoint is allowed.

A document action reports ERP_ENDPOINTS_PENDING, or nothing syncs after activation

That is the current scope of this connection, not a wrong value. Business operations on IFS — pulling orders or customers, reading or pushing inventory — are not run by this connection, because the business projection names differ per customer instance. A passed test only ever proves the IAM credentials work and projections can be listed.

Keep using the connection for connectivity verification. For document sync, start from the projection list returned by the test and have the work set up against the actual Integration projections of your instance — changing the five connection values will not turn document sync on.