Named Connections for EPM REST: Other Web Service Provider

Why this exists

A repeatable way to call the Oracle Cloud EPM REST API while keeping credentials encrypted and out of the rule is to register the host once in the Connections module, then call it from Groovy using operation.application.getConnection.

It is also the only supported way to make external calls from a Groovy rule. Oracle does not allow direct calls to external sources from within the Groovy sandbox; external access must be configured through the Connections module.

Host, not the browser URL

Lets say your pod's url that you log into looks like:

https://epm-acme.epm.us-phoenix-1.ocs.oraclecloud.com/epmcloud

REST does not want /epmcloud. Strip the context. The BASE-URL Oracle means in the docs is the first part only:

https://epm-acme.epm.us-phoenix-1.ocs.oraclecloud.com

Same idea on the older *.oraclecloud.com shape (https://epm2-acme.epm.us6.oraclecloud.com). Identity domain is usually sitting in that hostname (acme in the examples). Test vs prod typically share a domain; the instance name changes.

Auth: Basic is what Connections will store

Basic auth over HTTPS is the path this post is built around, because that is what you park in a named Connection:

• OCI Gen 2: username is usually just username (email-style logins included).
• Classic / Gen 1: identitydomain.username is still the format that actually works.
• Either format is documented as valid on Gen 2; if you get 401, try the other one before you rotate the password.

OAuth 2 exists (OCI Gen 2, Domain Admin has to register a client, you send Authorization: Bearer). Fine for a middleware box. Overkill for a Groovy rule talking through Connections. Stick to Basic unless you have a reason.

The user on the Connection is the user the API runs as. Roles matter. If that account cannot click the button in the UI, it cannot POST the job either.

Connections module: register it once

You are not putting a URL in the rule. You are naming a credentialed host and letting Groovy ask for it by name.

Create the connection

In the target application: Tools → Connections (some pods still say Application → Connections).

Create.

Pick Other Web Service Provider. That is the type getConnection actually speaks. The EPM-to-EPM provider is a different object.

Save. There is no dedicated Test button.

What stays in the connection

Host and Basic auth. That is it.

Do not bake /aif/rest/V1 into the URL. The first time you need /HyperionPlanning/rest/v3 you will clone the connection for no reason. The rule owns the path.

What stays in the rule

Verb, path, JSON body, RTPs, poll loop. getConnection("EPM_REST") is a lookup, not a REST call. The call is conn.post(path).body(...).asString().

If Groovy says the connection does not exist, check the name spelling and that you saved it. Connection names are pod-wide (not per application) and case-sensitive — EPM_REST and epm_rest are different lookups.

Gotchas

• Connection name mismatch. getConnection("EPM_REST") is case-sensitive. Names are shared across the pod, not scoped to one application.

• 401 after a password rotate. The identity-domain user on the Connection is not SSO. When security rotates the Automate account, every Groovy rule using that Connection 401s until you edit the Connection. The rule is fine. The secret lived in Connections, which is the point.

• /epmcloud still on the URL. Browser URL is not BASE-URL. The Groovy call will fail or 404 in ways that look like auth.

• The Connection user is the actor. RTPs are the human. The REST call runs as the Connection account. If that account cannot run the job in the UI, Groovy cannot either.