---
title: Oracle Fusion Integration Setup
description: >-
  Configure Oracle Fusion to authorize Datadog to access its REST APIs using
  OAuth 2.0.
breadcrumbs: Docs > Integrations > Integration Guides > Oracle Fusion Integration Setup
---

# Oracle Fusion Integration Setup

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Use this guide to give Datadog access to Oracle Fusion REST APIs using OAuth 2.0. The setup process establishes a read-only, least-privilege integration between Datadog and your Fusion instance.

Datadog queries Oracle Fusion REST APIs, including enterprise service scheduler (ESS) logs and data from enterprise resource planning (ERP), human capital management (HCM), supply chain management and manufacturing (SCM), and customer experience (CX). To set up the integration, create the following components in your Fusion environment:

1. **Confidential Application**: An OAuth 2.0 client used for secure machine-to-machine authentication.
1. **Integration User**: A dedicated Fusion user with read-only and ESS-related roles, created in Fusion Security Console.
1. **Role Assignments**: Permissions for Datadog to read job logs and REST resources, granted to the integration user.
1. **Datadog tile configuration**: The credentials and URLs collected during setup, entered in the Oracle Fusion integration tile. After configuration is complete, Datadog obtains OAuth access tokens from your Fusion Identity Domain and uses them to call your Fusion REST APIs.

## Prerequisites{% #prerequisites %}

- You have Security Console access in Fusion.
- You have access to the Fusion Identity Domain (OCI IAM) associated with your Fusion instance. Full OCI access is not required.
- Your account has permission to:
  - Create Confidential Applications
  - Create and modify users
  - Assign job roles

## Create a confidential application{% #create-a-confidential-application %}

Create an OAuth client that Datadog uses to authenticate against your Fusion Identity Domain.

1. Navigate to **Identity & Security** > **Domains** and open the Identity Domain associated with your Oracle Fusion instance.
1. Navigate to **Integrated Applications** > **Add Application** > **Confidential Application**.
1. Enter a name such as `Datadog Fusion Integration` and click **Create**.
1. Navigate to **OAuth Configuration** > **Edit OAuth configuration** and configure the following settings:
   1. Select **Configure this application as a client now** and check **Client credentials** under **Allow grant types**.
   1. Enable **Bypass consent** and allow client IP addresses from anywhere.
   1. Under **Token Issuance Policy**, select **Specific** and toggle **Add Resources** on.
   1. Under **Resources**, select **Add scope** and choose your Fusion application, typically called **Fusion Applications Cloud Service**.
   1. Leave all other fields as default.
1. Save the OAuth configuration changes, then activate the application under **Actions** at the top of the screen.
1. Copy the following values to enter in Datadog later:
   - **Client ID**: Found under **OAuth Configuration** > **General Information**
   - **Client Secret**: Found under **OAuth Configuration** > **Client Secret**
   - **Scope**: Found under **OAuth Configuration** > **Resources** > **Scope**
   - **Token Endpoint (OAuth URL)**: `https://idcs-<IDENTITY_DOMAIN_ID>.identity.oraclecloud.com/oauth2/v1/token`. The identity domain value is found under **Domain Details** > **Domain URL**.

For more information, see [Configure OAuth Using Client Credentials Grant Type](https://docs.oracle.com/en/cloud/saas/applications-common/25d/farca/configure_oauth.html) in the Oracle documentation.

## Create a Fusion integration user{% #create-a-fusion-integration-user %}

Datadog accesses Fusion through a dedicated read-only service account. This user carries the roles that control what Datadog can read.

1. In Fusion, navigate to **Security Console** > **Users** > **Create User**.
1. Set the username to exactly match the Client ID generated in the previous step.
1. Assign an email alias to the user. The user does not need to log in manually.
1. Save the user.

## Assign required roles{% #assign-required-roles %}

Grant the following roles to the integration user so that Datadog can read ESS logs and Fusion REST API data. Role names may vary in your Fusion environment.

1. In Fusion, navigate to **Security Console** > **Users** > **Edit User** > **Roles** > **Add Role**.
1. Assign the following roles:

| Role                   | Code                                 | Purpose                               |
| ---------------------- | ------------------------------------ | ------------------------------------- |
| ESS Monitor            | `ESSMonitor`                         | Read ESS job requests and job logs    |
| Integration Specialist | `ORA_FND_INTEGRATION_SPECIALIST_JOB` | Access ERP Integration REST endpoints |
| Internal Auditor       | `ORA_FND_INTERNAL_AUDITOR_JOB`       | Read-only access to audit data        |

{% alert level="info" %}
The ESS Monitor role cannot be assigned directly to a user. To assign it, navigate to **Security Console** > **Roles** > **Create Role** to create a custom role, add `ESSMonitor` under **Role Hierarchy**, then assign the new role to the integration user.
{% /alert %}

## Configure the Datadog tile{% #configure-the-datadog-tile %}

In the Datadog UI, enter the following values in the Oracle Fusion integration tile:

- **Fusion Base URL**
- **Token Endpoint (OAuth URL)**
- **Client ID**
- **OAuth Scope**
- **Client Secret**

## Validation{% #validation %}

Datadog automatically validates your credentials and displays error messages with suggested remedies if the connection fails.

To confirm the integration is working after your account is created:

- In the [Log Explorer](https://docs.datadoghq.com/logs/explorer.md), filter by `source:oracle-fusion` to view ESS and audit logs.
- In the [Metrics Explorer](https://docs.datadoghq.com/metrics/explorer.md), search for `oracle.fusion.*` to view Oracle Fusion metrics, such as `oracle.fusion.ess.jobs`.

If the integration is not returning data, verify that you have enabled logging in Fusion. Navigate to **Setup and Maintenance** > **Manage Audit Policies** and set all audit levels to **High**.

## Further reading{% #further-reading %}

- [Monitor Oracle Fusion Applications with Datadog](https://www.datadoghq.com/blog/oracle-fusion-applications-integration/)