# How to Add AI to IBM Maximo On-Prem Without Cloud > Source: https://netray.co/erp-help/private-ai-layer-ibm-maximo-manage-on-prem-architecture > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: ERP Help ## Short answer Use Maximo's REST API on object structures such as MXWO and MXASSET, or a read-only database replica, as the data path. Index manuals and attachments separately, serve an open-weight model locally, and let the tool server call Maximo as the signed-in user so security groups and site restrictions apply. Write-back creates draft records only, with human approval. ## Kind advanced ## System on-prem-apps ## Erp IBM Maximo Manage (on-prem) ## Module Work Orders, Assets, Inventory / Private AI layer ## Query how to add AI to IBM Maximo on-prem without cloud ## Alternate Queries - Maximo REST API LLM integration on-premise - Maximo work order AI assistant local model - Maximo oslc query natural language ## Applies To Maximo 7.6.1.x and Maximo Application Suite Manage deployed on-prem or on your own OpenShift. API keys are available from 7.6.1.2 onward; confirm against your fix pack. ## Steps ### Add a private AI layer to Maximo **Items:** List the questions maintenance planners and reliability engineers ask most: backlog by craft, overdue PMs, repeat failures by asset, parts availability for a work order, and what the manual says about a fault. Choose the data path per question: Maximo REST (OSLC) with oslc.where for live operational data, and a read-only replica for heavy analytics such as failure trends over years. Create an API key or service identity for the tool server, and have it call Maximo on behalf of the end user wherever the user's own security must apply. Build the document index from attachments (DOCLINKS), OEM manuals, job plans and failure analysis reports, with asset class, site and security tags on each chunk. Serve an open-weight model locally with vLLM or Ollama and register read tools such as search_work_orders, asset_history and parts_on_hand in an MCP server. Mirror Maximo security: security groups, organization and site authorization, and data restrictions are enforced by calling through the Maximo API as the user, not by filtering in the model. Add audit logging, run read-only for the first phase, then draft work orders and service requests in a non-approved status for human review. ## Sections ### Maximo data paths: REST, integration framework and database **Body:** Maximo's business objects (MBOs) sit on a relational database, DB2, Oracle or SQL Server. Core tables include WORKORDER, ASSET, LOCATIONS, PM, INVENTORY, INVBALANCES, MATUSETRANS, PO and DOCLINKS, with failure reporting in tables such as FAILUREREPORT. Reading them directly from a replica is fast, but it bypasses MBO logic and Maximo security. The supported application path is the REST API over object structures, for example MXWO for work orders and MXASSET for assets, using OSLC query parameters. The integration framework also offers publish channels, enterprise services and object structures for outbound and inbound data. Use REST for question answering and for any write. Attachments are linked through DOCLINKS to DOCINFO records, stored as files or URLs. That is where manuals, photos and inspection reports come from, so make DOCLINKS a first-class source for the retrieval index. **Code:** curl -s -H "apikey: $MAXIMO_API_KEY" \ "https://maximo.example.local/maximo/oslc/os/mxwo?lean=1&oslc.pageSize=50\ &oslc.select=wonum,description,status,assetnum,location,siteid,reportdate\ &oslc.where=status=%22WAPPR%22%20and%20siteid=%22BEDFORD%22" -- Read replica, for trend analytics only SELECT assetnum, COUNT(*) AS wo_count FROM workorder WHERE siteid = 'BEDFORD' AND worktype = 'CM' AND reportdate >= DATEADD(year, -2, GETDATE()) -- SQL Server syntax GROUP BY assetnum ORDER BY wo_count DESC; ### Reference architecture, including air-gapped **Body:** Maximo, its database replica, a document index, a tool server, a local model and an audit store. The tool server holds two kinds of access: user-scoped calls to the REST API, and a restricted analytics login to the replica for aggregate queries that return only what the user's site authorization allows. Change data capture or a nightly crawl keeps the index current as new attachments and job plans arrive. Work order long descriptions and failure remarks are worth indexing too, since they hold the tribal knowledge. For an air-gapped plant, run Maximo, the model host and the index in the same enclave, load weights and images by controlled transfer, and block all outbound traffic. Maximo Manage on-prem on OpenShift can share the cluster policy model, but keep GPU nodes in a separate node pool. ### Permissions: security groups, sites and data restrictions **Body:** Maximo security is layered: application and action permissions by security group, organization and site authorization, and data restrictions that add conditions to queries. The robust way to honor all of that is to call the REST API as the user, via their own credentials or a delegated token, so Maximo applies its own rules. If you must use the replica for performance, rebuild the site and group filters in the tool server from the same security tables, then test with restricted users. For documents, copy the owning site and class into the index metadata and filter before retrieval. Never give the model a key that can read all sites unless the use case truly demands it, and log which identity each call used. ### Write-back and approvals **Body:** Safe write-back creates drafts: a service request, a work order in WAPPR or a similar pre-approval status, with a description, asset, location and suggested job plan, after the planner has reviewed and clicked confirm. The POST goes through the REST API on the object structure so MBO validation and workflow still run. Do not let the assistant approve work orders, change inventory balances or close records. If your site needs fault-to-work-order automation, put a threshold and a human reviewer in front of it. ### Sizing, rollout and limits **Body:** A plant with 100 to 500 named users and moderate daily questions usually needs one or two data-center GPUs for a 14B to 70B class model, plus a small embedding model. Manuals and attachments from a mid-size plant are often 50,000 to 500,000 pages. See the calculator for ranges from your own numbers. Phase one, about four to six weeks, is read-only search and history questions. Phase two adds summaries of failure history and drafted work orders. Phase three adds approved actions in a few narrow flows. Honest limits: IBM ships its own AI features for Maximo in newer suites, which may suffice if you are on a supported Application Suite release and accept their data handling. Old customized 7.5 or 7.6 systems usually need the custom path, and poor failure code discipline limits what any assistant can conclude. ## Pitfalls - Querying WORKORDER directly for everything and silently bypassing site authorization and data restrictions. - Using one admin API key for all users, which makes the audit log useless and breaks least privilege. - Indexing DOCLINKS attachments without the owning site and class, leaking manuals across plants. - Letting the assistant approve or close work orders instead of drafting them. - Expecting good failure analysis from sparse or free-text-only failure codes. ## Ai Angle Netray builds Maximo assistants where cloud AI is not allowed: REST-based tools that run as the user, a replica for trend analytics, a document index over DOCLINKS and manuals, and a local open-weight model. ERPray patterns handle the purchasing and inventory side when Maximo sits next to an ERP. ## Faq ### Should we use the REST API or read the database? **Answer:** Use REST for user-facing questions and any write, because Maximo applies its security and business rules. Use a read-only replica for heavy aggregation and multi-year trends, with filters rebuilt from Maximo security. Many designs use both behind one tool server. ### Does this work on Maximo Application Suite? **Answer:** Yes for Manage on-prem or on your own OpenShift, using its REST API and your own database. The mechanism is similar, though URLs, authentication and fix pack details differ, so confirm against your MAS version. ### Can it read PDF manuals attached to assets? **Answer:** Yes. Attachments linked through DOCLINKS are crawled, parsed and indexed locally, with asset class and site tags. Scanned PDFs need OCR first, which also runs locally. Quality depends on scan quality and tables inside the manual. ### Is IBM's own assistant enough? **Answer:** Possibly, if you run a supported suite release and are comfortable with its data flow. If you need fully air-gapped operation, a legacy version, or custom tools across Maximo and other systems, a private layer is the practical route. ## Search terms maximo ai on premise, maximo rest api llm, maximo oslc query, maximo work order ai assistant, maximo mxwo object structure, ibm maximo local llm, maximo manage on-prem ai, maximo doclinks search ai --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json