IFS Cloud OData Projection API: Fixing 401 and 403 Errors
IFS Cloud projection OData API 401 unauthorized invalid_token
Also searched as
- IFS Cloud REST API authentication client credentials
- IFS Cloud OData 403 forbidden projection permission set
- how to call IFS Cloud API with access token
- IFS Cloud IAM service client token endpoint
Short answer
IFS Cloud exposes its data through OData v4 projections under /main/ifsapplications/projection/v1/, secured by OAuth2 tokens from IFS IAM. A 401 almost always means the token is missing, expired or issued by the wrong realm; a 403 means the identity is authenticated but its permission sets do not grant that projection or its entity actions.
Applies to: IFS Cloud 21R1 and later (cloud-hosted and customer-managed), projection-based APIs; earlier IFS Applications 10 REST/OData patterns differ
How to get an authorised call working
- 1Find the projection you need in the API Explorer inside IFS Cloud, and note its name (for example CustomerOrderHandling) and entity set.
- 2In the IFS IAM admin console, create a client for your integration. For server-to-server use, enable the client credentials grant and note the client id and secret.
- 3Request a token with a POST to the realm token endpoint, https://<host>/auth/realms/<namespace>/protocol/openid-connect/token, with grant_type=client_credentials.
- 4Send the token as an Authorization: Bearer header on each call to https://<host>/main/ifsapplications/projection/v1/<Projection>.svc/<EntitySet>.
- 5Map the service client to an IFS user (a technical user) and give that user a permission set that includes a projection grant for the projection.
- 6If a call still returns 403, check entity and action grants as well, not just the projection grant.
- 7For PATCH or DELETE, read the record first and send its @odata.etag value in an If-Match header.
- 8Cache the token until shortly before expiry instead of requesting one per call.
What 401 means versus 403
The two codes point at different layers. A 401 is raised before IFS looks at what you asked for: the bearer token is absent, malformed, expired, signed for another realm, or the audience does not match the environment you are calling. A 403 means the token was accepted and the caller was identified, but IFS authorisation said no.
This split matters because the fix lives in different places. 401 problems are solved in the IAM client and the token request. 403 problems are solved in IFS permission sets, which is where IFS controls what each user can see and do, regardless of how they authenticate.
A common source of confusion is testing with a browser session cookie or a personal token and then moving to a service client. The service client is a different identity, so it needs its own grants even if your own account works.
Requesting a token with client credentials
Each IFS Cloud environment has its own IAM realm, and the token endpoint path contains the realm name. Using the production realm URL against a test environment, or the reverse, is a classic cause of invalid_token. Copy the exact issuer URL from the environment, do not assemble it from memory.
Use the client credentials grant for unattended integrations such as a data pipeline or middleware flow. Use an authorization code flow only when a person must sign in, for example a custom portal. Keep the secret in a vault, not in the script.
curl -s -X POST "https://erp.example.com/auth/realms/prod/protocol/openid-connect/token" \ -d "grant_type=client_credentials" \ -d "client_id=my-integration" \ -d "client_secret=$CLIENT_SECRET"
curl -s "https://erp.example.com/main/ifsapplications/projection/v1/CustomerOrderHandling.svc/CustomerOrderSet?\$top=5&\$select=OrderNo,CustomerNo" \ -H "Authorization: Bearer $TOKEN"
Fixing 403 with permission sets
In IFS Cloud, access is granted through permission sets, and projections are one of the things a permission set can grant. If the technical user behind your client has no grant for the projection, every call returns 403 even though the token is perfect.
Grant the minimum. Read-only integrations should get read access to the projection and the entities they query, not a broad role copied from an administrator. Remember that IFS also enforces row-level and entity-level security on the underlying logical units, so an integration that sees fewer rows than your own account often has a narrower permission set, not a bug.
After changing a permission set, allow for caching. Some grant changes only apply to new sessions, so request a fresh token before retesting.
Writes, ETags and OData query habits
Updates use PATCH on the entity URL with keys in parentheses, and IFS expects optimistic concurrency. Fetch the record, take @odata.etag, and send it back in If-Match. A stale or missing ETag produces a precondition error that people sometimes mistake for an auth failure.
Keep reads efficient: use $select to limit columns, $filter to push predicates to the server, $top and server-driven paging for large sets, and $expand sparingly because each expansion can multiply the work. For bulk extraction, prefer a scheduled export or a data lake feed over paging through a transactional API all day.
Common pitfalls
- !Using a token from one environment (test) against another (production); realms and issuers differ.
- !Testing with your personal login, then deploying a service client that has no permission set.
- !Granting an administrator role to the integration user just to make the 403 go away.
- !Requesting a new token on every call, which adds load on IAM and slows the flow.
- !Forgetting If-Match on PATCH and DELETE, and misreading the resulting error.
- !Pulling large history through $expand-heavy queries on the live system during business hours.
How an ERP-grounded AI assistant handles this
An AI assistant that reads the projection metadata can map a plain-language request to the right projection and entity set, draft the OData query with $select and $filter, and show it for review before anything runs. ERPray works read-only by default, shows the query it generated, and respects the IFS permission sets of the user, so it cannot return rows that user could not already see. For write-back, any change is routed through human approval.
Frequently asked questions
Which grant type should an IFS Cloud integration use?
For unattended server-to-server integrations, use the client credentials grant with a dedicated technical user. Use an interactive authorization code flow only when a person signs in. In both cases the resulting identity still needs permission sets that grant the projections it calls.
Why does my own login work but the service client gets 403?
They are different identities with different permission sets. Your account likely holds roles that include the projection grant, while the technical user behind the service client has none. Grant the specific projection and entity access to that user and request a new token.
Where do I find which projection to call?
Use the API Explorer in IFS Cloud, which lists projections with their entity sets, actions and functions. Pages in the web client are each backed by a projection, so the projection behind a screen you already use is usually the right one for the same data.
Do I need an ETag to update a record?
Generally yes. IFS uses optimistic concurrency, so read the record, take its @odata.etag, and send it in an If-Match header on PATCH or DELETE. Without it, or with a stale value, the update is rejected even when authentication and permissions are correct.
Related
How to Set Up Business Events and Actions in IFS
IFS Business Events fire when a defined condition on a Logical Unit is met, such as a new record, an update, or a specific attribute changing, and Actions subscribe to those events to send email, invoke a workflow, or call an external service. Both are configured in Solution Manager (or the Events and Actions work area in IFS Cloud) without requiring custom PL/SQL for most standard cases.
Error fixIFS Cloud Background Job Stuck in Posted or Executing
A background job that stays Posted is waiting for a batch queue processor that is not picking it up, while one that stays Executing is either genuinely long-running or orphaned after a crash or restart. Check the Background Jobs page for the job state and error text, confirm the batch queue is active with capacity, then requeue or cancel the job.
How-toHow to Add a Custom Field to an IFS Cloud Page
In IFS Cloud you add a custom field by opening the page in configuration mode, choosing to add a field, defining its name, type and placement, and publishing the configuration. The field is stored by the platform as configuration, not as a code change, which is why it normally survives upgrades.
How-toHow to Create a Generic Inquiry in Acumatica
Generic Inquiries (GI) are Acumatica's no-code query builder for joining tables, adding filters, and exposing the result as an inquiry screen, dashboard data source, or API endpoint. Open System > Customization > Generic Inquiry, add your base table, define joins and conditions, then run and save. No SQL or customization project is required.
Error fixFix Odoo AccessError: You Are Not Allowed to Access Records
Odoo raises AccessError when a user's security groups do not grant a CRUD right on a model through ir.model.access.csv, or when an ir.rule record rule filters the specific record out for that user or company. Fix it by adding the user to the group named in the error, editing the model's access rights, or reviewing the record rule's domain under Settings > Technical > Security.
How-toHow to Void a Check in Sage 100
Sage 100 voids checks through Accounts Payable > Main > Check and Payment Voiding. Select the bank code, choose the check number, and Sage reverses the Cash Disbursements Journal entry and reopens the invoice it paid. A check that already cleared in Bank Reconciliation or falls in a closed period needs an extra step before it can be voided cleanly.
AI for ERPAI for IFS Cloud in aerospace and defense manufacturing
Add AI to IFS Cloud for aerospace and defense: projections, Aurena UX, Lobby, and engineer-to-order data, deployed on-prem or in your private cloud.
AI for ERPIFS Field Service Management AI Integration: Private AI on IFS Cloud Service Data
AI for IFS Field Service Management: service requests, work tasks, agreements and technician data via IFS Cloud APIs, joined to parts and finance. On-prem.
Stuck on IFS Cloud?
Talk to engineers who work inside IFS Cloud every week, and who build private AI that answers these questions from your own ERP data.