---
title: Connect + JD Edwards (Oct 2026): Build the AIS Orchestration Step by Step
description: On October 28, 2026, Oracle documents Tools 9.2.4 as the minimum for Orchestrator Studio, and an orchestration that aborts returns HTTP 500 while one that continues returns 200. Here is the lookup orchestration a Connect Lambda can call inside 8 seconds.
url: https://www.factualminds.com/blog/amazon-connect-jd-edwards-integration-2026/
datePublished: 2026-10-28T00:00:00.000Z
dateModified: 2026-10-28T00:00:00.000Z
author: palaniappan-p
category: Cloud Architecture
tags: amazon-connect, contact-center, aws, jd-edwards, erp, aws-lambda
---

# Connect + JD Edwards (Oct 2026): Build the AIS Orchestration Step by Step

> On October 28, 2026, Oracle documents Tools 9.2.4 as the minimum for Orchestrator Studio, and an orchestration that aborts returns HTTP 500 while one that continues returns 200. Here is the lookup orchestration a Connect Lambda can call inside 8 seconds.

On October 28, 2026, Oracle's Orchestrator Guide sets the floor for building a JD Edwards lookup in Orchestrator Studio: EnterpriseOne Tools 9.2.4, with Studio 9.2.4 deployed on AIS Server 9.2.4.0. A Connect flow then gives your Lambda 8 seconds to call that orchestration and return four strings. The steps below build the orchestration, call it from the Lambda, and test the whole path.

It goes deeper on one system than the parent guide. For the comparison across NetSuite, Odoo and JD Edwards, the shared 8-second budget and the flat `STRING_MAP` contract, read [Amazon Connect ERP integration: NetSuite, Odoo and JD Edwards](https://www.factualminds.com/blog/amazon-connect-erp-integration-netsuite-odoo-jd-edwards-2026/). In short: Connect waits at most 8 seconds on a synchronous Lambda, the response must be a flat map of strings, and the handler never throws, it returns a `FALLBACK` map so the flow can branch.

This is a design, an illustrative contract and mocked tests. We have not run it against a live AIS Server, and FactualMinds has no published Connect plus JD Edwards engagement. Broader Connect work is on [Amazon Connect consulting](https://www.factualminds.com/services/amazon-connect/).

---

## What AIS and Orchestrator are doing for you

The AIS Server is JD Edwards' REST front door. It authenticates the caller against EnterpriseOne, opens a session with the EnterpriseOne HTML Server, and runs the service. Orchestrator Studio is a web application shipped on the same AIS Server: you assemble service requests into an orchestration, save it, and the AIS Server exposes it as a REST endpoint named after the orchestration.

The Lambda should not know what an Address Book form looks like. It posts a phone number to one named endpoint and reads four fields. Everything JD Edwards-specific stays inside the orchestration, which your JD Edwards team can version, secure and test.

| Piece | Label |
| --- | --- |
| Invoke AWS Lambda block, contact attributes | **Native** (Connect) |
| AIS Server, Orchestrator Studio, orchestrations | **Native** (JD Edwards, Oracle-supported) |
| The customer-lookup orchestration itself | **Custom engineering** (yours) |
| The Lambda adapter | **Custom engineering** ([artifact](https://www.factualminds.com/examples/architecture-blog-2026/connect-commerce-context/erp/README.md)) |

## Version requirements, as documented

Verified against Oracle's 9.2 documentation:

- Orchestrator Studio 9.2.4 requires a minimum of Tools 9.2.4. Oracle says to deploy AIS Server 9.2.4.0 (Studio ships on it) and to apply the latest Tools update.
- Studio 8.0 can log in to AIS 9.2.4.0 but creates only version 2 orchestrations, and Oracle describes it as intended for maintenance and migration. Studio 7.3 and earlier cannot log in at all.
- Everything saved by Studio 9.2.4 is a version 3 orchestration. Version 3 outputs can be typed; version 1 and 2 outputs must be strings. Oracle also says the output format changed, particularly for arrays, and tells you to review existing integrations before upgrading.
- Oracle recommends two AIS instances, one for testing orchestrations and one for production, and an additional HTML Server instance for AIS requests so web-client users are not affected.

Later features carry later minimums: custom response messages need 9.2.5.4, stateless load balancing 9.2.5.2. A lookup needs neither, which is a reason to keep it small. We did not find a separate minimum for calling a version 3 endpoint beyond a Tools release that has Studio 9.2.4; confirm on your AIS Server.

## Design the lookup orchestration

Keep the first version to what a caller needs: is the account usable, what is owed, where is the last order.

1. Inputs. Define one input, `phone`. Oracle's guide supports two request formats: a standard format with an `inputs` array of `name` and `value` pairs, and a generic format that is plain JSON. The adapter sends the generic one:

```json
{ "phone": "+14155550123" }
```

Copy the exact JSON from the Inputs section of Studio's Run Orchestrations page, as Oracle's cURL guidance says.

2. Find the customer. Use a form request or a data request. A form request drives an EnterpriseOne application the way a user would: you pick the application, form, version and form mode, and you can build it with the Process Recorder instead of by hand. For Address Book the application is P01012 (the AIS reference uses the form `P01012_W01012B`). A data request instead reads from a table or business view directly, with a page size that defaults to 1,000.

We prefer a data request against a business view for a read-only lookup: no form interaction, and only the columns you choose. The trade-off is that it bypasses application logic, so confirm in a test environment that it returns the customer a user sees in Work With Addresses. We name no tables, because we did not verify them; pick them in Studio with your functional team.

3. Phone matching. Phone numbers in an ERP are typically entered as free text, and we did not verify how your Address Book stores them. A caller ID of `+14155550123` will not match `415-555-0123` by equality. Normalise on the JD Edwards side, or match on a field you maintain, and decide before building what the orchestration does with zero or several matches.

4. Receivables and sales orders. Add a second request for open receivables and a third for the latest sales order. We did not verify application IDs for those two areas; find them in Studio's pickers, and apply to this user the security you apply to those programs.

5. Map outputs. In the End node's **Outputs and Assertions**, choose the return fields and rename them in the Output column. Name them exactly as the adapter expects:

| Output | Meaning | If nothing matches |
| --- | --- | --- |
| `accountStatus` | `ACTIVE`, `INACTIVE`, `NOT_FOUND` | `NOT_FOUND` |
| `openInvoiceCount` | count | `0` |
| `lastOrderStatus` | order status text | `NONE` |
| `lastOrderRef` | order reference | `NONE` |

Use no spaces: Oracle's OpenAPI example shows output names like "Previous Order". Use a rule step (a set of conditions that routes to a true or false path) to set `NOT_FOUND` explicitly. An empty `accountStatus` is not an error to the adapter: it maps to `UNKNOWN` with `lookupStatus` OK, which is the silent failure you do not want.

6. Error handling per step. In each step's Error Handling dialog, choose **Abort** for the customer lookup. Oracle documents that the system generates an exception either way, but that Abort ends the orchestration with a 500, while **Continue** keeps going and records the error in a "Continued on Error" array in the response. For a lookup, Continue means a 200 response that looks like success. Use Continue only on the optional steps (the sales order), and give those outputs a default.

The illustrative contract, with a request and response pair labelled as not captured from a live system, is in [`jde-orchestration/`](https://www.factualminds.com/examples/architecture-blog-2026/connect-commerce-context/jde-orchestration/README.md).

## Calling the orchestration over REST

Oracle's REST reference lists execute (GET and POST) at three paths:

| Path | Notes |
| --- | --- |
| `/jderest/orchestrator/{orchestration}` | Unversioned. The Orchestrator Guide's cURL example posts here. |
| `/jderest/v2/orchestrator/{orchestration}` | Version 2 |
| `/jderest/v3/orchestrator/{orchestration}` | Version 3, for orchestrations from Studio 9.2.4 |

The artifact's adapter posts to the unversioned path with a Basic header, the form the Orchestrator Guide shows. We have not observed which path your release prefers, so test all three with `curl` (test plan, step 3) and keep the one that returns the shape you expect.

The call takes JSON in and out, a token in `jde-AIS-Auth`, and an optional `jde-AIS-Auth-Device`. Oracle lists these statuses:

| Status | Oracle's description |
| --- | --- |
| 200 | Successful execution |
| 400 | Bad request, invalid JSON input |
| 403 | Authorization failure |
| 406 | Invalid Accept header (v3 page) |
| 415 | Invalid Content-Type header |
| 444 | Invalid token |
| 500 | Server failed to process request |

The 444 and 500 bodies are an error object with `message`, `exception`, `status` (`ERROR` or `WARNING`), `timeStamp`, an optional `userDefinedErrorText` (the text you typed in the step's Error Handling), and an `exceptionId` that exists only if an exception record was written to table F980060. That `exceptionId` is the thread to pull when JD Edwards operations asks what happened.

## Authentication: Basic per call or a token

Oracle documents several login types. Two matter here.

Basic on each call. Oracle says HTTP Basic is the login type for IoT devices calling orchestrations, and that support is enabled out of the box. Requests that carry credentials are stateless: each gets a temporary session that is removed when the request completes. One documented trap: if the AIS Server runs on WebLogic and its user registry does not mirror EnterpriseOne's, WebLogic can intercept the Basic credentials. Oracle's fix is to set `enforce-valid-basic-auth-credentials` to `false` in the domain's `config.xml` and restart. 

Oracle's v3 execute pages describe token headers and, for GET, `$username` and `$password` query parameters, but do not mention Basic; the AIS guide and the cURL example do. Query-string credentials land in access logs, so we would not use them.

Token. Request one with Basic or a JWT, then pass it as `jde-AIS-Auth`. Documented endpoints: `POST /jderest/tokenrequest` (version 1), `POST /jderest/v2/tokenrequest`, and `GET` or `POST /jderest/v3/orchestrator/jde-login`. Headers `jde-AIS-Auth-Environment`, `-Role` and `-Device` select the environment, role and device. The response includes `userInfo.token` and an `aisSessionCookie`. Logout is `POST /jderest/tokenrequest/logout` (200 on success, 500 on failure) or `GET /jderest/v3/orchestrator/jde-logout` with the token header. Oracle's own page is inconsistent about the device header name on logout (`jde-AIS-Auth-Device` in the table, `jde-AIS-Device` in the example), so check it.

Three documented facts decide whether tokens suit a Lambda.

1. A token is bound to a device name; if you do not send one, the requesting IP address is used, and a token from one IP cannot be used from another. Validation runs on every use. Lambda containers can leave through different addresses. If you use tokens, send a constant device name, and send it on every call, since a token requested with a device name must be used with it.
2. Sessions live by the timeout and time-to-live settings in Server Manager (`rest.ini`). Oracle does not give defaults in prose. A sample configuration response shows `sessionTimeout` 20 and `timeToLive` 720 with no units.
3. Without stateless load balancing (Tools 9.2.5.2), a session works only on the AIS Server that created it, and the load balancer must provide session affinity. Behind a load balancer, a cached token will intermittently return 444.

Our recommendation: Basic per call for the pilot, tokens only if measured sign-on time eats your budget. Per-call Basic costs a sign-on on every contact (unmeasured) but has no state to lose. A token adds device binding, expiry and node affinity, and the shipped adapter does not implement it. If you add one, handle 444 by logging in once and retrying only if budget remains.

## Private connectivity and the latency budget

AIS Servers are commonly inside a private network. We found no Oracle statement either way, so check your estate. If yours is private, the Lambda runs in a VPC with a route to it over Site-to-Site VPN or Direct Connect. Design points:

- Name resolution. The Lambda must resolve the AIS host name through a private DNS path your network team owns, or use an address.
- TLS trust. A private CA certificate must be trusted by the Node 24 runtime. Do not disable certificate checks.
- Secrets path. A Lambda in a VPC also needs a route to Secrets Manager (interface endpoint or NAT).
- Abort first. The handler aborts the ERP call at 5 seconds by default (`ERP_BUDGET_MS`, clamped at 6), so Connect's 8-second ceiling never decides.

A starting allocation for the 5 seconds, which we propose and have not measured:

| Stage | Budget |
| --- | --- |
| Lambda to AIS connect and TLS over VPN | 0.5 s |
| AIS sign-on (stateless) and orchestration start | 1.0 s |
| Customer, receivables and order steps | 3.0 s |
| Response and mapping | 0.5 s |

Replace these with your own p95 from the Lambda subnet. If the steps alone exceed 3 seconds, do not tune the Lambda; move this ERP to the cached pattern in the parent post.

## Capacity and session limits

We found no documented maximum number of AIS sessions or concurrent orchestration calls. Oracle documents what governs them, not the number: timeout and time-to-live in Server Manager, and a separate HTML Server instance for AIS traffic. The number that matters is yours: at 20 simultaneous callers, a promotion means 20 concurrent orchestration runs. Cap the Lambda's reserved concurrency at a figure your JD Edwards team agrees to, and load-test with it.

## Security and licensing

- A dedicated JD Edwards user for the integration, with a role that can run only the lookup's applications and read only what the four outputs need. No write access.
- Orchestrations are UDOs. Oracle says they are saved and managed as User Defined Objects with life-cycle statuses (Personal, Pending Approval, Rework, Reserved, Shared), and what a user can do depends on UDO security. A Personal orchestration is the creator's. We did not verify which status the integration user needs to execute it, so test with that user, not with yours.
- Studio access is separate. Studio is secured through the proxy application P98I0000. We expect the integration user does not need it; confirm.
- Credentials live in Secrets Manager, read at cold start. Oracle's login response has a `passwordAboutToExpire` field, so plan rotation.
- Licensing. We have no verified Oracle statement on what an external caller of AIS or Orchestrator requires. Ask your Oracle account team in writing.

## Step-by-step test plan

1. AIS reachable. In Server Manager, use Test Configuration on the AIS Server; it calls the `defaultconfig` service. Then `curl https://<ais>/jderest/defaultconfig`.
2. Orchestration works in Studio. Open Run Orchestrations, enter a known customer's phone and confirm the green check and the four outputs. Do this in the test environment.
3. REST works with the integration user. From a laptop first:

   ```bash
   curl -sS -w '\n%{http_code} %{time_total}s\n' -X POST \
     -u "$JDE_USER:$JDE_PASSWORD" \
     -H 'Content-Type: application/json' -H 'Accept: application/json' \
     -d '{"phone":"+14155550123"}' \
     "https://$AIS_HOST/jderest/orchestrator/CustomerLookup"
   ```

   Repeat against `/jderest/v2/orchestrator/` and `/jderest/v3/orchestrator/`. `CustomerLookup` and the host are placeholders for yours.
4. Compare with the contract. Fetch `/jderest/v3/open-api-catalog3/CustomerLookup` and confirm the output property names are the four flat names.
5. Same call from the Lambda subnet. Time it from there. Anything over your 3-second step budget stops the project here.
6. Negative cases. Unknown phone (`NOT_FOUND`), a shared phone (the orchestration aborts, expect `HTTP_500`), a wrong password, a stopped AIS Server (`TIMEOUT`).
7. Run the artifact test: `cd examples/architecture-blog-2026/connect-commerce-context/jde-orchestration && node --test`. Expected: five passing tests.
8. Connect flow. Synchronous block, `STRING_MAP`, timeout 6 to 7 seconds, then a **Check contact attributes** branch on `lookupStatus` before any data branch.

> **Reproduce this** — The contract, the illustrative request and response, and the test are in [`/examples/architecture-blog-2026/connect-commerce-context/jde-orchestration/`](https://www.factualminds.com/examples/architecture-blog-2026/connect-commerce-context/jde-orchestration/README.md). The test runs the existing [`erp/handler.mjs`](https://www.factualminds.com/examples/architecture-blog-2026/connect-commerce-context/erp/handler.mjs) with a mocked `fetch`. It checks the request body and path, that the example response maps to `OK`, that a 200 error body and a "Continued on Error" body both become `BAD_RESPONSE`, that an empty `accountStatus` becomes `UNKNOWN`, and that 444 and 500 become `HTTP_444` and `HTTP_500`. No AIS Server was called.

## Troubleshooting

| Symptom | Likely cause | Check |
| --- | --- | --- |
| `HTTP_444` | Token invalid, expired, bound to another device or IP, or issued by another AIS node | Device name consistency, `rest.ini` timeouts, load balancer affinity |
| `HTTP_403` | Authorization failure | Integration user's role and UDO access to the orchestration |
| `HTTP_415` / `HTTP_406` | Missing or wrong `Content-Type` or `Accept` | Send `application/json` for both |
| `HTTP_400` | Invalid JSON, or input names not matching the orchestration | Copy the request from Run Orchestrations |
| `HTTP_500` | A step set to Abort failed | `exceptionId`, F980060, Orchestrator Monitor, the step's error text |
| `BAD_RESPONSE` | 200 without `accountStatus`: Continue on error, or output not mapped | Response for a "Continued on Error" array; the End node outputs |
| `accountStatus` is `UNKNOWN` with `OK` | Empty output | Set `NOT_FOUND` explicitly with a rule |
| Login returns 405 (token route) | HTML Server Allowed Hosts does not accept this AIS Server | Server Manager, Web Runtime, Allowed Hosts |
| Basic credentials rejected before JD Edwards | WebLogic intercepting Basic auth | `enforce-valid-basic-auth-credentials` in `config.xml` |
| `TIMEOUT` | VPN, DNS, TLS, sign-on or slow steps | Step 5 timings from the Lambda subnet |
| `NOT_CONFIGURED` | A required setting is empty | `JDE_AIS_URL`, `JDE_ORCHESTRATION`, `JDE_USER`, `JDE_PASSWORD` |

> **What could break (modeled, not an incident)** — A lookup orchestration is edited to set the receivables step to Continue on error, and a permissions change later makes that step fail. Every call returns 200 with a valid `accountStatus` and an `openInvoiceCount` of 0, so the IVR tells owing customers they owe nothing. The adapter checks only `accountStatus`. Abort on receivables errors, or output `UNKNOWN` when that step fails and alarm on it.

## Costs (published prices only)

On October 28, 2026, the Lambda page lists $0.20 per million requests and $0.0000166667 per GB-second (x86, US East N. Virginia), with a free tier of 1 million requests and 400,000 GB-seconds a month. Arithmetic, not a measurement: 100,000 lookups a month at 512 MB and 1.5 seconds is 75,000 GB-seconds, inside the free tier. The Site-to-Site VPN page lists $0.05 per connection-hour for US East (Ohio), about $36.50 for a 730-hour month, plus data transfer out charges. Direct Connect has its own pricing. We list no price for Oracle licensing, because none is published to us.

## What to do this week

1. Ask Oracle, in writing, about licensing for an external caller of AIS and Orchestrator.
2. Confirm your Tools release is 9.2.4 or later and which AIS instance is for testing.
3. Create a read-only integration user and role.
4. Build the orchestration with the four named outputs and Abort on the lookup step.
5. Run the test plan through step 5 and record p95 from the Lambda subnet.
6. Add the `FALLBACK` alarm by reason before routing live traffic.

## What this post doesn't cover

- A live run against a JD Edwards system. The tests are mocked and the example request and response are illustrative.
- Application IDs and tables for receivables and sales orders, and the exact version 3 response envelope. Verify both on your system.
- A token-based adapter, JWT or OAuth, and stateless load balancing setup.
- A documented AIS session limit, JD Edwards licensing, and a minimum Tools release for the version 3 execute path specifically.
- Writes back to JD Edwards, and compliance. Running on AWS does not make invoice handling compliant.
- NetSuite and Odoo are in the [parent guide](https://www.factualminds.com/blog/amazon-connect-erp-integration-netsuite-odoo-jd-edwards-2026/), and the agent-screen side is in [custom agent UI and Customer Profiles](https://www.factualminds.com/blog/amazon-connect-custom-agent-ui-customer-profiles-2026/).

## FAQ

### What is the minimum JD Edwards Tools release for an Orchestrator-based Amazon Connect lookup?
Oracle's Orchestrator Guide says Orchestrator Studio 9.2.4 needs a minimum of EnterpriseOne Tools 9.2.4 and is deployed with AIS Server 9.2.4.0. Studio 8.0 can still log in to that AIS Server but creates only version 2 orchestrations. Oracle recommends applying the latest Tools update. Features such as the Pause step need later releases (9.2.8.3).

### Which REST path do I call, /jderest/orchestrator, /v2/ or /v3/?
Oracle's REST reference lists the execute operation, GET and POST, at /jderest/orchestrator/{orchestration}, /jderest/v2/orchestrator/{orchestration} and /jderest/v3/orchestrator/{orchestration}. Orchestrations created in Studio 9.2.4 are version 3 orchestrations. The Orchestrator Guide's cURL example still posts to the unversioned path. Call the one you test successfully, and compare the response with the v3 OpenAPI catalog entry.

### Should the Lambda use Basic authentication on every call or request an AIS token?
Basic on every call is stateless: the AIS Server gives each request a temporary session and removes it afterwards. A token saves repeated sign-on but is bound to a device name or source IP, expires by Server Manager settings, and, without stateless load balancing (Tools 9.2.5.2), works only on the AIS node that issued it. Start with Basic for a pilot and measure the sign-on cost from the Lambda subnet.

### Does an orchestration error come back as an HTTP error?
It depends on the step setting. If a step is set to Abort, the orchestration ends in an exception and the REST call returns 500 with an error body. If it is set to Continue, the call can return 200 and records the error in a Continued on Error array. The adapter therefore treats a 200 without accountStatus as BAD_RESPONSE, and the orchestration should always output accountStatus.

### Is there a documented limit on AIS sessions or concurrent orchestration calls?
Not in the Oracle pages we read on October 28, 2026. They state that sessions follow the timeout and time-to-live settings in Server Manager (rest.ini) and that sessions can be viewed there, but they give no maximum session count. A sample AIS configuration response shows sessionTimeout 20 and timeToLive 720 with no units. Load-test your own AIS instance.

### Do we need extra Oracle licensing to call AIS from Amazon Connect?
We could not verify an Oracle licensing statement for an external system calling AIS or Orchestrator, so we make none. Ask your Oracle account team in writing before the project starts.

### Does this post prove the lookup works on our JD Edwards system?
No. The artifact test mocks fetch and checks the adapter against an illustrative request and response. We have not run it against a live AIS Server, and FactualMinds has no published Connect plus JD Edwards engagement.

---

*Source: https://www.factualminds.com/blog/amazon-connect-jd-edwards-integration-2026/*