> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Oracle Cerner

> Connect Oracle Health (Cerner) Millennium to Oleria to inventory who holds a Millennium sign-in and which positions each user holds.

Connect Oracle Cerner to Oleria to see who can sign in to your Oracle Health Millennium domain and which positions (Millennium's security roles) each user holds. Oleria reads this from Oracle Health's EHR APIs using a system account, and never reads patient or clinical data.

One Oleria connection maps one Millennium domain (tenant).

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from Millennium:

* **Users** - active personnel with a Millennium user name. Personnel without a user name, such as referring physicians listed only for routing, are skipped.
* **Positions** - the Millennium positions (code set 88) your users hold, shown as roles.
* **Position membership** - which positions each user holds.
* **Administrators** - users who hold a position you list as an administrator position in the connection form.

<Note>
  This integration is read-only and covers sign-ins and positions only. Oracle Health's APIs don't expose what each position grants (application groups and privileges), organization security, personnel groups, sign-in history, MFA, or an audit log, so Oleria doesn't show them. Oleria can't change Millennium access.
</Note>

## Prerequisites

* Administrator permission on the Oleria workspace
* Your Millennium domain's **tenant ID** (a GUID), from Cerner Central
* Access to Oracle Health **code Console** to register a System application, and to **Cerner Central** to enable it for your domain
* Optional: the code values of the positions you treat as administrator positions

## Register a system account

Oleria authenticates as a system account: an application of type **System** registered in code Console.

<Steps>
  <Step title="Register a System application">
    In code Console, register a new application of type **System** for Oleria. Grant it these Oracle Health EHR API scopes:

    | Scope | Needed for | Required |
    | :- | :- | :- |
    | `oraclehealth:millennium:personnel` | Users and the positions they hold | Yes |
    | `oraclehealth:millennium:code-system` | The position catalog and checking the administrator positions you enter | Recommended |

    Don't grant patient or FHIR scopes. Oleria never requests them.

    <Note>
      If code Console doesn't offer these scopes for a System application, or Oleria's connection check reports that the scope isn't granted, contact [support@oleria.com](mailto:support@oleria.com). Oracle may need to enable the EHR APIs for your domain.
    </Note>
  </Step>

  <Step title="Enable the application for your domain">
    In Cerner Central, enable the application for your Millennium domain. Oracle describes this in "Making Self-Developed SMART Apps Available in Your Domain".
  </Step>

  <Step title="Copy the credentials">
    Copy the application's **client ID** and **secret**, and your domain's **tenant ID**.
  </Step>
</Steps>

## Connect Oracle Cerner to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **Oracle Cerner**.
  </Step>

  <Step title="Complete the connection form">
    | Field | Notes |
    | :- | :- |
    | Tenant ID | Required. Your Millennium domain's tenant ID (a GUID). You can't change it after the integration is saved. |
    | System account client ID | Required. The client ID of the System application. |
    | System account secret | Required. The application's secret. When you edit the integration later, leave it blank to keep the stored secret. |
    | Administrator position code values | Optional. Comma-separated code values (code set 88) of the positions whose holders Oleria should flag as administrators. Leave it empty to flag no one. |
  </Step>

  <Step title="Authenticate">
    Select **Authenticate** to validate and save the integration. Oleria requests a token, reads the first page of personnel, and checks that user names and positions are visible to the system account before saving.
  </Step>
</Steps>

<Note>
  If the code-system scope isn't granted, Oleria still connects, but it can't show positions nobody holds or check the administrator position code values you enter.
</Note>

## Verify the integration

Confirm the Oracle Cerner instance appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, review the discovered users and positions in your Oleria workspace.

## Known limitations

* **Users who leave disappear rather than showing as disabled.** Oracle Health's APIs list only active personnel, so a deactivated or end-dated user drops out of the next sync.
* **Administrators come only from the positions you list.** Millennium doesn't expose what a position grants, so Oleria can't work out administrators by itself.
* **No activity, MFA, or sign-in history.** These aren't available through Oracle Health's APIs.
* **No remediation actions.** Oracle Health's APIs can't change positions or sign-ins.
* **A few users may show no positions.** If Oracle Health won't return a particular user's record, Oleria still lists the user, without positions, and marks them so you can check them in Millennium. If more than a few records fail, the sync fails instead.
* **Large domains sync slowly.** Oleria reads each user's positions with a separate request and paces its requests, so a domain with many thousands of users can take over an hour to sync.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.