---
title: Use a remote proxy to access data objects
description: Proxy REST requests to a remote PingIDM or Advanced Identity Cloud instance to access data objects as if they are local resources
component: pingidm
version: 8.1
page_id: pingidm:objects-guide:remote-proxy
canonical_url: https://docs.pingidentity.com/pingidm/8.1/objects-guide/remote-proxy.html
llms_txt: https://docs.pingidentity.com/pingidm/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Data Object Model", "Synchronization"]
page_aliases: ["data-rest-proxy.adoc"]
section_ids:
  remote-proxy-use-cases: Common use cases
  remote-proxy-high-level-setup: High-level setup
  remote-proxy-prereqs: Prerequisites
  remote-proxy-ssl-prereq: SSL/TLS certificates
---

# Use a remote proxy to access data objects

The remote proxy allows you to connect to another PingIDM instance or Advanced Identity Cloud tenant to access data objects as if they are local resources. Through the `/openidm/external/idm/<remote-instance-name>` endpoint, you can:

* Query and manage users on a remote instance

* Create sync mappings between instances

* Run scripts that interact with remote data

* Perform reconciliation to sync data across environments

## Common use cases

* **Environment promotion**: Sync data from sandbox → staging → production.

* **Geographic distribution**: Keep geographically distributed data centers in sync.

* **Migration**: Sync data between self-managed PingIDM instances and Advanced Identity Cloud tenants.

* **Multi-instance management**: Manage multiple PingIDM instances or Advanced Identity Cloud tenants from a single control plane.

|   |                                                                                                                                                                                            |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|   | The proxy doesn't support [liveSync or implicit sync](../synchronization-guide/sync-types.html) from remote resources. You must use reconciliation when pulling data from a remote system. |

## High-level setup

Setting up a remote proxy involves configuring both a local instance (where you configure the proxy) and a remote instance (where the proxy points).

**Local instance:**

1. Create an external proxy configuration pointing to the remote instance.

2. Configure OAuth 2.0 client credentials for authentication.

**Remote instance:**

If the remote instance is fronted by PingAM:

1. Create an OAuth 2.0 client with the `client_credentials` grant type.

2. Configure a static user mapping that grants the OAuth 2.0 client only the roles required for the proxy use case (for example, `internal/role/platform-provisioning`).

3. Ensure the OAuth 2.0 client has the `fr:idm:*` scope.

**Setup overview:**

![Diagram showing the remote proxy setup between a local instance and a remote instance.](_images/remote-proxy-workflow.svg)

## Prerequisites

For the **local** instance, you need:

* Instance hostname

  * For example:

    ```none
    https://<local-instance-fqdn>
    ```

* Credentials for authentication

* OAuth 2.0 client ID from the remote instance (for example, `<clientIDName>`)

* OAuth 2.0 client secret from the remote instance

* Realm name on the remote instance, if the remote instance is fronted by PingAM (for example, `alpha` or `bravo`)

For the **remote** instance, you need:

* Instance hostname

  * For example:

    ```none
    https://<remote-instance-fqdn>
    ```

* Credentials for authentication

* Realm name, if the remote instance is fronted by PingAM (for example, `alpha` or `bravo`)

* OAuth 2.0 client ID (for example, `<clientIDName>`)

* OAuth 2.0 client secret

### SSL/TLS certificates

To connect to a remote instance over SSL or TLS, you must import the remote instance's server certificate into your local instance's truststore. This is only necessary if a CA that isn't already in the truststore signed the certificate. Learn more in [CA-signed certificates](../security-guide/ca-signed-certs.html).