Workiva Support Center

Note: This Workiva-developed connector allows you to connect the Workiva and Workday platforms. Workiva Support is happy to guide you through configuring the connector within your workspace. However, any Workday platform errors or troubleshooting within the Workday platform must be handled by your Workday administrator or their support team.

With the Workday connector, you can use commands in a chain to interact with Workday® HR and Financials to:

• Download custom reports from Workday
• Import budget data into Workday
• Launch a Workday Enterprise Interface Builder (EIB) integration

Requirements

To set up the connection, you'll need:

• The Workday tenant to connect to.
• The host and domain of the Workday environment to connect to.
• The authentication credentials of an integration system user created in Workday.

Step 1: Get the Workday Tenant information

You can determine the tenant, host, and domain information from the Workday public web service WSDL XML file.

1. Enter "Public Web Services" in the Workday search bar and select that report.
2. Find the Web Service for the particular integration you are using.
   Examples include: Staffing for Get Workers, Financial Management for Import Budget, Integrations for EIB-related commands,….
3. Click that service's "Related Actions" button, and then click View WSDL under the "Web Service" menu.
4. In the XML file, locate the soapbind:address element (this is usually near the bottom of the file).
5. Using the URL from the location attribute, extract the tenant, host, and domain information from the URL.
   The URL uses the following format:
   https://{host}.{domain}/ccx/service/{tenant}/public_web_service_name/version_number

Example

Using the format above, we can find the tenant, host, and domain from a sample WSDL URL:
https://wd2-impl-services1.workday.com/ccx/service/mycompany/Financial_Management/v45.1

You will need these values when setting up your connector in the next step.

Step 2: Configure Workday authentication

This connector offers two ways to authenticate: OAuth2 via API, and User+Password. 

OAuth2 API authentication

If you are using OAuth2 API authentication, you must have an API client set up in Workday. Refer to the Workday Support page Register API Clients for instructions on creating an API client. 

As part of this API client configuration, make certain that you have:

• Selected Bearer as the Access Token Type.
• Enabled (marked) the following checkboxes:
  • Non-Expiring Refresh Tokens
  • Include Workday Owned Scope

Redirection URLs

Workiva has region-specific Connection Override URLs for connector configurations.  Use the following table to select the correct URL for your location.
If you are in the North, Central, or South America, use the default URL. If you are in the Asia-Pacific region, use the APAC URL. If you are in EMEA, use the EU URL. 

OAuth2 endpoints

If you are using OAuth2 to verify your connection will you need to have the following endpoint values. These will be listed when you set up the Workday API Client on the Edit API Client page in Workday.

TIP: If you are using an existing API client instance that uses an OAuth2 token and secret, you can see this information at the top of the Workday View API page.

Basic Authentication 

If you are using Basic Authentication, refer to the Workday Support page Create an Integration System User (ISU) account in Workday for instructions on creating an Integration System User (ISU).

Step 3: Set up the Workday connector

Note: To make the connector available for use in your organization's chains, an Organzation Security Administrator must first enable it from Configuration.

1. From Chain Builder, click Connections compare_arrows, and then Create at the top right.
2. Under Connector Connection, select Workday Connector and the default CloudRunner.
   
3. Under Basic Info, enter a unique name and description to help identify the connection.
   

4. Under Properties, enter the connection's details.
   If you are using OAuth2, you will need to enter the values for Workday REST Endpoint, Workday OAuth2 Token Endpoint, and Workday OAuth2 Authorization Endpoint.
    If you are using Basic Authentication (username+password), leave these blank.

   

   Field	Content
   Tenant	The Workday tenant to connect to.
   Host	The host of the Workday environment to connect to. In the environment's URL, the characters before the Domain property represent the host.
   Domain	The domain of the Workday environment to connect to,  such as workday.com or myworkday.com.
   Workday REST endpoint	The Workday-provided REST endpoint URL. (Only if using OAuth2 authentication.)
   Workday OAuth2 token endpoint	The Workday-provided OAuth2 token endpoint URL. (Only if using OAuth2 authentication.)
   Workday OAuth2 authorization endpoint	The Workday-provided OAuth2 endpoint URL.  (Only if using OAuth2 authentication.)

Troubleshooting

If the connection to Workday fails:

• Verify the integration system user's authentication credentials are correct.
• Verify the integration system user has proper permissions to access the functional groups and domains related to the connection's commands.
• Verify the correct Workday tenant, host, and domain are entered for the connector.
• When running the Download custom report command, ensure the report type is set to Advanced. Composite reports are not available via the Workday API at this time.