Workiva Support Center

Formerly known as Adaptive Insights, the Workday Adaptive Planning connector uses commands in a chain to import or export data or metadata.

Note: This connector is built by Workiva and connects to a third-party system. While our Support team can help configure this connector within your workspace, we are unable to troubleshoot or otherwise assist with any issues that originate outside of the Workiva platform.

Requirements

To enable the connection, the connector uses the Workday Adaptive Planning REST API. To set up the connector, you'll need:

• An integration user set up in Adaptive Planning who has been assigned a role with appropriate permissions to perform the connector's commands.
• The integration user's username and password.
• If the integration user can access multiple instances of Adaptive Planning, the Instance Code they will connect to.

  Note: To determine the integration user's available instance codes, you can use the Adaptive Planning exportInstances API endpoint.

Set up the Workday Adaptive Planning connector

Note: To make the connector available for use in your organization's chains, an org security administrator first enables it from Configuration.

1. From Chain Builder, click Connections compare_arrows, and then Create at the top right.
2. Under Connector Connection, select Workday Adaptive Planning and the default CloudRunner.
   

Workiva offers two authentication methods (Basic and JWT Bearer Grant (Workday Credentials)). You can select the one you want to use under Credentials in the connection configuration.

Authenticate with Basic authentication

1. Under Properties, optionally enter the instance code for the Adaptive Planning instance.
2. Select ‘Basic Credential’ as the authentication type.
3. Enter the following values:
   Username: The username of the integration user to use with the connector.
   Password: The password for the user provided in the Username field.

Authenticate with a JWT Bearer Grant (Workday Credentials)

This authentication method uses Workday credentials to authenticate with Adaptive Planning, and requires that:

• SSO is enabled.
• The Workday tenant settings for Adaptive Planning User Sign-on and Public APIs enabled are enabled.
• A Public API ISU is mapped between Workday and Adaptive Planning.

For specific details on this setup, refer to the following Workday documentation:

• Set Up SAML SSO into Adaptive Planning for Synced Users
• Troubleshooting: User Sync with Adaptive Planning

As part of this configuration, a x509 private key must be uploaded to the Connection Resources portion of this connection, and a public certificate created by this key must be uploaded to Workday and associated with a ‘JWT Bearer Grant’ type API client. This client in turn must be associated with the ISU you’re using for requests to Adaptive Planning, with mapped credentials between the two systems.

For specific details on this setup, refer to the following Workday documentation: Register API Clients.

Key details

The supported private key format is PKCS#8, and can be either password protected or non-password protected. A new key can be created using openssl with the following command:

openssl req -x509 \
 -newkey rsa:2048 \ 
 -keyout key.pem \ 
 -out cert.pem -days 3650

Determining the Workday host, domain and tenant

Using the Workday REST API Endpoint listed under the API Client, identify the host, domain and tenant, which follows the format of https://{host}.{domain}/ccx/api/v1/{tenant}

Example

https://wd2-impl-services1.workday.com/ccx/api/v1/mycompany

Set up Bearer credentials type in the Adaptive Planning connector

1. Upload your private key to the Resources portion of the connection.
   
2. Select the ‘Bearer’ authentication type.
   
3. Enter the following information:

   Property	Details
   x509 Private Key	Enter the name of the uploaded private key exactly as shown in the connection resources.
   Password	Enter the password for the private key. Leave this field blank if your key is not password protected.
   Client ID	Enter the Client ID of the JWT Bearer Grant API client.
   Integration Service User	Enter the name of the Integration Service User (ISU) associated with the API Client
   Host	Enter the host of the Workday environment to connect to. In the environment's URL, the characters before the Domain property represent the host.
   Tenant	Enter the Workday tenant to connect to.
   Domain	Enter the domain of the Workday environment to connect to, such as workday.com or myworkday.com.

Once you have set up the authentication:

1. Select the environments to use the connection, and click Save.
2. To test the connection, create and run a chain with the connector's Export Versions command, and verify it returns a valid output.

Troubleshooting

If the connection to Workday Adaptive Planning fails:

• Verify the integration user's authentication credentials.
• Ensure the integration user's role has appropriate permissions for the commands the connector performs.
• If the integration user can access multiple instances of Adaptive Planning, check the instance code entered for the connector.

For additional information on making Adaptive Planning API requests using Workday credentials, see this Workday page: Make Adaptive Planning API Requests with Workday Credentials.