OneStream to Workiva Integration

The OneStream to Workiva integration enables organizations to automate the extraction, transformation, and delivery of data from OneStream Cloud into the Workiva platform. This integration can be implemented using either a direct API-based connection through Workiva Chains and the HTTP Connector, or a file-based SFTP workflow using the OneStream Smart Integration Connector (SIC).

Both integration methods support the ingestion of data into Workiva for downstream connected reporting processes.

API Integration

API Connection Requirements

OneStream Cloud Environment: The API integration approach is supported only when OneStream is hosted within a publicly accessible cloud environment.
OAuth2 Client Credentials (Non-Interactive User): For optimal security and auditing, create a dedicated OneStream user for this integration, utilizing symmetric credentials (client ID and client secret) for authentication.
Minimum Required Permissions: Assign the service account only the permissions required to access the relevant Cube Views and associated data.
Network and Firewall Access: Ensure Workiva’s static IP addresses are allow listed to permit outbound HTTPS (port 443) communication to the OneStream API endpoint.

Note: You can optionally use a Personal Access Token (PAT) instead of OAuth2. This approach requires a standard interactive OneStream user to log into the Identity & Access Management Portal to generate the token. Because the token may not be retrievable after it is generated, you must capture it immediately. To store it securely, create a Workspace Variable (such as onestream_api_pat) within Chain Builder and mark it as Secret to encrypt the value.

Configure the API Integration

The API integration leverages the GetCubeView or GetAdoDataSetForCubeViewCommand endpoints to retrieve Cube View data from OneStream.

Workiva Chains can authenticate against OneStream, execute the API request, transform the returned JSON payload, and load the resulting dataset into Wdata tables for reporting and downstream processing.

Workiva Configuration Steps

Securely Store the OAuth2 Credentials: Create Workspace Variables within Chain Builder for both your Client ID and Client Secret. When creating the variable for the Client Secret (for example, onestream_api_secret), you must mark the variable as Secret. This encrypts the value and prevents unauthorized visibility.
Enable Required Connectors: Verify that the HTTP Connector, JSON Transformation Connector, and Tabular Transformation Connector are enabled and properly configured within the Workiva environment.
Create the Destination Wdata Table: Export a sample Cube View from OneStream as a CSV file and use it as the template for the Wdata table schema. Record the Table ID for use within the Chain configuration.
Transform and Map Data: Convert the JSON response into a tabular format if required, then map OneStream field names to the corresponding Workiva table columns and data types.
Configure Chain Automation: Configure the Chain's trigger mechanism to control when it executes options include running on a defined schedule, on demand (manual execution), as a step within a larger orchestration workflow, or triggered by a control sheet.

Required API Parameters

Parameter	Required	Description
BaseWebServerUrl	Yes	The base URL of the OneStream application server.
ApplicationName	Yes	The name of the OneStream application containing the Cube View.
CubeViewName	Yes	The Cube View used to retrieve the dataset.
CubeName	Yes	The associated Cube name used by the Cube View.

SFTP Integration

In an SFTP-based integration, OneStream exports data files (typically CSV format) to an intermediate SFTP location using Smart Integration Connector. Workiva Chains then retrieves the files using the SFTP connector, processes the data, and loads it into Wdata tables.

This approach is commonly used in organizations where direct API access is unavailable or there is a preference to not create or use CubeViews.

Customer IT / Finance Team Responsibilities	Implementation Partner Responsibilities
Provision and maintain the SFTP environment. Configure the Smart Integration Connector (SIC) to transfer files to the SFTP location. Define the preferred authentication mechanism (username/password or SSH key-based authentication). Provide SFTP server connection details and required credentials. Maintain the operational integration process after go-live.	Configure Data Management Sequences within OneStream to automate report generation and exports. Build and maintain the Workiva Chain used to retrieve, validate, transform, and import data into Wdata. Configure downstream reporting integrations and refresh processes.

Additional Resources