Workday Sensor

What it ingests

Org chart and role context from Workday HCM via the Workday REST API:

Workday object	Ontology entity	Signal
Supervisory organization	Organization	organization
Worker	Person (identity)	worker

A supervisory organization is a team (the HubSpot company analog). Workers are identity — they resolve to Person via email/name, the same contract as a HubSpot contact or Greenhouse candidate, and MEMBER_OF their supervisory org. Manager is identity only (no Person→Person edge).

This is Workday alone. BambooHR is a different HRIS with a different API and has its own BambooHR sensor.

Read-only and poll-based against https://{host}/ccx/api/v1/{tenant}. SOAP, RaaS, SCIM, and Workday Event Notifications are out of v1.

Credential

References a workday_api_client credential by id. The secret is a JSON blob:

{
  "host": "wd2-impl-services1.workday.com",
  "tenant": "acme",
  "client_id": "<API client id>",
  "client_secret": "<API client secret>",
  "refresh_token": "<non-expiring refresh token>"
}

host is the Workday REST hostname (*.workday.com or *.myworkday.com) — no path. tenant is the tenant name in /ccx/oauth2/{tenant}/token. Auth is the OAuth 2.0 refresh-token grant (API Client for Integrations), not a browser authorization-code flow and not an ISU username/password.

curl -sS -X POST https://your-corveil-host/api/credentials \
  -H "Authorization: Bearer <admin>" -H "Content-Type: application/json" \
  -d '{"type":"workday_api_client","name":"acme-workday","secret":"{\"host\":\"wd2-impl-services1.workday.com\",\"tenant\":\"acme\",\"client_id\":\"…\",\"client_secret\":\"…\",\"refresh_token\":\"…\"}"}'

Config fields

Key	Required	Notes
enabled_objects	no	Comma-separated Workday object kinds. Blank polls every supported kind. Unknown names are rejected at configure time.

Supported object names: organizations, workers. supervisory_organizations and orgs are accepted as aliases for organizations.

There is no default_entity_type. This source emits Organization plus identity, so a single override would silently mistype one of them. Host and tenant live on the credential, not on sensor config.

Provider-side setup

1. In Workday, create an Integration System User (ISU) with read access to worker public data and current staffing information.
2. Search Register API Client for Integrations. Enable Non-Expiring Refresh Tokens. Scope Staffing (and Integration as required).
3. Search Manage Refresh Tokens for Integrations, select the ISU, and generate a refresh token.
4. Copy Client ID, Client Secret, refresh token, tenant name, and REST hostname (from your Workday API docs URL — often wd2-impl-services1.workday.com or impl-services1.wd5.myworkday.com).
5. Activate pending security policy changes.

Wire-up

POST /api/sensors

{
  "sensor_type": "workday",
  "name": "Acme Workday",
  "config": {
    "enabled_objects": "organizations, workers"
  },
  "credentials": { "api_client": "<workday_api_client credential id>" }
}

Verify

Run Test connection. It mints an access token and authenticates against the first enabled object's list endpoint, so a 401/403 fails at save/test rather than on the first poll.

Once polling, each object kind's count appears in the per-poll summary log (organizations_collected, workers_collected). A kind stuck at zero while the other moves is the signal to check that kind's Workday security domain.

How incremental sync works

Workday's REST worker/organization collections paginate with limit / offset and do not expose an updated_after filter comparable to Harvest. Corveil:

• Walks each collection from the persisted offset, up to 10 pages (1,000 records) per object per poll.
• Resets the offset to 0 when a collection drains, so the next poll rescans from the head. sensor_events dedupes on workday:<signal>:<id>.
• Stamps OccurredAt from lastModified when present; otherwise uses ingest time (ingest_fallback).
• Access tokens last about an hour; a 401 re-mints once from the stored refresh token.

Deletes are invisible. A worker vanishing from results is not treated as a deletion.

Not included

• BambooHR. A different HRIS; do not configure this source against BambooHR.
• SOAP / RaaS / SCIM. Different Workday products; their credentials will not mint a REST access token.
• OAuth authorization-code (browser). Only the API Client for Integrations refresh-token grant is supported.
• Positions, jobs, compensation, time off. Deferred. Role context is the worker's businessTitle plus the supervisory org.
• Event Notifications / webhooks. Out of v1; polling is the supported path.