Workday connector

The Workday connector connects directly to the Workday REST API. It enables AI agents to query workers, organizational structure, time off balances and entries, recruiting pipelines, inbox tasks, and holiday calendars from Workday HCM.

The Workday connector uses Workday's REST API with OAuth 2.0 authentication. It supports two grant types:

• Authorization Code — each user authenticates interactively; actions run as that user. Requires non-expiring refresh tokens.
• Client Credentials — a single service account token; no user interaction required. Suitable for automated or machine-to-machine workflows.

To configure the connector, provide your Workday tenant URL, tenant name, and OAuth credentials.

All actions are read-only. Compensation, payroll, personal contact information, performance ratings, and medical data are not accessible.

You can create a Workday connector in Stack Management > Connectors or when you add a Workday data source.

Tenant URL

The base URL of your Workday tenant, for example https://mycompany.workday.com.

Tenant Name

The tenant identifier used in API paths, for example mycompany. Typically, this matches the subdomain in your Workday URL.

Authentication

OAuth 2.0 — either Authorization Code (per-user) or Client Credentials (machine-to-machine). Both require a Client ID, Client Secret, and Token URL from a registered Workday API client. Authorization Code also requires an Authorization URL. The authorization and token URLs follow the pattern:

• https://<tenant>.workday.com/ccx/oauth2/<tenant>/authorize
• https://<tenant>.workday.com/ccx/oauth2/<tenant>/token

Actions are grouped by Workday functional area. Each group requires the corresponding OAuth scope (Functional Area) to be enabled on your Workday API client.

Use the Action configuration settings to customize connector networking, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use xpack.actions.customHostSettings to set per-host configurations.

To use the Workday connector, register an API client in Workday with the appropriate grant type.

1. Log in to Workday as a system administrator.
2. Search for and open Register API Client for Integrations.
3. Enter a name for the client (for example, Kibana Integration).
4. From the Client Grant Type menu, select Authorization Code Grant.
5. Enable PKCE.
6. Enable Non-Expiring Refresh Tokens.
7. Add the Functional Areas corresponding to the action groups you want to enable (see the Available actions table above).
8. Click OK and copy the Client ID and Client Secret that are displayed. Store the secret securely — Workday displays it only once.
9. Search for and open View API Clients. Find your client and copy the Authorization Endpoint and Token Endpoint URLs.
10. To configure the Kibana connector, enter:
    • Tenant URL: your Workday base URL (for example, https://mycompany.workday.com)
    • Tenant Name: your tenant identifier (for example, mycompany)
    • Client ID and Client Secret from step 7
    • Authorization URL and Token URL from step 8

1. Log in to Workday as a system administrator.
2. Search for and open Register API Client for Integrations.
3. Enter a name for the client (for example, Kibana M2M Integration).
4. From the Client Grant Type menu, select Client Credentials Grant.
5. Add the Functional Areas corresponding to the action groups you want to enable (see the Available actions table above).
6. Click OK and copy the Client ID and Client Secret. Store the secret securely.
7. Search for and open View API Clients. Find your client and copy the Token Endpoint URL.
8. To configure the Kibana connector, enter:
   • Tenant URL: your Workday base URL (for example, https://mycompany.workday.com)
   • Tenant Name: your tenant identifier (for example, mycompany)
   • Client ID and Client Secret from step 6
   • Token URL from step 7