Set up a Workday connector

Which Workday connector should I use?

C1 offers two Workday connectors: Workday and Workday Accounts (WQL). How you want to work with Workday in C1 will determine which one you should set up.

Workday connector: This connector is the best choice if you want to use Workday as a directory. You’ll also need it if you want to enable access requests for Workday role and group assignments.
Workday Account (WQL) connector: This connector utilizes the Workday Query Language (WQL), which allows it to pull a different data set than the Workday connector. Workday Accounts (WQL) is the best choice if you want to review who has what kind of access to Workday in your organization, including account type and service center assignments.

Resource	Workday connector*	Workday Accounts (WQL) connector
Accounts	Sync	Sync
Roles	Sync
Security groups	Sync, Provision**	Sync
Account type (Implementers and Integration Users)		Sync
Service centers		Sync

*If the Workday connector is configured using a custom report (see below), it can also pull in information on the account owner’s organization, title, and manager. **Provisioning applies to user-based security groups, and needs a JSON custom report.

Capabilities

Custom report (JSON)

Resource	Sync	Provision
Accounts
Roles
Security groups
AI agents**

The Workday connector supports provisioning membership in user-based security groups when it’s configured with a JSON custom report. See Security group provisioning for the setup it needs.

API client

Resource	Sync	Provision
Accounts
Roles
Security groups
AI agents

**AI agents sync only when the custom report is configured with an API Client. With Basic Auth, turning on AI agents fails the sync.

AI agents are opt-in. The connector syncs the agents registered in Workday’s Agent System of Record (ASOR), including each agent’s provider, platform, version, and skills. Enable the AI agents resource type in C1 after the API client’s security group has the ASOR domain access described below. If the API client lacks that access, a sync that includes AI agents fails with an error naming the missing scope. Agents are synced as standalone resources and are not yet linked to the Agent System User accounts they run as.

Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. With every authentication method, the Workday connector can write a worker’s work email and work phone back to Workday, so you can keep them in sync from C1 with attribute push rules or the Perform connector action automation step.

Action name	Additional fields	Description
update_profile	`user_id` (resource ID, required), `email` (string, optional), `phone` (string, optional)	Changes the worker’s primary work email and the number of their primary work phone. Set at least one of `email` or `phone`.

Workday applies the change as a completed Work Contact Change event, skipping its review step. To use this action:

The Workday account whose credentials the connector uses (the report owner, or the account the API client’s refresh token belongs to) must be in a security group with:
- Get and Put integration permissions on the Person Data: Work Contact Information domain (Contact Information functional area)
- Permission to initiate Change Work Contact Information (Web Service) in the Work Contact Change business process security policy
If you authenticate with an API client (Options 2 and 3 below), also add the Contact Information scope to the API client.
With a custom report, the report’s user_id column must hold the worker’s Employee ID or Contingent Worker ID.

A phone can be updated, not added. The worker must already have a primary work phone, and the new number keeps that phone’s country and device type. Send the number with or without its country code; a number with a different country code is rejected. Clearing the email or phone isn’t supported.

To keep C1 from re-sending a value Workday already has, sync the same attribute back: include the email column in a custom report, and add a work phone column with the phone XML alias through the report’s additional fields.

Gather Workday credentials

Configuring the connector requires you to pass in credentials generated in Workday. Gather these credentials before you move on.

To authenticate with Workday, you can use a Report-as-a-service (RaaS) custom report in JSON format (with either Basic Auth or API Client), or directly an API Client with OAuth.Which authentication method should I use?The Custom Report with Basic Auth option is the most popular and is often preferred by Workday Admins and HR teams. RaaS allows fine-grained control over what data is sent to C1 and lets you transform attribute formats as needed.The Custom Report with API Client option is a good choice when your security policies require OAuth-based authentication, while still providing the same fine-grained data control as Basic Auth reports. The refresh token for this option must be generated using the credentials of the Workday user who owns the report.The API Client option pulls available data about Workday accounts, such as each account’s manager and manager email, which can be used as user attributes. It does not require a custom report.Follow the relevant set of instructions below to generate your credentials.

Option 1: Authenticate using a custom report with Basic Auth

A user with the permission to create a custom report in Workday must perform this task.

Set up the custom report

In Workday, navigate to the Tasks and Reports menu and select Create Custom Report.

When setting report details, set the report type to Advanced and mark Enable As Web Service.

When setting data sources, disable the Optimized for Performance option and select All Workers as the data source.

At this point, you can create the custom report by following the directions below.

Expected custom report contents

The connector reads the custom report in JSON format and expects a specific structure. Below is a table of the supported fields: Suggested Data Source: All Active and Terminated Workers

Column Heading Override XML Alias/Column Heading Override	Required	Description	Suggested Workday Object Field
user_id	Yes	Unique identifier for the user	Worker: Employee ID
email	No	User’s email address	Worker: Email - Primary Work
first_name	Yes	User’s first name	Worker: First Name
middle_name	No	User’s middle name	Worker: Middle Name
last_name	Yes	User’s last name	Worker: Last Name
active	Yes	Boolean indicating if user is active	Worker: Active Status
org_name	No	User’s department or organization	Worker: Supervisory Organization Name
business_title	No	User’s job title	Worker: Business Title
security_groups	No	User’s security groups	Worker: User-Based Security Groups for User
roles	No	User’s roles	Worker: Organization Roles
manager_name	No	Manager’s name	Calculated Field - Lookup Related Value: Worker: Manager Level 01: Full Name
manager_email	No	Manager’s email	Calculated Field - Lookup Related Value: Worker: Manager Level 01: Email - Primary Work

Notes:

The order of the fields does not matter.
The Column Heading Override XML Alias value MUST match Column Heading Override.
You may substitute the suggested Workday object fields with alternatives as long as they provide equivalent data.
To sync extra worker attributes (such as cost center or location), add them as columns and enter their Column Heading Override XML Alias values in Additional report fields when you configure the connector.

CSV custom reports are deprecated. Connectors already set up with a CSV report URL keep syncing, but new connectors should use a JSON report. To move a connector from CSV to JSON, create a new report with the fields above and switch the connector to its JSON URL in the same change.Don’t edit the existing CSV report in place. Until the URL changes, the connector reads that report as CSV, by column position, so any sync in between gives every account the wrong ID and C1 deletes and recreates all accounts and their grants. Changing only the URL is not enough either: the sync returns no accounts, because a CSV report’s columns don’t match the fields above. After the switch, role IDs change, so C1 recreates the roles and their grants, and security groups start syncing.

Security group provisioning

When the report includes the security_groups column, C1 can add users to and remove them from user-based security groups. Other group types, such as role-based security groups, sync as usual but can’t be provisioned, because Workday derives their membership from role and organization assignments. To provision security groups:

The report’s user_id column must hold the worker’s Employee ID or Contingent Worker ID, so the connector can find the worker’s Workday account.
The Workday account whose credentials the connector uses (the report owner) must be in a security group with these domain permissions, both in the System functional area:
- User-Based Security Group Administration: Get and Put (granting the parent Security Administration domain also covers it)
- Workday Accounts: Get
If you authenticate with a custom report and API client (Option 2 below), also add the System scope to the API client.

Duplicate user_id rows in the JSON report are reduced to a single record: the active record wins, and the record that loses is discarded whole, taking its roles and security groups with it.

Legacy CSV report contents (deprecated)

Connectors still on a CSV report need these fields in this order:

Active Status
User Name
Employee ID
Worker
Security Group
Role Name
Organization
Organization Type

These columns are read by position, so their headers don’t matter. To sync extra worker attributes (such as cost center or location), add them as columns after Organization Type and enter their column headers in Additional report fields when you configure the connector. Workday uses each column’s Column Heading Override XML Alias as its CSV header (for example Cost_Center), so enter that value. Values are read from each worker’s first row, and blank values are left out of the profile. If a header matches a built-in profile key (first_name, last_name or security_group), the built-in value is kept.

The fields needed in custom reports can vary depending on how your Workday installation is configured. Contact C1 support if you need help figuring out which fields to include.

Create the custom report.

Look up the custom report URL

On the Report Definition page, click the Related Actions (three dots) button.

Navigate to Actions > Web Service > View URLs.

Right-click on the JSON URL, then carefully copy and save it. The URL includes format=json.

Done. Next, move on to the connector configuration instructions.

Option 2: Authenticate using a Custom Report with API Client

This option combines a RaaS Custom Report with OAuth authentication. Follow the Set up the custom report steps from Option 1 above to create the report and obtain its URL, then set up an API client as described below.

The refresh token for this option must be generated using the credentials of the Workday user who owns the custom report. Tokens generated for a different user will result in authorization errors when the connector attempts to fetch the report.

Unlike Option 3, this option does not require creating an Integration System User (ISU) or an Integration System Security Group (ISSG). The API client is tied directly to the report owner’s credentials via the refresh token.

Create Workday API Client Credentials for Custom Report

A user with the permission to create a new API client in Workday must perform this task.

Create a New Workday API Client

In Workday, use the search bar to look up “Register API Client for Integrations”. Make sure to select this name from the results, not the similarly named “Register API Client”.

Give the new API client a name, such as “C1 integration (report OAuth)”.

In the Scopes box, select Tenant Non-Configurable. Also search for “Staffing” and select Staffing and Organizations and Roles. (Optional) To provision security groups, also select System. To sync AI agents, also select Agent System of Record, and make sure the report owner has View access to the Setup: Agents domain. Click OK.

The Tenant Non-Configurable scope is required for custom report OAuth authentication. Without it, OAuth token requests will be rejected.

The newly created client’s client ID and client secret are shown. Carefully copy and save these credentials.Do not click Done at the bottom of the page yet.

Create a Refresh Token

Click the three dots icon next to the client name and navigate to API Client > Manage Refresh Tokens for Integrations.

Select the Workday user who owns the custom report (not the ISU) and click OK.

This step is critical. The refresh token must be associated with the user who created and owns the custom report, not the ISU. Using the wrong user will result in authorization errors when fetching the report.

On the Delete or Regenerate Refresh Token page, scroll down and check the Generate New Refresh Token box.

Click OK.

Carefully copy and save the new refresh token.

Done. Next, move on to the connector configuration instructions.

Option 3: Authenticate using API client credentials (OAuth)

Create Workday API Client Credentials

A user with the permission to create a new API client in Workday must perform this task.

The process involves creating an Integration System User (ISU), creating a security group, associating the ISU with the security group, and then registering the API client and generating a refresh token.

Create an Integration System User (ISU)

In Workday, use the search bar to look up “Create Integration System User”.

In the Create Integration System User modal, enter a User Name, such as “C1 integration”.

Enter and confirm a strong Password for this user.Optionally, you can provide a New Password Never Expires if appropriate for your security policies.

Click OK.

Make note of the User Name you created, as you will need it later.

Create a new Security Group

In Workday, use the search bar to look up “Maintain Permissions for Security Group”.

In the Maintain Permissions for Security Group modal, make sure the Maintain button is selected.

In the Source Security Group field, navigate to By Type > Integration System Security Group.

Create a new security group. Give it a name, such as “C1 integration security group”.

On the new group’s Domain Security Policy Permissions tab, leave the Select All box checked.

Click the + icon to create six (or more, see below) new rows, and fill them out as follows:Row 1:

View/Modify Access: View Only
Domain Security Policy: Worker Data: Public Worker Reports

Row 2:

View/Modify Access: View Only
Domain Security Policy: Reports: Organization

Row 3:

View/Modify Access: View Only
Domain Security Policy: Security Administration

Row 4:

View/Modify Access: View Only
Domain Security Policy: Manager: Organization Roles

Row 5:

View/Modify Access: View Only
Domain Security Policy: Person Data: Work Email

Row 6:

View/Modify Access: View Only
Domain Security Policy: Worker Data: Current Staffing Information

Row 7 (needed only if title data is split out from the inherent staffing parent domain):

View/Modify Access: View Only
Domain Security Policy: Worker Data: Staffing Business Title

Row 8 (needed only to sync AI agents):

View/Modify Access: View Only
Domain Security Policy: Setup: Agents

Click OK.

Assign the Security Group to the Integration System User (ISU)

Still in Workday, use the search bar to look up “View Workday Account” and select the Integration System User (ISU) you created previously.

Click the three dots icon next to the account name and navigate to Security Profile > Assign Integration System Security Groups.

Select the security group you created and click OK.

Activate Security Policy Changes

Next, activate the security policy changes. Search for “Activate Pending Security Policy Changes”.

Add a comment about the change you’re making and click OK.

Review the changes and if everything looks good, click the Confirm checkbox, then click OK.

Create a New Workday API Client

In Workday, use the search bar to look up “Register API Client for Integrations”. Make sure to select this name from the results, not the similarly named “Register API Client”.

Give the new API client a name, such as “C1 integration”.

In the Integration System User field, select the ISU you created earlier. This is crucial for associating the API client with the correct permissions.

In the Scopes box, search for “Staffing”. Select Staffing and Organizations and Roles and click OK. To sync AI agents, also select Agent System of Record.

The newly created client’s client ID and client secret are shown. Carefully copy and save these credentials.Do not click Done at the bottom of the page yet.

Create a Refresh Token

Next, click the three dots icon next to the client name and navigate to API Client > Manage Refresh Tokens for Integrations.

Select the Integration System User (ISU) you want to associate with the token (this should be the same ISU you selected when registering the API client) and click OK.

On the Delete or Regenerate Refresh Token page, scroll down and check the Generate New Refresh Token box.

Click OK.

Carefully copy and save the new refresh token.

Done. Next, move on to the connector configuration instructions.

Configure the Workday connector

To complete this task, you’ll need:

The Connector Administrator or Super Administrator role in C1
Access to the set of Workday credentials generated by following the instructions above

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Apps > Connectors and click Add connector.

Search for Workday and click Add.

Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

Find the Settings area of the page and click Edit.

If using a custom report with Basic Auth (Option 1), select Custom Report with Basic Auth and fill out the form:

Enter the Report URL, Report username, and Report user password in the relevant fields.
Optional. To include extra Workday data in the sync, in the Additional report fields field, enter any additional field names from the custom report (their XML aliases) that you want to include in user profiles. Press Enter between each field name. Fields that return multiple values (such as roles or security_groups) are not supported.

If using a custom report with OAuth (Option 2), select Custom Report with API Client and fill out the form:

Enter the Report URL in the relevant field.
Enter the Client ID, Client secret, and Refresh token from the API client you registered for this report. For Tenant Name, enter the tenant segment from your Report URL — it’s the value between /customreport2/ and the next / (for example, in https://wd2-impl-services1.workday.com/ccx/service/customreport2/acme/..., the tenant is acme).
Optional. Enter any additional field names from the custom report (their XML aliases) in the Additional report fields field. Press Enter between each field name. Fields that return multiple values (such as roles or security_groups) are not supported.

If using an API client (Option 3), select API Client and fill out the form:

Enter the Client ID, Client secret, and Refresh token in the relevant fields.
Optional. Enter the full URL of your Workday tenant in the Workday URL field. Defaults to https://wd2-impl-services1.workday.com — only change this if your tenant uses a different URL.
Enter the Workday tenant name in the Tenant Name field.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Workday connector is now pulling access data into C1.

**Follow these instructions to use the Workday connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

Official download center: For stable binaries (Windows/Linux/macOS) and container images.

Step 1: Set up a new Workday connector

In C1, navigate to Apps > Connectors and click Add connector.

Search for Baton and click Add.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Workday connector deployment:

Secrets configuration

# baton-workday-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-workday-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Option 1: Custom report with Basic Auth
  BATON_WORKDAY_FETCH_USERS_FROM_CUSTOM_REPORT: true
  BATON_WORKDAY_REPORT_URL: <Workday custom report URL>
  BATON_WORKDAY_REPORT_USERNAME: <Workday username of the user who created the report>
  BATON_WORKDAY_REPORT_PASSWORD: <Workday password of the user who created the report>
  BATON_WORKDAY_ADDITIONAL_REPORT_FIELDS: <List of additional field names from the Workday custom report (their XML aliases) to include in user profiles>

  # Option 2: Custom report with OAuth (refresh token must belong to the report owner)
  BATON_WORKDAY_FETCH_USERS_FROM_CUSTOM_REPORT: true
  BATON_WORKDAY_REPORT_URL: <Workday custom report URL>
  BATON_WORKDAY_CLIENT_ID: <Workday API client ID>
  BATON_WORKDAY_CLIENT_SECRET: <Workday API client secret>
  BATON_WORKDAY_REFRESH_TOKEN: <Refresh token generated for the report owner>
  BATON_TENANT_NAME: <Workday tenant name>
  BATON_WORKDAY_ADDITIONAL_REPORT_FIELDS: <List of additional field names from the Workday custom report (their XML aliases) to include in user profiles>

  # Option 3: API client with OAuth
  BATON_WORKDAY_CLIENT_ID: <Workday API client ID>
  BATON_WORKDAY_CLIENT_SECRET: <Workday API client secret>
  BATON_WORKDAY_REFRESH_TOKEN: <Workday API client refresh token>
  BATON_WORKDAY_URL: <Workday API URL>
  BATON_TENANT_NAME: <Workday tenant name>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-workday.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-workday
  labels:
    app: baton-workday
spec:
  selector:
    matchLabels:
      app: baton-workday
  template:
    metadata:
      labels:
        app: baton-workday
        baton: true
        baton-app: workday
    spec:
      containers:
      - name: baton-workday
        image: public.ecr.aws/conductorone/baton-workday:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-workday
        envFrom:
        - secretRef:
            name: baton-workday-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Workday connector to. Workday data should be found on the Entitlements and Accounts tabs.

Done. Your Workday connector is now pulling access data into C1.

Troubleshooting the Workday connector

Make sure that the integration security group you created when configuring the connector has the domain security policy applied to Report/Task Permissions only.

In Workday, use the search bar to look up “View Security Group”, then navigate to Security Groups > Integration System Security Group (Unconstrained) and select the security group you just created.

On the security group’s page, click the three dots icon next to the security group name and navigate to Security Group > Manage Domain Permissions for Security Group.

Make sure that Worker Data: Public Worker Reports is shown in the Domain Security Policies permitting View access box.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Custom connectors

Configurable connectors

Pre-built connectors

Set up a Workday connector

Which Workday connector should I use?

Capabilities

Custom report (JSON)

API client

Connector actions

Gather Workday credentials

Option 1: Authenticate using a custom report with Basic Auth

Set up the custom report

Expected custom report contents

Security group provisioning

Legacy CSV report contents (deprecated)

Look up the custom report URL

Option 2: Authenticate using a Custom Report with API Client

Create Workday API Client Credentials for Custom Report

Create a New Workday API Client

Create a Refresh Token

Option 3: Authenticate using API client credentials (OAuth)

Create Workday API Client Credentials

Create an Integration System User (ISU)

Create a new Security Group

Assign the Security Group to the Integration System User (ISU)

Activate Security Policy Changes

Create a New Workday API Client

Create a Refresh Token

Configure the Workday connector

Resources

Step 1: Set up a new Workday connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Troubleshooting the Workday connector

​Which Workday connector should I use?

​Capabilities

​Custom report (JSON)

​API client

​Connector actions

​Gather Workday credentials

​Option 1: Authenticate using a custom report with Basic Auth

​Set up the custom report

​Expected custom report contents

​Security group provisioning

​Legacy CSV report contents (deprecated)

​Look up the custom report URL

​Option 2: Authenticate using a Custom Report with API Client

​Create Workday API Client Credentials for Custom Report

​Create a New Workday API Client

​Create a Refresh Token

​Option 3: Authenticate using API client credentials (OAuth)

​Create Workday API Client Credentials

​Create an Integration System User (ISU)

​Create a new Security Group

​Assign the Security Group to the Integration System User (ISU)

​Activate Security Policy Changes

​Create a New Workday API Client

​Create a Refresh Token

​Configure the Workday connector

​Resources

​Step 1: Set up a new Workday connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

​Troubleshooting the Workday connector

Which Workday connector should I use?

Capabilities

Custom report (JSON)

API client

Connector actions

Gather Workday credentials

Option 1: Authenticate using a custom report with Basic Auth

Set up the custom report

Expected custom report contents

Security group provisioning

Legacy CSV report contents (deprecated)

Look up the custom report URL

Option 2: Authenticate using a Custom Report with API Client

Create Workday API Client Credentials for Custom Report

Create a New Workday API Client

Create a Refresh Token

Option 3: Authenticate using API client credentials (OAuth)

Create Workday API Client Credentials

Create an Integration System User (ISU)

Create a new Security Group

Assign the Security Group to the Integration System User (ISU)

Activate Security Policy Changes

Create a New Workday API Client

Create a Refresh Token

Configure the Workday connector

Resources

Step 1: Set up a new Workday connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Troubleshooting the Workday connector