Overview

Workday is an enterprise platform for managing human capital, finance, and business operations across your organization. Persona’s Workday integration enables organizations to securely retrieve and sync worker information from Workday Human Capital Management (HCM) into Persona. Use Workday as your system of record to prefill identity data, automate verification for employees and contractors, and keep investigations and access decisions moving without manual copy-paste.

Benefits

Automated Enrichment: Pull trusted worker details (e.g., name, email, birthdate) from Workday to automatically populate Persona workflows and cases.

Real-Time Context: Surface Workday attributes directly in Persona so reviewers and operations teams have the full picture when making decisions.

Reduced Manual Work: Eliminate repetitive lookups and data entry across HRIS and risk tools, shortening investigation and onboarding time.

Improved Consistency: Use Workday as your single source of truth to standardize identity data across systems and teams.

Integration Features

Persona’s Workday integration supports secure retrieval and mapping of worker data into Persona so teams can automate onboarding, re-verification, and access reviews.

Setting up the Workday HCM RaaS integration

Persona integrates with Workday’s Reports as a Service (RaaS) to allow for sharing specific data with Persona. RaaS reports are custom reports in Workday exposed a web service that Persona can access via the API.

Prerequisites

To integrate via Workday RaaS, ensure you have:

• Ability to create custom reports in Workday and expose those reports as a web service
• An Integration System User (ISU) with appropriate data access permissions. You’ll need the user name and password for the ISU.
• RaaS Server URL. You can retrieve this from Workday once the RaaS report is configured.

Configuring the RaaS Report

1. In your Workday Dashboard access the ‘Create Custom Report’ module.

2. Give your report a name, a type of Advanced, and mark the "Enable as Web Service" option.

3. Select your data source.

4. Add the following columns to your report and link them to the appropriate data elements within your Workday tenant. Create column heading overrides to follow this specific naming convention - note that the column names must match exactly in order for the integration to work:

   • employee_id (required) - the Workday ID (WID) of the employee that Persona will use for lookup
   • legal_name_first - legal first name
   • legal_name_last - legal last name
   • birthdate - date of birth in ISO 8601 format (YYYY-MM-DD)
   • email_address - employee email address
   • photo - base 64 encoded profile photo

   Although employee_id is the only required column, Persona recommends configuring legal first name, legal last name, and birthdate at a minimum for verification purposes.

5. Configure filtering for the report on employee_id. You may also need to specify employee_id as a Prompt field for the report.

6. Add an Integration System User (ISU) as an ‘Authorized User’ of the custom report.

Connecting to the Persona dashboard

1. In the Persona Dashboard, go to Integrations > Marketplace and select Workday.
2. Click Add Credential at the top of the page.
3. Toggle the Server selection to Workday Reports as a Service (RaaS) Server.
4. Populate your RaaS Server URL, provide a nickname for your credential, and enter the username and password of the ISU authorized for your custom report. If you are unsure of your RaaS Server URL, when viewing your custom report in Workday, select Actions > Web Service > View URLs. Then copy the JSON URL. It will follow the general format of: {raas_server_url}/customreport2/{tenant}/{report_owner}/{report_name}
5. After you have connected your credential, click the ‘Test’ button.
6. Select the Execute Workday custom report (RaaS) endpoint. You’ll need the following information about the report in order to test it (see step 4 for instructions on retrieving this information):
   • Tenant
   • Report Owner
   • Report Name
   • Format - keep the default selection of JSON here
   • An Employee ID for filtering
7. Upon successful testing, your integration is ready for use.

Using the Workday RaaS integration in a workflow

1. Create a new workflow, or open an existing workflow you’d like to update.
2. Add a new Action step > Integrations.
3. Select the Workday integration and choose your Workday credentials.
4. Choose the Execute Workday custom report (RaaS) action, then configure the input fields and field mappings.
5. Save and publish the workflow. Run a test to confirm data is retrieved and mapped as expected.

Setting up the Workday HCM Workers integration

Prerequisites

To set up the Workers integration, ensure you have:

• Admin access to your Workday account
• Workday OAuth 2.0 credentials for secure authentication (Client ID and Secret)
• Server URL, Authorization URL, and Token URL from the Workday API client configuration page
• (Optional) an Integration System User (ISU) with necessary API permissions. See the FAQ section for more information on what ISUs are and how to set them up.

Setting up the Workday Credentials

1. In your Workday dashboard, search “Register API Client” to create a new client, or “Edit API Client” to modify an existing one.
2. Click “Register an API Client”. Input the Client Name of your choosing.
3. For the Client Grant Type, select Authorization Code Grant.
4. (Optional) Select the Integration System User (ISU) you’d like to associate with this credential. See the FAQ section for how to set up an ISU.
5. For the redirection URL, input https://app.withpersona.com/integrations/oauth-callback.
6. For the Scope (Functional Areas), select Staffing and Integration.
7. Click OK to register the API client.

Connecting to the Persona Dashboard

1. In the Persona Dashboard, go to Integrations > Marketplace and select Workday.
2. Click Add Credential at the top of the page.
3. Enter the Server URL, which is listed as the “Workday REST API Endpoint” at bottom of the Workday API client configuration page.
4. Enter the Authorization URL, which is listed as “Authorization Endpoint” in Workday.
5. Enter the Token URL, which is listed as “Token Endpoint” in Workday.
6. Enter a nickname for the credential, as well as your client ID and secret.
7. Click continue, and sign in to your Workday tenant with an account that has the required permissions and approve the requested access.
   • If you do not associate your Workday API client with an ISU, you will need to sign in to a Workday account that either created or has access to the API client when setting up your connection between Persona and Workday. If you do associate your Workday API client with an ISU, then you should log in with the ISU’s username and password when setting up the connection.
8. Save your credential. You can remove the credential at any time.

Using the Workers integration in a workflow

1. Create a new workflow, or open an existing workflow you’d like to update.
2. Add a new Action step > Integrations.
3. Select the Workday integration and choose your Workday credentials.
4. Choose the Retrieve a specific worker action, then configure the input fields and field mappings.
5. Save and publish the workflow. Run a test to confirm data is retrieved and mapped as expected.

Workday Operations Overview

Persona can retrieve worker records and associated profile details using Workday’s API. See below for the available Workflow Action steps and possible configurations for the Workday integration:

Execute Workday custom report (RaaS)

Fetch data exposed in a custom report about a worker from Workday and bring key attributes into Persona. This is commonly used to prefill verification flows, enrich a Case or Account, or validate data consistency across systems.

Configuration Steps:

• Provide values for required fields:
  • Tenant
  • Report Owner
  • Report Name
  • Worker Identifier: Provide the unique identifier used in your tenant to reference the worker (for example, employee or worker ID).

Retrieve a specific worker

Fetch a specific worker’s profile from Workday using the workers API endpoint and bring key attributes into Persona. This is commonly used to prefill verification flows, enrich a Case or Account, or validate data consistency across systems.

Configuration Steps:

• Provide values for required fields:
  • Worker Identifier: Provide the unique identifier used in your tenant to reference the worker (for example, employee or worker ID).

FAQs

What is the difference between the RaaS integration and the Worker integration? Which one should I use?

The RaaS integration allows you to define and expose specific attributes to Persona. The Worker integration has access to the data Workday exposes via the workers API endpoint. We generally recommend integrating via RaaS.

What permissions are required in Workday?

You need admin-level access with permissions to read worker records or to configure custom reports and to expose as a web service.

Do I need an Integration System User (ISU)?

You will need an ISU for the RaaS integration.

The Worker integration does not require an ISU. Authentication for Persona’s Worker integration is all conducted via OAuth.

How do I troubleshoot integration issues?

• Confirm the account connected to Persona has the necessary permissions in Workday.
• Verify the worker identifier provided in the workflow matches your Workday configuration.
• Review integration logs in Persona (Integrations > Integration Logs) to see request/response details and error messages.

Where can I learn more about Workday Functional Areas?

For more information on Functional Areas and what domains they cover, search “Functional Areas” in the search bar of your Workday dashboard.