Skip to content
Help Center
withpersona.comDashboard

Workday HCM integration overview

View Markdown Contact support Contact support 16 min read
On this page

Overview

Workday is an enterprise platform for managing human capital, finance, and business operations across your organization. Persona’s Workday integration enables organizations to securely retrieve and sync worker information from Workday Human Capital Management (HCM) into Persona. Use Workday as your system of record to prefill identity data, automate verification for employees and contractors, and keep investigations and access decisions moving without manual copy-paste.

Choosing an Integration Method

Persona offers two separate integration methods for Workday HCM. Each uses different credentials and supports different operations. You must use the correct credential type for the operation you intend to perform — they are not interchangeable.

RaaS (Reports as a Service)Workers API (REST)
Best forCustom reports with specific fields you defineFetching full worker profiles from Workday’s standard API
AuthenticationISU username & password, or ISU OAuth (refresh token)Authorization code grant, or ISU OAuth (refresh token)
Supported operationExecute Workday custom report (RaaS)Retrieve a specific worker
Recommended?Yes, generally recommendedFor teams already using Workday OAuth

RaaS credentials will not work with the Retrieve a specific worker operation, and Workers API credentials will not work with Execute Workday custom report (RaaS). Make sure you configure the right credential for your intended use case before setting up the integration in Persona.

Benefits

Automated Enrichment: Pull trusted worker details (e.g., name, email, birthdate) from Workday to automatically populate Persona workflows and cases.

Real-Time Context: Surface Workday attributes directly in Persona so reviewers and operations teams have the full picture when making decisions.

Reduced Manual Work: Eliminate repetitive lookups and data entry across HRIS and risk tools, shortening investigation and onboarding time.

Improved Consistency: Use Workday as your single source of truth to standardize identity data across systems and teams.

Integration Features

Persona’s Workday integration supports secure retrieval and mapping of worker data into Persona so teams can automate onboarding, re-verification, and access reviews.

Setting up the Workday HCM RaaS integration

Persona integrates with Workday’s Reports as a Service (RaaS) to allow for sharing specific data with Persona. RaaS reports are custom reports in Workday exposed a web service that Persona can access via the API.

Prerequisites

To integrate via Workday RaaS, ensure you have:

  • Ability to create custom reports in Workday and expose those reports as a web service
  • An Integration System User (ISU) with appropriate data access permissions. You’ll need either the ISU’s username and password, or a Workday API Client (Client ID and Secret) and an OAuth refresh token generated for the ISU.
  • RaaS Server URL. You can retrieve this from Workday once the RaaS report is configured.

Configuring the Integration System User (ISU)

Persona runs your custom report as the ISU, so the report can only return data the ISU is allowed to see. If the ISU’s security group is missing access to a field in the report, Workday either leaves that field out or refuses to run the report. Set up the ISU and its security group before you build the report.

The examples below use ISU_Persona and ISSG_Persona. Use whatever naming convention your Workday tenant follows.

  1. In Workday, run the Create Integration System User task and create an ISU for Persona, for example ISU_Persona.
  2. Run the Create Security Group task, choose the type Integration System Security Group, and create a group for Persona, for example ISSG_Persona. Add the ISU as a member of the group.
  3. Grant the security group Get access on every domain that secures a field in your report. Add View as well if you want to sign in as the ISU and view the report in Workday.
    • Get controls access through APIs and integrations, which is how Persona runs the report. View controls access in the Workday user interface. Modify is not required, because Persona only reads worker data.
    • To find the domain that secures a field, run the View Security for Securable Item task on that field.
    • Common domains for the fields Persona uses include Worker Data: Personal Data, which secures birthdate, and the domains that secure legal name, worker ID, and email address (for example, contact information).
  4. Run the Activate Pending Security Policy Changes task. Changes to domain security policies do not take effect until they are activated.
  5. Make the ISU the owner of the custom report, or add the ISU as an Authorized User of the report, and share the report with the security group.
  6. Before connecting to Persona, verify the setup: sign in to Workday as the ISU, open the report’s JSON URL (Actions > Web Service > View URLs), and run it with a test employee ID.
    • If Workday returns an error here, the problem is in the report or the ISU’s security configuration, not in Persona. Fix it in Workday before creating your credential.

Configuring the RaaS Report

  1. In your Workday Dashboard access the ‘Create Custom Report’ module.

  2. Give your report a name, a type of Advanced, and mark the “Enable as Web Service” option.

  3. Select your data source.

  4. Add the following columns to your report and link them to the appropriate data elements within your Workday tenant. Create column heading overrides to follow this specific naming convention. The column names must match exactly in order for the integration to work:

    • employee_id (required) - the worker identifier that your report’s prompt filters on (for example, Employee ID), which Persona uses for lookup
    • legal_name_first - legal first name
    • legal_name_last - legal last name
    • birthdate - date of birth in ISO 8601 format (YYYY-MM-DD)
    • email_address - employee email address
    • photo - base 64 encoded profile photo

    Although employee_id is the only required column, Persona recommends configuring legal first name, legal last name, and birthdate at a minimum for verification purposes.

  5. Configure filtering for the report on the worker identifier, and add a Prompt for it named Employee_ID. Persona passes the worker identifier to the report as the Employee_ID parameter, so the prompt name must match exactly. A required prompt that is missing or named differently is a common cause of Workday returning a 500 error.

  6. Add an Integration System User (ISU) as an ‘Authorized User’ of the custom report.

Connecting to the Persona dashboard

  1. In the Persona Dashboard, go to Integrations > Marketplace and select Workday.

  2. Click Add Credential at the top of the page.

  3. Toggle the Server selection to Workday Reports as a Service (RaaS) Server.

  4. Populate your Base RaaS Server URL, provide a nickname for your credential, and enter the username and password of the ISU authorized for your custom report.

    • Your Base RaaS Server URL will look like: https://services1.myworkday.com/ccx/service
    • If you are unsure of your Base RaaS Server URL, when viewing your custom report in Workday, select Actions > Web Service > View URLs. Then select the JSON URL.
    • Note: Do not paste this full URL, only the first part of it is your base RaaS server URL. Here are the components of the resulting URL: {raas_server_url}/customreport2/{tenant}/{report_owner}/{report_name}
    • Your base URL will include everything up to /customreport2.

  5. After you have connected your credential, click the Test button.

  6. Select the Execute Workday custom report (RaaS) endpoint. You’ll need the following information about the report in order to test it (see step 4 for instructions on retrieving this information):

    • Tenant
    • Report Owner
    • Report Name
    • Format - keep the default selection of JSON here
    • An Employee ID for filtering

  7. Upon successful testing, your integration is ready for use.

Using ISU OAuth for RaaS instead of a username & password

As an alternative to entering the ISU’s username and password directly, you can authenticate the RaaS credential with an OAuth refresh token tied to the ISU:

  1. In your Workday dashboard, search “Register API Client” to create a new API Client for Integrations (or reuse an existing one).
  2. On the API client, set Non-Expiring Refresh Tokens to Yes.
  3. On the API client, set Scope (Functional Areas) to cover every functional area that the report’s domains belong to, and explicitly include Tenant Non-Configurable.
    • Workday secures some default fields, such as legal first and last name, through the Tenant Non-Configurable functional area. Integration System Security Groups and ISUs have access to it automatically, but API clients do not. Without it, Workday does not return those fields and can respond with a 500 error that says “The task submitted is not authorized.”
  4. From Related Actions > Manage Refresh Tokens for Integrations, select the ISU associated with your custom report and generate a refresh token for it.
    • Generate the refresh token for the ISU itself. If you generate it for a different user, the report runs as that user and returns only what that user can see.
  5. In the Persona Dashboard, when adding your RaaS credential, provide the RaaS Server, the Workday Token Endpoint, the Client ID and Secret from your API client, the ISU’s refresh token, and a nickname for the credential.

Persona exchanges the refresh token for an access token at credential creation and automatically refreshes it going forward — no interactive sign-in is required. In the Persona Dashboard, this credential type is labeled Workday RaaS ISU OAuth Authorization.

If you change the API client’s functional areas later, generate a new refresh token for the ISU, then create a new Persona credential or update the existing one with the new token.

With OAuth, Workday limits the report to data that both the ISU’s security group and the API client’s functional areas allow. If the same report works with the ISU’s username and password but fails with ISU OAuth, compare the API client’s functional areas with the domains that secure the report’s fields, and confirm Tenant Non-Configurable is included.

Using ISU OAuth for the Workers integration instead of an interactive sign-in

As an alternative to the interactive sign-in used in the Workers setup, you can authenticate the Workers credential with an OAuth refresh token tied to an ISU. This authenticates as a Workday Integration System User (ISU) against your tenant’s REST API endpoint, so no interactive login is required after setup:

  1. In your Workday dashboard, search “Register API Client” to create a new API Client for Integrations (or reuse an existing one).
  2. On the API client, set Non-Expiring Refresh Tokens to Yes.
  3. From Related Actions > Manage Refresh Tokens for Integrations, select the ISU you want to authenticate as and generate a refresh token for it.
  4. In the Persona Dashboard, when adding your Workers credential, provide the Server URL, the Workday Token Endpoint, the Client ID and Secret from your API client, the ISU’s refresh token, and a nickname for the credential.
    • Your Server URL is the Workday REST API endpoint for your tenant, in the format https://services1.myworkday.com/ccx/api/v1/your_tenant. In Workday, search for the “View API Clients” task. The endpoint is listed at the top of the page as Workday REST API Endpoint.
    • Your Token URL is listed as Token Endpoint on the API client configuration page.

Persona exchanges the refresh token for an access token at credential creation and automatically refreshes it going forward. In the Persona Dashboard, this credential type is labeled Workday REST API ISU OAuth Authorization, which distinguishes it from the RaaS-pinned ISU OAuth credential. The endpoints this credential can reach are governed by the ISU’s Workday security groups, not by OAuth scopes. This credential works with the Retrieve a specific worker operation and the other Workday REST operations available in the integration.

Using the Workday RaaS integration in a Workflow

  1. Create a new Workflow, or open an existing Workflow you’d like to update.
  2. Add a new Action step > Integrations.
  3. Select the Workday integration and choose your Workday credentials.
  4. Choose the Execute Workday custom report (RaaS) action, then configure the input fields and field mappings.
  5. Save and publish the Workflow. Run a test to confirm data is retrieved and mapped as expected.

Setting up the Workday HCM Workers integration

Prerequisites

To set up the Workers integration, ensure you have:

  • Admin access to your Workday account
  • Workday OAuth 2.0 credentials for secure authentication (Client ID and Secret)
  • Server URL, Authorization URL, and Token URL from the Workday API client configuration page
  • (Optional) an Integration System User (ISU) with necessary API permissions. See the FAQ section for more information on what ISUs are and how to set them up.

Setting up the Workday Credentials

  1. In your Workday dashboard, search “Register API Client” to create a new client, or “Edit API Client” to modify an existing one.
  2. Click Register an API Client. Input the Client Name of your choosing.
  3. For the Client Grant Type, select Authorization Code Grant.
  4. (Optional) Select the Integration System User (ISU) you’d like to associate with this credential. See the FAQ section for how to set up an ISU.
  5. For the redirection URL, input https://app.withpersona.com/integrations/oauth-callback.
  6. For the Scope (Functional Areas), select Staffing and Integration.
  7. Click OK to register the API client.

Connecting to the Persona Dashboard

  1. In the Persona Dashboard, go to Integrations > Marketplace and select Workday.
  2. Click Add Credential at the top of the page.
  3. Enter the Server URL, which is the Workday REST API endpoint for your tenant in the format https://services1.myworkday.com/ccx/api/v1/your_tenant. In Workday, search for the “View API Clients” task. The endpoint is listed at the top of the page as Workday REST API Endpoint.
  4. Enter the Authorization URL, which is listed as “Authorization Endpoint” in Workday.
  5. Enter the Token URL, which is listed as “Token Endpoint” in Workday.
  6. Enter a nickname for the credential, as well as your client ID and secret.
  7. Click Continue, and sign in to your Workday tenant with an account that has the required permissions and approve the requested access.
    • If you do not associate your Workday API client with an ISU, you will need to sign in to a Workday account that either created or has access to the API client when setting up your connection between Persona and Workday. If you do associate your Workday API client with an ISU, then you should log in with the ISU’s username and password when setting up the connection.
    • To avoid the interactive sign-in, use ISU OAuth for the Workers integration instead.
  8. Save your credential. You can remove the credential at any time.

Using the Workers integration in a workflow

  1. Create a new Workflow, or open an existing Workflow you’d like to update.
  2. Add a new Action step > Integrations.
  3. Select the Workday integration and choose your Workday credentials.
  4. Choose the Retrieve a specific worker action, then configure the input fields and field mappings.
  5. Save and publish the Workflow. Run a test to confirm data is retrieved and mapped as expected.

Workday Operations Overview

Persona can retrieve worker records and associated profile details using Workday’s API. See below for the available Workflow Action steps and possible configurations for the Workday integration:

Execute Workday custom report (RaaS)

Fetch data exposed in a custom report about a worker from Workday and bring key attributes into Persona. This is commonly used to prefill verification flows, enrich a Case or Account, or validate data consistency across systems.

Configuration Steps:

  • Provide values for required fields:
    • Tenant
    • Report Owner
    • Report Name
    • Worker Identifier: Provide the unique identifier used in your tenant to reference the worker (for example, employee or worker ID).

Retrieve a specific worker

Fetch a specific worker’s profile from Workday using the workers API endpoint and bring key attributes into Persona. This is commonly used to prefill verification flows, enrich a Case or Account, or validate data consistency across systems.

Configuration Steps:

  • Provide values for required fields:
    • Worker Identifier: Provide the unique identifier used in your tenant to reference the worker (for example, employee or worker ID).

FAQs

What is the difference between the RaaS integration and the Worker integration? Which one should I use?

The RaaS integration allows you to define and expose specific attributes to Persona. The Worker integration has access to the data Workday exposes via the workers API endpoint. We generally recommend integrating via RaaS.

What permissions are required in Workday?

Setting up the integration requires admin-level access in Workday to create custom reports, expose them as a web service, and configure security.

For the RaaS integration, the ISU’s Integration System Security Group needs Get access on every domain that secures a field in your report. If you authenticate with ISU OAuth, the API client’s functional areas must also cover those domains and include Tenant Non-Configurable. See Configuring the Integration System User (ISU) for the full setup.

Do I need an Integration System User (ISU)?

You will need an ISU for the RaaS integration, authenticated either with the ISU’s username and password or via an OAuth refresh token generated for the ISU.

For the Worker integration, you can authenticate either with an interactive OAuth sign-in, which does not require an ISU, or with an OAuth refresh token generated for an ISU, which does.

Why does testing my RaaS credential return a 500 error?

Workday returns a 500 error, often with a message such as “Processing error occurred. The task submitted is not authorized.” or “The requested resource could not be found.”, when it cannot run the report for the credential. Work through these checks:

  • Read the full response body in Integrations > Integration Logs in the Persona Dashboard. Workday’s message usually points at the cause.
  • Sign in to Workday as the ISU and run the report’s JSON URL with a test employee ID. If it fails there, the issue is in Workday rather than Persona.
  • Confirm the report has a prompt named Employee_ID, which is the parameter name Persona sends.
  • Confirm the ISU’s security group has Get access on every domain that secures a field in the report, and that you ran Activate Pending Security Policy Changes after your last change.
  • If you use ISU OAuth, confirm the API client’s functional areas cover the report’s domains and include Tenant Non-Configurable. After changing them, generate a new refresh token for the ISU and update your Persona credential with it.

How do I troubleshoot integration issues?

  • Confirm the account connected to Persona has the necessary permissions in Workday.
  • Verify the worker identifier provided in the workflow matches your Workday configuration.
  • Review integration logs in Persona (Integrations > Integration Logs) to see request/response details and error messages.

Where can I learn more about Workday Functional Areas?

For more information on Functional Areas and what domains they cover, search “Functional Areas” in the search bar of your Workday dashboard.

Plans Explained

Workday HCM Integration by plan

Startup ProgramEssential PlanGrowth PlanEnterprise Plan
Workday HCM IntegrationNot AvailableNot AvailableLimitedAvailable

Learn more about pricing and plans.

Last updated on .

Was this page helpful?If something is missing, let us know and we will take a look.
Thanks for the feedback. It helps us improve these docs.

Related articles

Workday Recruiting integration overview
Marketplace and 3rd-Party Integrations · Workforce
FAQ: Workforce IDV
Marketplace and 3rd-Party Integrations · Workforce