Workday

Workday

This connector reads your Workday tenant through the Workday REST API (https://<host>/ccx/api/<service>/<version>/<tenant>/...): workers and their staffing, direct reports, supervisory organizations and their members, organizations by type, job profiles, jobs (positions), time off balances, time off entries, leaves of absence, and job postings. 16 tools, all read-only.

HR data is sensitive personal data. Look people up only for a legitimate work reason, show absence and leave data only to the worker, their manager or HR, and never copy it beyond the person who asked. Workday enforces the integration user's security groups on every call, so the connector only sees what that user may see. Compensation, pay slips, home addresses, national IDs and other personal details are not part of this connector.

Setup (a Workday administrator, about 15 minutes)

1. Create an Integration System User (task Create Integration System User) and put it in an integration security group (task Create Security Group, type Integration System Security Group (Unconstrained), or constrained to the organizations you want to expose). Grant the group Get (View) access on the domains this connector reads, for example Worker Data: Public Worker Reports, Reports: Organization, View: Supervisory Organization, Job Profile: View, Worker Position: View, Worker Data: Time Off (Time Off Balances), Worker Data: Time Off (Time Off), Worker Data: Leave of Absence and Job Postings: External, then run Activate Pending Security Policy Changes. Leave out the domains whose tools you do not want to use.
2. Run Register API Client for Integrations: give it a name, tick Non-Expiring Refresh Tokens, and add the scopes (functional areas) Staffing, Organizations and Roles, Jobs & Positions, Time Off and Leave and Recruiting (only those you need). Copy the Client ID and Client Secret: the secret is shown only once.
3. Run Manage Refresh Tokens for Integrations, pick the Integration System User as the Workday account, then choose Generate New Refresh Token for the API client and copy the refresh token.
4. Run View API Clients: the Token Endpoint reads https://<host>/ccx/oauth2/<tenant>/token. Put <host> (for example wd2-impl-services1.workday.com or wd5-services1.myworkday.com, without https://) into WORKDAY_HOST and <tenant> into WORKDAY_TENANT.
5. Paste the client ID, client secret and refresh token into WORKDAY_CLIENT_ID, WORKDAY_CLIENT_SECRET and WORKDAY_REFRESH_TOKEN. AnythingMCP exchanges the refresh token for a short-lived access token at the token endpoint (client ID and secret as HTTP Basic) and renews it by itself; no browser sign-in is needed.

IDs: every tool takes the 32-character Workday ID returned as id, and most also accept a reference such as Employee_ID=21001, Organization_Reference_ID=SUP_ORG_100 or Job_Profile_ID=SOFTWARE_ENGINEER. workday_get_time_off_balances needs the Workday ID itself.

Workflow

• People: workday_search_workers (by name, worker ID or email), then workday_get_worker for the full staffing record and workday_list_direct_reports for a manager's team.
• Org structure: workday_list_supervisory_organizations, workday_get_supervisory_organization, workday_list_organization_members; other hierarchies with workday_list_organization_types and then workday_list_organizations with a type id.
• Jobs: workday_list_job_profiles, workday_get_job_profile, workday_list_jobs.
• Absence: workday_get_time_off_balances, workday_list_time_off_entries (requests and their status), workday_list_leaves_of_absence.
• Recruiting: workday_list_job_postings (filter by job requisition) and workday_get_job_posting. Workday's REST API has no listing of job requisitions themselves; postings carry the open jobs.

Paging: lists return total and up to limit rows (at most 100). Ask for the next page with offset = previous offset + limit while it is below total.

Common errors

• OAuth2: could not renew the access token or invalid_grant: the refresh token was revoked or belongs to another API client; generate a new one with Manage Refresh Tokens for Integrations. invalid_client: wrong client ID or secret.
• 401: the access token was refused; check that the host and tenant match the token endpoint.
• 403 or an empty list: the integration user's security group lacks the domain, or the API client lacks the scope (functional area) for this service.
• 404: the ID does not exist or the tenant name is wrong. 503 Service unavailable usually means the tenant name does not exist on that host.

Out of scope here: every write (hiring, job changes, time off requests and corrections, contact changes), compensation, payroll and pay slips, benefits, performance and talent data, candidate and prospect records, and Workday Query Language reports.