Workday HCM
Workday·AE_HSc_WorkdayConnectorGuide
Overview
The Workday connector integrates AlertEnterprise with Workday HCM for human-capital data sync — the source-of-record for Workers, organizations, and employment lifecycle events in most enterprise deployments. Provisioning is built on Workday's Human Resource API (SOAP); reconciliation is built on the Report API, which is a prerequisite for reconciliation operations.
Topology: Alert Connector Framework (ACF) drives the Alert Workday Connector, which issues SOAP/HTTPS calls into Workday's HR API and Report API endpoints. No intermediate agent — direct vendor-cloud REST/SOAP integration.
Authentication supports both Basic auth (Workday Integration System User credentials) and OAuth 2.0 client credentials, configurable per tenant. Workday's API model is service-versioned (e.g. v44.x, v45.x); the connector negotiates against the customer's exposed version.
Architecture
Composed from this connector's actors + edges. Trust zones are color-coded; trust crossings render as thicker lines.
Authentication
2 methods supported
Workday tenant requires an Integration System User account with sufficient domain security policy permissions to call the HR + Report APIs. Credentials are passed in the SOAP header per Workday's standard auth model.
Alternative auth path for Workday tenants using OAuth-protected API endpoints. Configurable per deployment.
Prerequisites
Everything that must be in place for this connector to work, with the owner who's responsible.
Workday Report API enabled
customerReconciliation depends on Workday's Report API. The customer's Workday tenant must have the Report API enabled, and the AE Integration System User must have permission to call the reports the connector consumes.
Workday Integration System User (ISU) account
customerAn ISU account with appropriate domain security policy permissions for HR API + Report API. Workday best practice is a dedicated ISU per integration partner.
Worker Field Mapping documentation
jointCustomer must provide field mappings between AE Worker attributes and Workday Worker XML field paths before reconciliation can begin.
Data fields
3 fields mapped between AE Guardian and the vendor system.
| AE field | Vendor field | Description | Direction | Required |
|---|---|---|---|---|
| Worker | Workday Worker (Employee + Contingent Worker) | Worker records — employees and contingent workers. Reconciled from Workday into AE; provisioning writes user-related fields back as needed. | bidirectional | yes |
| Organization | Workday Organization (Supervisory Organization, Cost Center, etc.) | Organizational hierarchy. Reconciled from Workday into AE for downstream entitlement decisions. | inbound | no |
| Employment Status | Workday Worker employment status | Active / leave / terminated lifecycle states drive AE-side provisioning decisions. | inbound | no |
HR specifics
- Sync modes
- full-load · delta
- Scheduled sync
- configurable
- Direction
- inbound
- Contingent worker support
- Yes
Field mappings are defined per deployment against Workday's Worker XML schema. Customer typically provides the mapping spreadsheet; AE connector configuration translates to runtime mappings.
Bulk operations are supported via Workday's Report API (returns paginated result sets). Initial-load reconciliation typically uses a full-population report.
- src/connectors/workday/source.pdf — p7 — Chapter 2, Connector Architecture