Type to search.

Workday connector

Serverless Preview

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Preview

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Planned

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Planned

    We plan to add this functionality in a future Elastic Stack update. Subject to changes.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The Workday connector connects directly to the Workday REST API. It enables AI agents to query workers, organizational structure, time off balances and entries, recruiting pipelines, inbox tasks, and holiday calendars from Workday HCM.

Note

This connector is currently available in Agent Builder only. Workflow support is planned for a future release.

The Workday connector uses Workday's REST API with OAuth 2.0 authentication. It supports two grant types:

  • Authorization Code — each user authenticates interactively; actions run as that user. Requires non-expiring refresh tokens.
  • Client Credentials — a single service account token; no user interaction required. Suitable for automated or machine-to-machine workflows.

To configure the connector, provide your Workday tenant URL, tenant name, and OAuth credentials.

All actions are read-only. Compensation, payroll, personal contact information, performance ratings, and medical data are not accessible.

You can create a Workday connector in Stack Management > Connectors or when you add a Workday data source.

Tenant URL
The base URL of your Workday tenant, for example https://mycompany.workday.com.
Tenant Name
The tenant identifier used in API paths, for example mycompany. Typically, this matches the subdomain in your Workday URL.
Authentication

OAuth 2.0 — either Authorization Code (per-user) or Client Credentials (machine-to-machine). Both require a Client ID, Client Secret, and Token URL from a registered Workday API client. Authorization Code also requires an Authorization URL. The authorization and token URLs follow the pattern:

  • https://<tenant>.workday.com/ccx/oauth2/<tenant>/authorize
  • https://<tenant>.workday.com/ccx/oauth2/<tenant>/token

Actions are grouped by Workday functional area. Each group requires the corresponding OAuth scope (Functional Area) to be enabled on your Workday API client.

Functional area Actions Required scope
Workers & org hierarchy Get current user, search workers, get worker profile, get direct reports, list organizations, get organization Worker Profile and Skills; Organizations and Roles
Staffing & inbox List job postings, get job posting, list inbox tasks Staffing; Tenant Non-Configurable
Time off & calendars Get time-off balance, list time-off entries, list absence types, list holidays Time Off and Leave; Time Tracking
Recruiting List candidates Recruiting

Use the Action configuration settings to customize connector networking, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use xpack.actions.customHostSettings to set per-host configurations.

To use the Workday connector, register an API client in Workday with the appropriate grant type.

  1. Log in to Workday as a system administrator.
  2. Search for and open Register API Client for Integrations.
  3. Enter a name for the client (for example, Kibana Integration).
  4. From the Client Grant Type menu, select Authorization Code Grant.
  5. Enable PKCE.
  6. Enable Non-Expiring Refresh Tokens.
  7. Add the Functional Areas corresponding to the action groups you want to enable (see the Available actions table above).
  8. Click OK and copy the Client ID and Client Secret that are displayed. Store the secret securely — Workday displays it only once.
  9. Search for and open View API Clients. Find your client and copy the Authorization Endpoint and Token Endpoint URLs.
  10. To configure the Kibana connector, enter:
    • Tenant URL: your Workday base URL (for example, https://mycompany.workday.com)
    • Tenant Name: your tenant identifier (for example, mycompany)
    • Client ID and Client Secret from step 7
    • Authorization URL and Token URL from step 8
  1. Log in to Workday as a system administrator.
  2. Search for and open Register API Client for Integrations.
  3. Enter a name for the client (for example, Kibana M2M Integration).
  4. From the Client Grant Type menu, select Client Credentials Grant.
  5. Add the Functional Areas corresponding to the action groups you want to enable (see the Available actions table above).
  6. Click OK and copy the Client ID and Client Secret. Store the secret securely.
  7. Search for and open View API Clients. Find your client and copy the Token Endpoint URL.
  8. To configure the Kibana connector, enter:
    • Tenant URL: your Workday base URL (for example, https://mycompany.workday.com)
    • Tenant Name: your tenant identifier (for example, mycompany)
    • Client ID and Client Secret from step 6
    • Token URL from step 7