Connection to Workday

DQC connects to your Workday tenant read-only over HTTPS using RaaS (Reports as a Service) and the REST API, authenticated with a dedicated Integration System User (ISU) and OAuth 2.0. No human login or end-user password is ever shared.

Who sets this up: a Workday Security Administrator (plus a Report Writer for the reports). The steps below are Workday-side configuration that an end user cannot perform.

1. Tenant coordinates

Collect these from any Workday URL or the About Workday page:

These combine into the URLs DQC uses:

• https://{host}/ccx/service/customreport2/{tenant}/{owner}/{report}?format=json — RaaS report

• https://{host}/ccx/oauth2/{tenant}/token — OAuth token endpoint

2. Create the Integration System User (ISU)

1. Run the task Create Integration System User.

2. Set a user name (e.g. ISU_DQC) and a strong password.

3. Check Do Not Allow UI Sessions — this is a web-service account.

4. Set Session Timeout Minutes to 0 so the integration session never expires.

5. Recommended: exclude the ISU from password expiration so it is not locked out by a rotation policy.

3. Create the Security Group (ISSG)

1. Run Create Security Group.

2. Choose Integration System Security Group (Unconstrained) for full-tenant access, or Constrained to limit DQC to one organization/region.

3. Name it (e.g. ISSG_DQC) and add ISU_DQC as a member.

4. Grant domain security access

Grant the ISSG Get / View access to the domains backing the data in scope:

Grant Get / View only — never Put/Modify. Then run Activate Pending Security Policy Changes. Forgetting to activate is the most common reason a connection test fails.

5. Register the OAuth 2.0 API Client

1. Run Register API Client for Integrations.

2. Check Non-Expiring Refresh Tokens.

3. Select the Scopes (Functional Areas) matching the data scope (Staffing, Organizations and Roles, optionally Compensation).

4. Submit and copy the Client ID and Client Secret (the secret is shown only once).

5. Open Manage Refresh Tokens for Integrations, generate a refresh token for ISU_DQC, and copy the Refresh Token.

DQC exchanges the refresh token for short-lived access tokens automatically; you never manage access tokens.

6. Prepare the RaaS reports

1. Run Create Custom Report, Report Type Advanced, on the appropriate data source (e.g. All Active and Terminated Workers).

2. Add the columns DQC should profile. Fewer, well-named columns give better data-quality results.

3. On the Advanced tab, check Enable As Web Service.

4. Share the report with ISSG_DQC so the ISU can run it.

5. From Web Service > View URLs, copy the JSON URL and note the report owner + name.

Effective dating: Workday data is time-versioned. Reports return data as of today by default. To extract as of a specific date, add an effective-date prompt to the report and tell DQC which date to pass.

7. Enter the connection in DQC

1. Go to Connectors > Data sources and click the Workday tile.

2. Fill in the fields below, then select the reports (tables) to sync.

Security & good practice

• Least privilege — only Get/View on the in-scope domains and the shared reports.

• Read-only — DQC never writes to Workday.

• Rotation — you can revoke the refresh token or rotate the secret in Workday anytime; re-enter the new values in DQC afterwards.

• Auditability — all access appears in Workday's audit logs under ISU_DQC.

Troubleshooting