Connection to Workday

DQC connects read-only to your Workday tenant through Reports as a Service (RaaS): every custom report you enable as a web service becomes a table in DQC that you can profile and check. DQC signs in as a dedicated Integration System User (ISU), either with its password (Basic) or with an OAuth 2.0 refresh token issued for it. No personal login is shared.

Who sets this up: a Workday Security Administrator (ISU, security group, API client) and a report writer (custom reports). Steps 1 to 5 happen in Workday, step 6 in DQC.

Add a Workday connector

To begin:

1. Go to the Connectors > Data sources screen

2. Click the Workday tile

3. Fill in the fields below, click Load tables and select the reports to add as tables

Required connection information

Base URL and Tenant cannot be changed after saving. To point DQC at another tenant (for example from the implementation tenant to production), create a new connector.

1. Find your tenant coordinates

Open any report's web service URLs in Workday (step 5) or look at your Workday URL:

DQC builds these URLs from them:

• {base URL}/ccx/service/customreport2/{tenant}/{owner}/{report}?format=json for each report

• {base URL}/ccx/oauth2/{tenant}/token for OAuth tokens

2. Create the Integration System User (ISU)

1. Run the task Create Integration System User.

2. Set a user name (for example ISU_DQC) and a strong password.

3. Check Do Not Allow UI Sessions: this is a web-service account. Basic and OAuth both work with it.

4. Set Session Timeout Minutes to 0.

5. Exclude the ISU from password expiration, or plan to update the password in DQC when it rotates.

3. Create the security group and grant domain access

1. Run Create Security Group and choose Integration System Security Group (Unconstrained), or Constrained to limit DQC to specific organizations.

2. Name it (for example ISSG_DQC) and add the ISU as a member.

3. Run Maintain Domain Permissions for Security Group and add the domains that secure the data in your reports under View (Report/Task Permissions) and Get (Integration Permissions). Never grant Modify or Put.

4. Run Activate Pending Security Policy Changes. Forgetting this step is the most common reason a connection test fails.

Typical domains, depending on the report content:

4. Choose the authentication

Option A: Basic (Integration System User)

No further setup in Workday. Enter the ISU user name and password in DQC. DQC does not retry a rejected login (HTTP 401), so a wrong password does not add failed attempts that could lock the ISU.

Option B: OAuth 2.0 (Refresh Token)

1. Run Register API Client for Integrations.

2. Check Non-Expiring Refresh Tokens.

3. Select the Scopes (Functional Areas) of the data in your reports (for example Staffing, Organizations and Roles, Contact Information) and always Tenant Non-Configurable. Without it Workday refuses every report requested with OAuth, and the connection test fails with Workday denied access to report …. Include Workday Owned Scope is not needed.

4. Copy the Client ID and the Client Secret (the secret is shown only once).

5. On the API client, open the related actions API Client > Manage Refresh Tokens for Integrations, select the ISU, check Generate New Refresh Token and copy the token.

DQC exchanges the refresh token for short-lived access tokens and renews them automatically. If Workday rejects an access token early, DQC requests a new one once before it reports an error. Changing the client's scopes later takes effect without a new refresh token. Generating a new refresh token invalidates the previous one immediately, so update the connector right after.

5. Prepare the reports

1. Run Create Custom Report with Report Type Advanced on the data source you need (for example All Active and Terminated Workers).

2. Add the columns DQC should check. The column names in DQC are the fields' XML aliases (Column Heading Override XML Alias), so set clear aliases; Workday recommends at most 16 characters. Fewer, well-named columns give clearer data quality results.

3. Check Enable As Web Service (shown for Advanced reports when you create the report, and on the Advanced tab). If Workday reports missing prompt defaults when you save, check Populate Undefined Prompt Defaults on the Prompts tab and save again.

4. Share the report: on the Share tab choose Share with specific authorized groups and users and add the ISU's security group. Domain permissions alone are not enough; without sharing Workday refuses the report.

5. Open the report's related actions Web Service > View URLs and copy the JSON URL. You can paste it into DQC as is, or enter owner/report.

• Prompts: Workday needs values for required prompts in the report URL. In View URLs, enter the prompt values first and paste the resulting URL into DQC: its prompt values are kept (the format parameter is not needed). Every load uses these values.

• Effective dating: Workday returns data as of today unless the report defines otherwise.

• Report names must be unique within a connector, because each report becomes a table named after it.

• Report owner: Workday cannot serve reports whose owner's user name contains a backslash. Use a report owned by another user.

6. Enter the connection in DQC

Add the connector as described above with the values from steps 1 to 5. Load tables lists the configured reports; select the ones to add as tables. When you save, DQC starts loading them.

How DQC loads and refreshes Workday data

• Each report is downloaded in full as JSON and stored in a DQC-internal cache. Checks, profiling and previews read from this cache, not from Workday directly.

• The first load starts when the connector is saved. Until it has finished, previews and samples show: Workday report '…' is being loaded from Workday for the first time. Try again in a few minutes.

• A loaded report is reused for 60 minutes. After that, rule runs and profiling load it again before they check, while previews and samples show the last loaded copy right away and refresh it in the background.

• Loads of the same report never run in parallel, which keeps the load on your tenant low.

• Column types: values that are only 0 or 1 become booleans, decimal numbers become numbers, YYYY-MM-DD values become dates, everything else stays text. Numeric identifiers such as employee IDs stay text, so leading zeros and long numbers are kept. Multi-instance fields become a text column holding JSON.

• Columns that are empty in every row are still created, taken from the report's schema.

• Workday limits a report exposed as a web service to 2 GB and a web service response to 1 million instances. For larger extracts, split or filter the report in Workday.

Whitelist the DQC Platform static IP

If your tenant restricts web service access by IP range (authentication policy), allow the DQC Platform's static IP:

3.123.94.228

For private cloud installations of DQC, allow your installation's outbound IP instead.

Security and good practice

• Least privilege: Get access only on the domains in scope and only the shared reports.

• Read-only: DQC only runs reports and never writes to Workday.

• Secrets: password, client secret and refresh token are stored encrypted and never shown again in DQC.

• Rotation: revoke the refresh token or change the ISU password in Workday at any time, then enter the new value in the connector.

• Auditability: all access appears in Workday's audit logs under the ISU.

Troubleshooting

Notes

• DQC uses only custom reports enabled as web services (RaaS). Workday's SOAP and WQL APIs are not used.

• All connectors support read-only data access, and credentials are encrypted and stored securely.

• Learn more: Supported data sources