# Workday > Workday: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 0.1.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the structure of an organisation from Workday: organisations, job profiles, locations, job requisitions, and reports you name. Each record becomes one document in the knowledge base. It reads; it never writes, and it does not read workers, compensation or payroll. Status: **Built, not certified** (needs a Workday implementation tenant). ## At a glance | Collector | Workday, version `0.1.0` | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | Workday: Workday REST API and Reports-as-a-Service ([the vendor's documentation](https://community.workday.com/sites/default/files/file-hosting/restapi/index.html)) | | Family | ERP | | Kind | Hr | | Ways to connect | OAuth approval | | Scopes | - Read: `Organizations and Roles`, `Jobs and Positions`, `Recruiting`, `Reports as a Service (named reports)` | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `*.workday.com`, `*.myworkday.com` | | Vendor API versions | REST v1, RaaS (customreport2) | | Lowest engine version | `0.47.0` | ## What it reads | Object | Source | | ------------------ | ------------------------------------------------------------------------------ | | `organisations` | supervisory organisations and cost centres (REST) | | `job_profiles` | job profiles (REST) | | `locations` | locations (REST) | | `job_requisitions` | job requisitions (REST) | | `reports` | named Reports-as-a-Service reports, as `owner/report`, that you write and name | You choose which to read; a whole tenant is never the default, and a report is read only if you name it. **What it never reads.** Workers, compensation and payroll: no object reads them. A report is written by you, so before anything is stored the collector drops every column whose name matches the personal-data deny-list (compensation, salary, pay, bonus, national id, tax id, passport, bank, IBAN, account number, date of birth, home address, personal email and phone, ethnicity, gender, marital status, disability, medical, health, religion, visa, benefits, and any reference to a worker, manager or recruiter) and counts them in the record’s metadata (`dropped_columns`: the count, never a value). The same guard applies to every field of every object. Build your reports without those columns anyway; the guard is a last line. ## How to connect 1. In Workday, register an **API Client for Integrations** with a refresh token, and give its integration system user **read** on the functional areas for the objects above (Organizations and Roles, Jobs and Positions, Recruiting) and on any report you name. Nothing that writes. 2. In LightHouse, open **Connectors** and choose **Workday**. 3. Enter the host (for example `wd2-impl-services1.workday.com`, no `https://`), the tenant name, the client id, client secret and refresh token. 4. Choose a label, the objects to read, the reports (as `owner/report`), and how often. The secrets are sealed in your deployment and never shown again. ## Permissions Read on the named functional areas and reports. The collector sends only `GET` requests; the one `POST` is the OAuth token request. Its read-only test proves it on every change. This release takes read-only credentials only. ## Limits - The host must be a `*.workday.com` or `*.myworkday.com` host, and it is the only host contacted. A redirect is never followed. - REST resources and reports have no change feed the collector relies on, so each is read in full and only what changed is rewritten. Large reports should be filtered in Workday. - A report row with no id-like column is keyed by its content, so an edited row is a new record and the old one is removed at the next listing. - Deletions are found by listing every six hours. - REST paths follow Workday’s published API descriptions (version 1 under `/ccx/api/v1/{tenant}/`); a resource a tenant does not expose is refused and the read fails with `scope_missing`. - Requests are paced and back off when Workday asks. ## Data handling - No personal data is read by default (see “What it reads”). Dropped report columns are counted, never stored. - The responses are not cached; only the records written are kept, in your deployment. - Nothing leaves your deployment: the collector runs inside it, and only the counts of items read reach LightHouse. ## Troubleshooting | What you see | What it means | What to do | | ------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------- | | `auth_failed` | The API Client or refresh token was refused (invalid client or grant) | Check the client; issue a new refresh token if it was revoked | | `scope_missing` | The integration user may not read the resource or report (403) | Grant the functional area, or share the report with the user | | `unreachable` | Workday did not answer, or answered with an error | Check the host and tenant | | `HostNotAllowed` | A request went to a host that is not your sealed host | Correct the credential | | Read succeeded, 0 written | Nothing changed since the last read | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ----------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `0.1.0` | `0.47.0` | REST v1; RaaS (customreport2) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/workday/