Workday

Built, not certified Built and tested against recorded and synthetic responses (version 0.1.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the structure of an organisation from Workday: organisations, job profiles, locations, job requisitions, and reports you name. Each record becomes one document in the knowledge base. It reads; it never writes, and it does not read workers, compensation or payroll.

Status: Built, not certified (needs a Workday implementation tenant).

At a glance

Collector	Workday, version 0.1.0
Reads	Workday: Workday REST API and Reports-as-a-Service (the vendor's documentation)
Family	ERP
Kind	Hr
Ways to connect	OAuth approval
Scopes	Read: Organizations and Roles, Jobs and Positions, Recruiting, Reports as a Service (named reports)
Read only	Yes, except: [object Object]
Vendor's API can move money	No
Personal data	None
Hosts it may contact	*.workday.com, *.myworkday.com
Vendor API versions	REST v1, RaaS (customreport2)
Lowest engine version	0.47.0

What it reads

Object	Source
organisations	supervisory organisations and cost centres (REST)
job_profiles	job profiles (REST)
locations	locations (REST)
job_requisitions	job requisitions (REST)
reports	named Reports-as-a-Service reports, as owner/report, that you write and name

You choose which to read; a whole tenant is never the default, and a report is read only if you name it.

What it never reads. Workers, compensation and payroll: no object reads them. A report is written by you, so before anything is stored the collector drops every column whose name matches the personal-data deny-list (compensation, salary, pay, bonus, national id, tax id, passport, bank, IBAN, account number, date of birth, home address, personal email and phone, ethnicity, gender, marital status, disability, medical, health, religion, visa, benefits, and any reference to a worker, manager or recruiter) and counts them in the record’s metadata (dropped_columns: the count, never a value). The same guard applies to every field of every object. Build your reports without those columns anyway; the guard is a last line.

How to connect

1. In Workday, register an API Client for Integrations with a refresh token, and give its integration system user read on the functional areas for the objects above (Organizations and Roles, Jobs and Positions, Recruiting) and on any report you name. Nothing that writes.
2. In LightHouse, open Connectors and choose Workday.
3. Enter the host (for example wd2-impl-services1.workday.com, no https://), the tenant name, the client id, client secret and refresh token.
4. Choose a label, the objects to read, the reports (as owner/report), and how often.

The secrets are sealed in your deployment and never shown again.

Permissions

Read on the named functional areas and reports. The collector sends only GET requests; the one POST is the OAuth token request. Its read-only test proves it on every change. This release takes read-only credentials only.

Limits

• The host must be a *.workday.com or *.myworkday.com host, and it is the only host contacted. A redirect is never followed.
• REST resources and reports have no change feed the collector relies on, so each is read in full and only what changed is rewritten. Large reports should be filtered in Workday.
• A report row with no id-like column is keyed by its content, so an edited row is a new record and the old one is removed at the next listing.
• Deletions are found by listing every six hours.
• REST paths follow Workday’s published API descriptions (version 1 under /ccx/api/v1/{tenant}/); a resource a tenant does not expose is refused and the read fails with scope_missing.
• Requests are paced and back off when Workday asks.

Data handling

• No personal data is read by default (see “What it reads”). Dropped report columns are counted, never stored.
• The responses are not cached; only the records written are kept, in your deployment.
• Nothing leaves your deployment: the collector runs inside it, and only the counts of items read reach LightHouse.

Troubleshooting

What you see	What it means	What to do
auth_failed	The API Client or refresh token was refused (invalid client or grant)	Check the client; issue a new refresh token if it was revoked
scope_missing	The integration user may not read the resource or report (403)	Grant the functional area, or share the report with the user
unreachable	Workday did not answer, or answered with an error	Check the host and tenant
HostNotAllowed	A request went to a host that is not your sealed host	Correct the credential
Read succeeded, 0 written	Nothing changed since the last read	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	0.1.0	0.47.0	REST v1; RaaS (customreport2)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only