Workday WQL (OAuth)

​

Finding your Workday Tenant

​

Finding the Web Services Endpoint

1

Go to Public Web Services

Search and navigate to the Public Web Services report.

2

Open the Human Resources WSDL

Locate Human Resources and hover to open the menu. From the three‑dot menu choose Web Service then click View WSDL (the page may take a minute to load).

3

Locate the wsdl:service element

Search for wsdl:service or scroll to the bottom of the page. You should see a section like this:

Copy everything before /service in the location attribute. Exclude the https:// prefix. In the example above this would be wd2-impl-services1.workday.com/ccx (yours may differ, e.g. wd5-services1.myworkday.com/ccx).

Save this value to be used in a later step.

​

Set up an Integration System User

1

Search for Create Integration System User

Search and navigate to the Create Integration System User task.

2

Enter account information

Enter a username and password in the Account Information section.

Click OK to create the user.

​

Add the Integration System User to a Security Group

1

Search for Create Security Group

Search and navigate to the Create Security Group task.

2

Choose group type

Select Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group drop‑down and enter the same name used when creating the Integration System User.

Click OK.

3

Assign the Security Group to the Integration System Users

Select Integration System Users from the drop-down menu. You may choose the user created in the step above or any other user to whom you want to assign this security group.

Click OK.

​

Configure Domain Security Policy Permissions

1

Search for Maintain Permissions for Security Group

Search and navigate to the Maintain Permissions for Security Group task.

2

Select Security Group Type

Select the Security Group name created earlier.

This integration uses the following Workday Security Group permissions. Set each listed permission to Get Only/View Only for read access in the View/Modify Access column.

The Workday HRIS integration currently requires all of the permissions listed below to be enabled for full support.
Workday’s API may return an error response if any of these permissions are missing.

Please note that Security Group Permissions can be customised within a Workday organisation, and this list does not account for such customisations.

Domain Security Policy	View/Modify Access
WQL for Workday Extend	Get Only
Worker Data: Current Staffing Information	Get Only
Workday Query Language	Get Only
Workday Query Language	View Only
Person Data: Name	Get Only
Person Data: Marital Status	Get Only
Person Data: Work Email	Get Only
Person Data: ID Information	Get Only
Person Data: Home Phone	Get Only
Person Data: Gender	Get Only
Person Data: Home Email	Get Only
Person Data: Date of Birth	Get Only
Person Data: Work Phone	Get Only
Person Data: Ethnicity	Get Only

Depending on the fields included in your custom report, additional Domain Security Policy Permissions may be required. If you encounter null values in the API response, review and add the necessary permissions accordingly.

​

Activate the Security Policy Changes

1

Search for Activate Pending Security Policy Changes

Search and navigate to the Activate Pending Security Policy Changes task.

2

Comment and Confirm

Add an optional comment then click OK.

Review the policies that require approval in the summary of the security policy changes. Tick the confirmation box and click OK to approve the pending security policy changes to activate them.

You must activate security changes each time you modify Domain Security Policy Permissions; otherwise changes will not take effect.

​

Register the REST API Client

1

Go to Register API Client

Search and navigate to the Register API Client for Integrations task.

2

Register API Client

Register the API client with the following details:

• Client Name: Any name (e.g. StackOne_Integrations).
• Non‑Expiring Refresh Tokens: Tick the box.
• Scopes: Select required functional scopes for API access:
  • Adaptive Planning for Financial Plans
  • Adaptive Planning for the Workforce
  • Staffing
  • System
  
  Click OK.

3

Copy the Credentials

After registration a page displays the Client ID and Client Secret. Copy and store these credentials securely.

4

Generate the Refresh Token

• At the top of the page click the menu (⋯) icon.
• Select API Client.
• Click Manage Refresh Tokens for Integrations.

Choose your Workday account (the Integration System User you’ve created earlier) and click OK.

On the refresh token page select Generate New Refresh Token and click OK.

When generated, copy the token and click Done.

​

Custom WQL Query

​

Create and View a Custom Report

1

Go to Create Custom Report

Search and navigate to the Create Custom Report task

2

Configure custom report

Follow these steps to configure the custom report:

• Report Name: Must be unique within the tenant
• Report Type: Select Advanced
• Optimised for Performance: Tick this box to enhance performance
• Data Source: Choose the appropriate data source based on the data you need (e.g. Workers for HCM reporting).

Click OK to continue.Add and configure report fields:

• Click the + icon to add a field.
• Select a Business Object (e.g. Worker) in the Business Object column.
• Choose the specific field (e.g. Employee ID) in the Field column.
• Set aliases in Column Heading Override to ensure stable field names in API responses.

The Column Heading Override XML Alias column will appear only after you enable Enable As Web Service under the Advanced tab and save the report. You can view this column when you return to edit the report.

Add following field’s Alias in your report. The aliases serve as stable identifiers for the API responses but the underlying fields must be properly configured.

• Workday_ID
• Employee_ID
• Title
• First_Name
• Last_Name
• Display_Full_Name
• Personal_Email
• Work_Email
• Personal_Phone_Number
• Work_Phone_Number
• Gender
• Ethnicity
• Date_Of_Birth
• Marital_Status
• Job_Title
• Company
• Hire_Date
• Original_Hire_Date
• Employment_Status
• Location
• Employment_Type
• Manager
• Cost_Centers
• National_Identifier_Numbers
• Termination_Date
• Home_Address
• Home_Address_Country
• Home_Address_Postal_Code
• Home_Address_State
• Home_Address_City
• Work_Address
• Work_Address_Country
• Citizenships
• Job_Code
• Effective_Date
• Grade
• Benefits
• Skills

3

Configure report prompts

• Tick Populate Undefined Prompt Defaults to make prompt default fields visible in the report table. Once the Prompt Defaults grid is visible, the ticked Populate Undefined Prompt Defaults field will be unticked again.
• Tick Display Prompt Values in Subtitle to enable prompt display.

Click OK to save the report.

4

Go to View Custom Report

Search for View Custom Report,

select the report you just created, and then click OK to open it.

5

Test Custom Report

Navigate to Test under the Custom Report menu via the 3-dot menu.

Click OK to test it.

You will get some sample data based on the fields you configured in the custom report.

​

Convert the Report to WQL in Workday

1

Go to Convert Reports to WQL

Use the global search bar to search for “Convert Reports to WQL”.

Select the custom report you created earlier in the Create and View a Custom Report step.

Click OK.

2

Click `OK` to continue

3

Get the generated WQL query

You are taken to a page showing the generated WQL query for your custom report.

Copy this WQL query and paste it into the Employee WQL Query field when connecting through the StackOne Connector Hub.

WQL does not support calculated fields when converting custom reports to WQL.

​

Connecting to StackOne

• Web Service Endpoint
• Tenant
• Client ID
• Client Secret
• Non-expiring Refresh Token
• Employee WQL Query: The custom Workday Query Language (WQL) query used when fetching employees.
  Copy

  Ask AI

  /* Sample WQL query format */
  SELECT workdayID as Workday_ID, employeeID as Employee_ID, legalName_Title as Title, legalFirstName as First_Name, legalLastName as Last_Name, legalNameInGeneralDisplayFormat as Display_Full_Name, email_PrimaryHome as Personal_Email, email_PrimaryWork as Work_Email, phone_PrimaryHome as Personal_Phone_Number FROM allWorkers