Skip to main content

Celonis Product Documentation

Extractor Detail, Workday
Permissions and pre-requisites

An Integration System User (ISU) with permissions to access Workday's web service operations that request required data (as listed below) has to be configured for the user's Workday tenant. For security reasons, Workday restricts each ISU to a single integration system. Below is a step-by-step guide to granting integration access to Workday.

  1. Create integration system user (ISU) --> In case of OAuth2, the user name needs to match the client name of the API client

    1. Select Create Integration System User task

    2. Keep Session Timeout Minutes default (zero)

    3. Select Do Not Allow UI Sessions to not allow the ISU for logging into your Workday system through the UI

  2. Create integration system security groups (ISSG)

    1. Select Create Security Group task

      (As a type, select Integration System Security Group (Unconstrained) or Integration System Security Group (Constrained). The main difference between those is that constrained version results will only returned for objects that have a connection with constraint. For example, for workers in the US organizational entity only.)

    2. In Group Criteria, select newly created ISU to be included in the security group

  3. Identify required security needed for specific operations (View Security for Securable Item) and edit domain security policies

    1. Select the Domain Security Policies for Functional Area report

    2. Select a security policy

    3. Select Edit Permissions

    4. Grant Get access for specific domain to newly created ISSG

  4. Activate pending security policy changes

    1. Access Activate Pending Security Policy Changes task

    2. Describe your changes in the Comment

    3. Select Confirm checkbox to activate your changes

To use OAuth2 two further pre-requisites are required:

  1. Generate a key pair → for Private Key and Public Key

    1. A tool like Cygwin can be used

    2. For generating a key pair and storing it in a key store called “JWTkeystore.jks” with an exemplary password “Workday123!” use the following command:

      keytool -genkey -keyalg RSA -alias Workday -keystore JWTkeystore.jks -storepass Workday123! -validity 360 -keysize 2048
    3. To extract the public key and save it as a file called “publickey.cert” use the following command:

      keytool -export -alias Workday -keystore JWTkeystore.jks -rfc -file publickey.ce
  2. Register API Client in the Workday system → for Client Name and Client ID

    1. In Workday, execute “Register API Clients”

    2. Select "JWT Bearer Grant as the Client Grant Type"

    3. Under "X509 Certificate", select "Create x509 Public Key" and paste the content of publickey.cert

    4. Select "Scope (Functional Areas)" that are relevant to the REST and SOAP APIs you wish to call


The Workday Extractor supports 2 authentication methods:

  • Basic-auth (storec credentials): The visibility of returned data is protected by Workday security domain access, which is equivalent to basic-auth with username and password.

  • OAuth2

    • Client ID: Client ID from the registered API client in Workday

    • User ID: Client Name from the registered API client in Workday

    • Private key: Private key from the key pair

Used Requests

The Workday Extractor supports requests from 5 different areas: Human Resources, Financial Management, Resource Management, Revenue Management and Reports.

Human Resources

The Workday Hire-to-Retire connector uses Workday's SOAP-based Human Resources Web Service which contains operations that expose Workday Human Capital Management Business Services data, incl. employee, contingent worker and organization info. The Celonis Extractor uses the below operations to retrieve data from Workday:

  • Get_Employee

    Retrieves granular information about individual employments (e.g., position, job, status).

  • Get_Employee_Employment_Info

    Retrieves granular information about individual employments (e.g., position, job, status).

  • Get_Former_Workers

    Retrieves data for individuals that have previously been employed but were not included as a Workday worker, incl. their personal/job details and contact info as of termination date.

  • Get_Job_Categories

    Retrieves job categories data for the specified criteria (all if no criteria specified), incl. reference ID, name, description and inactive flag.

  • Get_Job_Profiles

    Retrieves data related to job profiles for the specified criteria (all if no criteria is specified), organized into different response groups.

  • Get_Locations

    Retrieves data related to a location for the specified criteria (all if no criteria is specified).

  • Get_Organizations

    Retrieves data related to an organization, incl. staffing configuration, structure, etc.

  • Get_Supervisory_Organization_Assignment_Restrictions

    Retrieves the organization assignment default values and allowed values for supervisory organizations.

  • Get_Worker_Event_History

    Retrieves references to all events created through workflows associated with a worker based on the event type and data parameters.

  • Get_Worker_Profile

    Retrieves a subset of data related to a worker and their employment/contract, personal info, as well as compensation.

  • Get_Workers

    Retrieves public and private information for specified workers.

Financial Management

  • GET Payments

  • GET PaymentTypesTable

  • GET StopItem

  • GET BusinessUnits

  • GET CurrencyConversionRates

  • GET CurrencyRateTypes

  • GET CompanyOrganizations

  • GET CostCenters

  • GET ResourceCategories

  • GET FinancialRevenueCategories

Resource Management

  • GET Suppliers

  • GET PurchaseOrders

  • GET PurchaseRequisitions

  • GET PurchaseItems

  • GET Receipts

  • GET PurchaseOrderChangeOrders

  • GET SpendCategoryHierarchies

  • GET SupplierInvoiceAdjustments

  • GET SupplierInvoices

  • GET SupplierContracts

Revenue Management

  • GET Customers

  • GET CustomerCategories

  • GET CustomerDeposits

  • GET CustomerGroups

  • GET CustomerInvoiceAdjustments

  • GET CustomerInvoices

  • GET CustomerPayments

  • GET CustomerRefunds

  • GET RevenueCategories

  • GET SalesItems

  • GET SalesItemGroups


  • GET Report

API Request Limits

Practically, there are no known limitations that lead to restrictions so far. (Workday imposes API limits as a combination of the frequency and request porcessing time to protect against, e.g., Denial of Service attacks. The Celonis Extractor automatically takes those limits into account.)