---
title: Workday connector
description: Access Workday HR data across workers, org structure, time off, recruiting, and holidays with the Workday connector. Reference for OAuth 2.0 setup, connector configuration, and available actions.
url: https://www.elastic.co/docs/reference/kibana/connectors-kibana/workday-action-type
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Planned
---

# Workday connector
The Workday connector connects directly to the Workday REST API. It enables AI agents to query workers, organizational structure, time off balances and entries, recruiting pipelines, inbox tasks, and holiday calendars from Workday HCM.
<note>
  This connector is currently available in **Agent Builder** only. Workflow support is planned for a future release.
</note>


## Overview

The Workday connector uses Workday's REST API with OAuth 2.0 authentication. It supports two grant types:
- **Authorization Code** — each user authenticates interactively; actions run as that user. Requires non-expiring refresh tokens.
- **Client Credentials** — a single service account token; no user interaction required. Suitable for automated or machine-to-machine workflows.

To configure the connector, provide your Workday tenant URL, tenant name, and OAuth credentials.
All actions are read-only. Compensation, payroll, personal contact information, performance ratings, and medical data are not accessible.

## Create connectors in Kibana

You can create a Workday connector in **Stack Management > Connectors** or when you add a Workday data source.

### Connector configuration

<definitions>
  <definition term="Tenant URL">
    The base URL of your Workday tenant, for example `https://mycompany.workday.com`.
  </definition>
  <definition term="Tenant Name">
    The tenant identifier used in API paths, for example `mycompany`. Typically, this matches the subdomain in your Workday URL.
  </definition>
  <definition term="Authentication">
    OAuth 2.0 — either Authorization Code (per-user) or Client Credentials (machine-to-machine). Both require a **Client ID**, **Client Secret**, and **Token URL** from a registered Workday API client. Authorization Code also requires an **Authorization URL**.
    The authorization and token URLs follow the pattern:
    - `https://<tenant>.workday.com/ccx/oauth2/<tenant>/authorize`
    - `https://<tenant>.workday.com/ccx/oauth2/<tenant>/token`
  </definition>
</definitions>


## Available actions

Actions are grouped by Workday functional area. Each group requires the corresponding OAuth scope (Functional Area) to be enabled on your Workday API client.

| Functional area         | Actions                                                                                                        | Required scope                                     |
|-------------------------|----------------------------------------------------------------------------------------------------------------|----------------------------------------------------|
| Workers & org hierarchy | Get current user, search workers, get worker profile, get direct reports, list organizations, get organization | Worker Profile and Skills; Organizations and Roles |
| Staffing & inbox        | List job postings, get job posting, list inbox tasks                                                           | Staffing; Tenant Non-Configurable                  |
| Time off & calendars    | Get time-off balance, list time-off entries, list absence types, list holidays                                 | Time Off and Leave; Time Tracking                  |
| Recruiting              | List candidates                                                                                                | Recruiting                                         |


## Connector networking configuration

Use the [Action configuration settings](/docs/reference/kibana/configuration-reference/alerting-settings#action-settings) to customize connector networking, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use `xpack.actions.customHostSettings` to set per-host configurations.

## Get API credentials

To use the Workday connector, register an API client in Workday with the appropriate grant type.

### Authorization Code (per-user)

1. Log in to Workday as a system administrator.
2. Search for and open **Register API Client for Integrations**.
3. Enter a name for the client (for example, `Kibana Integration`).
4. From the **Client Grant Type** menu, select **Authorization Code Grant**.
5. Enable **PKCE**.
6. Enable **Non-Expiring Refresh Tokens**.
7. Add the **Functional Areas** corresponding to the action groups you want to enable (see the Available actions table above).
8. Click **OK** and copy the **Client ID** and **Client Secret** that are displayed. Store the secret securely — Workday displays it only once.
9. Search for and open **View API Clients**. Find your client and copy the **Authorization Endpoint** and **Token Endpoint** URLs.
10. To configure the Kibana connector, enter:
   - **Tenant URL**: your Workday base URL (for example, `https://mycompany.workday.com`)
   - **Tenant Name**: your tenant identifier (for example, `mycompany`)
   - **Client ID** and **Client Secret** from step 7
   - **Authorization URL** and **Token URL** from step 8


### Client Credentials (machine-to-machine)

1. Log in to Workday as a system administrator.
2. Search for and open **Register API Client for Integrations**.
3. Enter a name for the client (for example, `Kibana M2M Integration`).
4. From the **Client Grant Type** menu, select **Client Credentials Grant**.
5. Add the **Functional Areas** corresponding to the action groups you want to enable (see the Available actions table above).
6. Click **OK** and copy the **Client ID** and **Client Secret**. Store the secret securely.
7. Search for and open **View API Clients**. Find your client and copy the **Token Endpoint** URL.
8. To configure the Kibana connector, enter:
   - **Tenant URL**: your Workday base URL (for example, `https://mycompany.workday.com`)
   - **Tenant Name**: your tenant identifier (for example, `mycompany`)
   - **Client ID** and **Client Secret** from step 6
   - **Token URL** from step 7