Connect Workday to OneSchema Multi FileFeeds

Availability: Multi FileFeeds with the Workday connection and Fetch Workday Data transform features enabled.

This guide walks through creating a Workday connection in OneSchema and using it with the Fetch Workday Data transform in a Multi FileFeed.

OneSchema supports three Workday authentication methods:

Method	When to use
Refresh token	Recommended for most REST API data pulls. You register an API client in Workday, generate a long-lived refresh token, and OneSchema exchanges it for short-lived access tokens at runtime.
Client credentials	Use when your Workday API client is configured for the client credentials grant.
ISU	Use for Workday SOAP (WWS) access with an Integration System User account.

The rest of this guide focuses on the refresh token flow, which is the most common starting point for the Fetch Workday Data transform. Client credentials and ISU connections use the same OneSchema connection form with fewer fields.

What you need

Requirement	Notes
Admin or Developer role in OneSchema	Required to create or edit connections.
Workday connection feature enabled	If you do not see a Workday option on the Connections page, contact your OneSchema representative.
A Workday tenant with API access	Your Workday admin must be able to register API clients and manage refresh tokens.
A Workday account with the right permissions	The Workday account you select when generating the refresh token must have security-domain access to the data you want to pull.

Step 1 — Register an API client in Workday

In Workday, search for and open the Register API Client for Integrations task.

Fill in the registration:

Client Name — any descriptive name, for example OneSchema Multi FileFeed.
Non-Expiring Refresh Tokens — select this checkbox. OneSchema needs a refresh token that does not expire, because the integration runs on a schedule without an interactive login.
Scope (Functional Areas) — select the Workday functional areas that contain the data you plan to fetch. For example, choose Integration for generic REST endpoints or Human Resources for worker data. Your Workday admin can adjust this later if you add more Multi FileFeed use cases.

Save the client. Workday displays a Client ID and Client Secret. Copy both immediately — Workday does not show the secret again. OneSchema stores them encrypted.

Step 2 — Generate a refresh token

In Workday, search for and open the View API Clients report.
On the API Client for Integrations tab, select the client you just registered.
From the related actions menu, choose API Client → Manage Refresh Tokens for Integrations.
Select the Workday account that will own the API calls. This account must have the permissions required for the resource paths you plan to query.
In the Delete or Regenerate Refresh Token prompt, choose Generate New Refresh Token and confirm.
Copy the generated refresh token immediately. Treat it like a password: copy it directly into OneSchema and do not paste it into chat, email, or other storage.
Copy the full Token Endpoint URL shown on the same page. It looks like:
```
https://mycompany.workday.com/ccx/oauth2/mycompany/token
```
You only need the host and tenant parts for OneSchema; OneSchema constructs the token path automatically.

Step 3 — Create the Workday connection in OneSchema

In the OneSchema dashboard, go to Settings → Connections and click New Workday connection.
Select Refresh Token as the authentication method.
Fill in the connection fields:

OneSchema field	Where it comes from
Connection name	A descriptive label, e.g. `Workday Production — HR data`.
Host URL	The Workday host from the token endpoint URL, e.g. `https://mycompany.workday.com`. OneSchema only accepts Workday domains.
Tenant	The tenant identifier from the token endpoint path, e.g. `mycompany`.
Client ID	The Client ID from the registered API client.
Client Secret	The Client Secret from the registered API client.
Refresh token	The refresh token generated in Step 2.

Click Create connection. OneSchema validates the credentials against Workday and saves the connection.

The connection is now available on the Connections page and in any Multi FileFeed. To re-check it later, use the Test connection row action on the saved connection.

Step 4 — Add Fetch Workday Data to a Multi FileFeed

Open a Multi FileFeed in the MFF builder.
Click Add transform and search for Workday.
Add the Fetch Workday Data transform.
In the transform settings, the panel switches based on the selected account's authentication type:

Field	What to enter
Workday account	Select the connection you created.
Resource path	(REST accounts: refresh token or client credentials.) For standard HCM REST resources, enter the plain resource name, for example `workers` or `currencies`; OneSchema appends it to `/ccx/api/v1/{tenant}/`. For other Workday API families, enter the full host-relative path starting with `ccx/api/` or `api/` and include the connection tenant after the API version, for example `ccx/api/common/v1/{tenant}/countries` or `api/customObject/v1/{tenant}/customObjects/your-alias`. Do not include the host URL.
Service	(ISU/SOAP accounts only.) The Workday SOAP web service, for example `Human_Resources` or `Staffing`.
Operation	(ISU/SOAP accounts only.) The Workday SOAP operation, for example `Get_Workers`. Only read-only `Get_` operations are supported.
Page size	Maximum records to fetch per request. REST accounts support up to `100`. ISU/SOAP accounts support up to `999` (`Response_Filter.Count`). If you leave it blank, OneSchema uses the maximum for the account type.
Output format	File (CSV) to output a CSV file, or List to output a row list for downstream transforms.

Save the Multi FileFeed.

When the Multi FileFeed runs, OneSchema fetches a fresh access token (or uses the ISU credentials), calls the Workday REST or SOAP API, paginates through the result set, and produces the configured output.

Other authentication methods

Client credentials

Choose Client Credentials in the OneSchema connection form instead of Refresh Token. You still need the Client ID and Client Secret from a registered API client, but you do not generate or paste a refresh token. The Workday client must be configured to allow the client credentials grant.

ISU (SOAP / WWS)

Choose ISU when you want to call Workday Web Services (SOAP) instead of the REST API. You need:

An ISU username and ISU password for a Workday Integration System User.
A SOAP version in the form v43.1, 43.1, v43, or 43.

OneSchema uses these values to call the SOAP endpoint directly. The Fetch Workday Data transform will expose Service and Operation fields instead of a REST resource path.

Security notes

Encrypted storage. OneSchema encrypts the Client ID, Client Secret, refresh token, and ISU password at rest.
Handle secrets carefully. Treat the refresh token, Client Secret, and ISU password like passwords. Copy them directly from Workday into the OneSchema connection form. Do not paste them into chat, email, or other storage.
Short-lived access tokens. OneSchema requests an access token at the start of each run and stores it only in memory.
Refresh token rotation. If Workday returns a new refresh token during a run, OneSchema stores it back in the connection for the next run. Even so, we recommend registering the API client with Non-Expiring Refresh Tokens so the same token remains valid across runs.
No interactive login required. OneSchema does not support an interactive Workday OAuth sign-in flow. All credentials must be generated in Workday and pasted into the connection form.

Troubleshooting

Symptom	Likely cause	What to check
Connection creation fails with an authentication error	Client ID, Client Secret, or refresh token is incorrect, or the API client is disabled.	Re-copy the values from the View API Clients report.
Test connection fails with an authentication or access-denied error	The credentials are incorrect, or the Workday account tied to the refresh token lacks permission to the requested data.	Re-copy the values and confirm the account has the right security-domain access for the resource path you plan to use.
Workday API error 403	The Workday account lacks permission to the requested resource, security domain, or SOAP service/operation.	Confirm the account has the required security-domain access for the resource path, service, or operation.
Workday API error 404	The REST resource path or SOAP service/operation does not exist, or the tenant name is incorrect.	Check the spelling of the resource path, service, and operation; verify the tenant name.
Fetch Workday Data returns no records	The resource path is wrong, or the query is filtered by Workday security.	Verify the path and test the same call in Workday's REST API documentation or a tool like `curl`.
Refresh token expired error	The API client was not registered with Non-Expiring Refresh Tokens, or the token was revoked.	Regenerate the refresh token in Workday and update the connection.
Page size was reset	OneSchema clamps page sizes to the account type's maximum (100 for REST, 999 for ISU/SOAP).	Enter a value within the limit. A blank value uses the maximum, not a Workday default.