Workday Financial Management Setup Guide

Follow our setup guide to connect Workday Financial Management to Fivetran.

Prerequisites

To connect Workday Financial Management to Fivetran, you need a Workday Integration System User account that has read permissions for financials domain objects in Workday.

NOTE: We have added support for authentication using OAuth. To configure a Workday Financial Management connection, you can use a Workday user or a Workday integration system user. We recommend that you use a Workday integration system user.

Setup instructions

Create integration system user

Log in to your Workday application using an Administrator account.
In the application's search box, search for 'create user' and then select Create Integration System User.
Enter a User Name and Password.
Leave the Require New Password at Next Sign In checkbox clear.
(Only for Basic authentication mode) Select the Do Not Allow UI Sessions checkbox.
NOTE: If you opt for authentication using OAuth, be sure not to select the Do Not Allow UI Sessions checkbox. OAuth requires UI sessions.
Click OK and then click Done.

Create integration security group

In the search box, search for 'create security group' and then select Create Security Group.
In the Type of Tenanted Security Group drop-down menu, select Integration System Security Group (Unconstrained).
Enter a Security Group Name and click OK.
In the Edit Integration System Security Group (Unconstrained) window, add the integration system user you created in Step 1 to this security group.
Click OK.

Add integration security group to the authentication policy

In the search box, search for 'manage authentication policies' and then select Manage Authentication Policies.
Enter the Restricted to Environment value and then select the Authentication Policy Enabled checkbox.
In the Authentication Allowlist section, enter the Authentication Rule Name.
Select the Security Group you created.
Enter the Authentication Condition Name and Authentication Conditions.
In the Allowed Authentication Types section:
- If you use OAuth, select Any.
- If you don't use OAuth, in the Specific field, select User Name Password.
In the search box, search for 'Activate All Pending Authentication Policy Changes' and then select the corresponding task.
In the Comment text box, enter 'I approve the changes' and then click OK.
Select the Confirm checkbox and then click OK.

Add domain security policies

In the search box, search for 'security group membership and access' and then select the report link.
Select the security group you created in Step 2 and click OK.
Click the ... symbol next to the security group name.
Select Security Group > Maintain Domain Permissions for Security Group.
In the Integration Permissions section, in the Domain Security Policies permitting Get access field, search and select the following domains based on your module:
- For the Financial Management module:
  Expand for the complete list of financial management security domains
  - Access Ledger Account (Segmented)
  - Create : Cost Center
  - Manage: Organization Integration
  - Process: Ad Hoc Payment Settlement
  - Process: Bank Account Transfer for Settlement/Settlement
  - Process: Customer Invoice Payment
  - Process: Customer Invoice Payment/Settlement
  - Process: Expense Report Payment/Settlement
  - Process: Historic Ledger Types
  - Process: Intercompany Payment/Settlement
  - Process: Journals (NEW)
  - Process: Miscellaneous Payment Request Settlement
  - Process: Payroll Settlement
  - Process: Payroll Third-Party Payments Settlement
  - Process: Procurement Card Payment/Settlement
  - Process: Settlement
  - Process: Student Payment/Settlement
  - Process: Student Sponsor Refund/Settlement
  - Process: Supplier Invoice
  - Process: Supplier Invoice Payment/Settlement
  - Reports: Alternate Ledger Currency
  - Set Up: Accounts
  - Set Up: Alternate Ledger Currency
  - Set Up: Audit Tags and Assignments
  - Set Up: Basic Supplier Worktag
  - Set Up: Company General
  - Set Up: Currency (Compensation functional area)
  - Set Up: Currency Rates
  - Set Up: Financial Accounting
  - Set Up: Ledger Account Security Segments
  - Set Up: Maintain Custom Worktags
  - Set Up: Payroll - Company Specific
  - Set Up: Settlement
  - Set Up: Spend Categories
  - Special OX Web Services
- For the Inventory module:
  Expand for the complete list of inventory security domains
  - Process: Goods Delivery
  - Process: Inventory
  - Process: Inventory Pick List
  - Process: Inventory Shipment
  - Process: Inventory Stock Request
  - Process: Recall
  - Process: Recall Reaction
  - Set Up: Inventory
  - Set Up: Purchase Item
  - Special OX Web Services
- For the resource management module:
  Expand for the complete list of resource management security domains
  - Manage: Project Resource Forecast
  - Manage: Project Task Resources
  - Process: Advanced Ship Notice
  - Process: Advanced Ship Notice - Core
  - Process: Advanced Ship Notice - Reporting
  - Process: Credit Card
  - Process: Purchase Order - View
  - Process: Purchase Order Acknowledgement - Manage
  - Process: Purchase Order Acknowledgement - View
  - Process: Receipt/Return (NEW)
  - Process: Request for Quotes
  - Process: Supplier Catalogs
  - Process: Supplier Contract
  - Process: Supplier Invoice - Request
  - Process: Supplier Refund - View
  - Reports: Supplier
  - Set Up: Bank Entity
  - Set Up: Commodity Codes
  - Set Up: Customer Contacts
  - Set Up: Expense Item
  - Set Up: Procurement
  - Set Up: Project
  - Set Up: Project Details
  - Set Up: Project Hierarchy
  - Set Up: Project Tracking
  - Set Up: Supplier
  - Set Up: Supplier Contacts
  - Set Up: Supplier Invoice History
  - Set Up: Supplier Invoice Work Queue
  - Set Up: Spend Categories
  - Set Up: Tax
  - View: Supplier
  - View: Supplier Invoice Request
  - Worker Data: Project Timesheet and Worksheet
  - Special OX Web Services
- For the revenue management module:
  Expand for the complete list of revenue management security domains
  - Process: Alternate Customer Contract
  - Process: Billing
  - Process: Customer Contract - View
  - Process: Customer Contract (NEW)
  - Process: Customer Deposit
  - Process: Customer Invoice (NEW)
  - Process: Customer Refund Settlement
  - Process: Opportunity
  - Process: Order Fulfillment
  - Process: Project Billing - View
  - Process: Transfer Pricing
  - Reports: Customer
  - Set Up: Basic Revenue Category Worktag
  - Set Up: Customer Accounts
  - Set Up: Customer Contracts
  - Set Up: Customer Milestones
  - Set Up: Project Billing
  - Set Up: Revenue
  - Set Up: Sale Item
  - Special OX Web Services
NOTE: The above list of domains is not comprehensive and some tables might require further permissions. Search for table names in the View Security for Securable Item task. Look for GET request for the object and configure the listed domains under that in the Workday tenant.
TIP: You will see an alert. You must activate the security policy changes.
Click OK and then click Done.

Activate security policy changes

In the search box, search for 'Activate Pending Security Policy Changes'.
Select Activate Pending Security Policy Changes.
In the comment box, enter 'I approve the changes' and click OK.
Select the Confirm checkbox and click OK.

Connect using OAuth

IMPORTANT: Perform this step only if you want to authenticate the connection using OAuth. Skip to the next step if you want to use Basic authentication for your connection. The API client uses rotating refresh tokens and requires you to manually authorize the client while setting up the connection. The API client for integrations uses non-expiring refresh token to set up the connection and thus does not require you to manually authorize the client.

Create custom OAuth client app

Expand for instructions

IMPORTANT: This option is available only for connections created before February 25, 2025.

In the search box, search for Register API client.
In the Client Name field, enter your custom app name.
In the Client Grant Type field, select Authorization Code Grant.
Select the Enforce 60 Minute Access Token Expiry checkbox.
In the Access Token Type field, select Bearer.
In the Redirection URI, enter https://fivetran.com/integrations/workday_financial_management/oauth2/return.
In the Refresh Token Timeout (in days) field, enter a timeout period for your refresh token.
NOTE: By default, the value is set to 30 days. You can enter a timeout period between 1 and 365 days.
In the Scope (Functional Areas) drop-down menu, select the scopes you need access to.
NOTE: To identify the required Scopes (Functional Areas), search for the table name in the View Security for Securable Item task. Click View Security and look for the GET requests for the object. Find the required Scope (Functional Area) in the All Functional Areas column.
NOTE: Be sure not to select the Support Proof Key for Code Exchange (PKCE), Grant Administrative Consent, Include Workday Owned Scope, and Locked Out due to Excessive Failed Signon Attempts checkboxes.
Click OK.
Make a note of the Client ID, Client Secret, and Authorization Endpoint. You will need them to configure Fivetran.

Create custom OAuth client app for Integrations

Expand for instructions

IMPORTANT: Perform this step only if you want to authenticate your account using OAuth with API Client for Integrations.

In the search box, search for Register API Client for Integrations.
In the Client Name field, enter your custom app name.
(Optional) Select the Refresh Token Timeout (in days). You can select a value between 1 and 365 days. The default value is 30 days. To prevent the refresh token from timing out, Workday automatically selects the Non-Expiring Refresh Tokens check box.
NOTE: If you select a timeout period for the refresh token, you need to re-authorize your connection on the Edit connection details tab of the connection details page after the token expires.
In the Scope (Functional Areas) drop-down menu, select the scopes you need access to.
NOTE: To identify the required Scopes (Functional Areas), search for the table name in the View Security for Securable Item task. Click View Security and look for the GET requests for the object. Find the required Scope (Functional Area) in the All Functional Areas column.
NOTE: Do not select the Include Workday Owned Scope and Locked Out due to Excessive Failed Signon Attempts checkboxes.
Click OK.
Make a note of the Client ID and Client Secret. You will need them to configure Fivetran.
Click the Related Actions menu and select API Client > Manage Refresh Tokens for Integrations.
In the Workday Account field, search and select your workday account.
Select the Generate New Refresh Token checkbox.
Click OK.
Make a note of the Refresh Token. You will need it to configure Fivetran.

Finish Fivetran configuration

In the connection setup form, enter the Destination schema name of your choice.
Select the authentication mode: Basic or OAuth.
(Optional): If you choose Basic, do the following:
i. Enter your Workday Username.
ii. Enter your Workday Tenant. You can find the tenant in your Workday Web Services URL: https://<Workday-host-name>/ccx/service/<Workday-Tenant>/....
iii. Enter your Workday Password.
iv. Enter your Workday Hostname. You can find the Workday Hostname in your Workday Web Services URL, in the following format: https://<Workday-host-name>/ccx/service/....
(Optional): If you choose OAuth, do the following:
i. Enter your Workday Tenant. You can find the tenant in your Workday Web Services URL: https://<Workday-host-name>/ccx/service/<Workday-Tenant>/....
ii. Enter the Client ID you found in Step 5.
iii. Enter the Client Secret you found in Step 5.
iv. Enter your Workday Hostname. You can find the Workday Hostname in your Workday Web Services URL, in the following format: https://<Workday-host-name>/ccx/service/....
v. In the Authorization URL field, enter the authorization endpoint that you found in Step 5.
vi. Click Authorize to allow Fivetran to access your Workday Financial Management account using OAuth. You will be redirected to your Workday Financial Management account to authorize Fivetran's access.
IMPORTANT: We recommend logging in while in incognito mode to ensure authorization of the correct account.
vii. Log in to your Workday Financial Management account with the integration system user you created in Step 1. Once you have finished, you will be redirected back to Fivetran.
Use toggle button to choose between API client and API client for integration that you created.
If you choose OAuth and register an API Client for Integration, do the following:
i. Enter your Workday Tenant. You can find the tenant in your Workday Web Services URL: https://<Workday-host-name>/ccx/service/<Workday-Tenant>/....
ii. Enter the Client ID you created.
iii. Enter the Client Secret you created.
iv. Enter your Workday Hostname. You can find the Workday Hostname in your Workday Web Services URL, in the following format: https://<Workday-host-name>/ccx/service/....
v. Enter the Refresh Token you generated.
Click Save & Test. Fivetran will take it from here and sync your Workday Financial Management data.

Connector Overview

Schema Information

Release Notes

API Connection Configuration

Documentation Home