Connecting to Workday HCM

Workday Human Capital Management (HCM) is a leading enterprise cloud application for managing human resources, payroll, talent acquisition, benefits, and workforce planning. Integrating Workday HCM with IBM watsonx Orchestrate enables seamless automation of HR operations, real-time data synchronization, and improved employee lifecycle management.

To enable this integration, you must establish a secure connection that enables both platforms to communicate. See Managing connectionsfor more details.

Important: By default, Single sign-on (SSO) is disabled for your app. To enable it, refer to Configuring single sign-on for applications.

Connecting to Workday HCM using OAuth2

To connect watsonx Orchestrate to Workday HCM OAuth2:

  1. From the main menu, select Manage > Connections.

  2. Search for Workday HCM OAuth2.

  3. Locate the connection ID with the following format: workday_oauth2_auth_code_ibm_184bdbd3

  4. Click edit next to the matched connection ID.

  5. Choose the environment where the connection will be used:

    • Draft: for development or testing
    • Live: for production use

  6. Select Oauth2 Authorization Code as the authentication type.

  7. Provide the following values:

    • Server URL: Base URL of the Workday server
      You can get the server URL from the TOKEN URL by copying the portion of the URL upto /ccx and adding /<tenant_name> at the end. The tenant name is the part of the TOKEN URL found between /oauth2/ and /token.
      Example : https://wd2-impl-services1.workday.com/ccx/ibmsrv_dpt1
    • Token URL: Endpoint to exchange the authorization code for an access token
    • Scope: Defines what access is being requested (for example, read write profile)
    • Authorization URL: URL where users are redirected to log in and authorize access
    • Client ID: Unique ID for your application (available in Workday UI)
    • Client Secret: A secret key used to authenticate your app with Workday

    To get these values, see the Workday API documentation.

  8. Choose the appropriate credential type.

  9. Click Save to complete the setup.

Note: The icon A Supports appears indicates that the connection was successfully established.

Connecting to Workday HCM (Base)

Note: For agents deployed before August 2025, continue using existing connection types for Workday integration. For agents created after August 2025, OAuth2 is the only supported authentication method for Workday.

To connect watsonx Orchestrate to Workday HCM:

  1. From the main menu, select Manage > Connections.

  2. Search for Workday HCM.

  3. Locate the connection ID with the following format: workday_base_key_value_ibm_184bdbd3

  4. Click edit next to the matched connection ID.

  5. Choose the environment where the connection will be used:

    • Draft: for development or testing
    • Live: for production use

  6. Select Key Value Pair as the Authentication Type.

  7. Provide the following keys and their respective values:

    • base_url: The base URL of your Workday API instance
    • token_url: The URL used to obtain the OAuth token
    • tenant_name: Your Workday tenant identifier
    • client_id: The client ID of your Workday integration system
    • client_secret: The client secret to authenticate your Workday integration.

    To get these values, see the Workday API documentation.

  8. Choose the appropriate credential type.

    Note: Only the team credentials are supported when an app is connected using the Key Value Pair authentication type.

  9. Click Save to complete the setup.

Connecting to Workday HCM Employee

Note: For agents deployed before August 2025, continue using existing connection types for Workday integration. For agents created after August 2025, OAuth2 is the only supported authentication method for Workday.

To connect watsonx Orchestrate to Workday HCM Employee:

  1. From the main menu, select Manage > Connections.

  2. Search for Workday HCM Employee.

  3. Locate the connection ID with the following format: workday_employee_key_value_ibm_184bdbd3

  4. Click edit next to the matched connection ID.

  5. Choose the environment where the connection will be used:

    • Draft: for development or testing
    • Live: for production use

  6. Select Key Value Pair as the Authentication Type.

  7. Provide the following keys and their respective values:

    • bearer_token: The access token used for API authentication
    • refresh_token: The token used to refresh the bearer token

    To get these values, see the Workday API documentation.

  8. Choose the appropriate credential type.

  9. Click Save to complete the setup.

Connecting to Workday HCM Manager

Note: For agents deployed before August 2025, continue using existing connection types for Workday integration. For agents created after August 2025, OAuth2 is the only supported authentication method for Workday.

To connect watsonx Orchestrate to Workday HCM Manager:

  1. From the main menu, select Manage > Connections.

  2. Search for Workday HCM Manager.

  3. Locate the connection ID with the following format: workday_manager_key_value_ibm_184bdbd3

  4. Click edit next to the matched connection ID.

  5. Choose the environment where the connection will be used:

    • Draft: for development or testing
    • Live: for production use

  6. Select Key Value Pair as the Authentication Type.

  7. Provide the following keys and their respective values:

    • bearer_token: The access token used for API authentication
    • refresh_token: The token used to refresh the bearer token

    To get these values, see the Workday API documentation.

  8. Choose the appropriate credential type.

  9. Click Save to complete the setup.