Skip to content

Workday Connector

The Workday connector reads users, optional groups, and optional group membership through JSON custom reports, including Workday report-as-a-service style URLs.

JSON custom reports / RaaS

Typical feeds:

users report
groups report
group members report

Roster uses Workday live when an admin searches Workday users or groups from the Platform participant picker. When the admin adds a selected user or group to a participant, Roster caches that selected record in directory_records and directory_record_sources. When the selected record is a group, Roster also caches the selected group’s direct members and membership edges for participant resolution.

MCP and REST directory-record search uses only Roster’s cached/materialized directory records. It does not call Workday live.

  • JSON users report URL
  • optional JSON groups report URL
  • optional JSON group members report URL
  • report username
  • report password stored in the runtime environment or secret manager
  • stable external IDs in report rows

The users report should expose fields mapped to Roster external_id, display_name, primary_email, and user_name. Group reports should expose external_id, display_name, and mail when groups are used.

The group members report should expose:

group_external_id
user_external_id

Supported secret kind:

password

Store the report password outside Roster, then reference it from the connector:

env:WORKDAY_REPORT_PASSWORD

The connector normalizes Workday report rows into Roster directory users and groups:

queryUsers(query)
getUser(externalId)
queryGroups(query)
getGroup(externalId)
getGroupMembers(externalId, query)

Live search loads the configured report rows and filters them through the connector’s field mappings. Scheduled refresh remains cache-only and refreshes only selected records and attached group memberships.