Create a connection to Workday by navigating to the Connections page in the Sync App application and selecting the corresponding icon in the Add Connections panel. If the Workday icon is not available, click the Add More icon to download and install the Workday connector from the CData site.

Required properties are listed under the Settings tab. The Advanced tab lists connection properties that are not typically required.

Connecting to the Workday WQL API

The WQL service must be enabled before connecting:

1. Open Workday and enter View Domain in the search bar. Enter Workday Query Language for the prompt.
2. Check that one of the Allowed Security Group Types includes the user you are connecting with.

Configuring the Host and Tenant

To obtain the Host and Tenant properties, log into Workday and search for View API Clients. On this screen, Workday will display the Workday REST API Endpoint which contains both the Host and Tenant. The Tenant is the portion after the last slash, while the Host is the "https://" and the domain name.

For example: if the API endpoint is https://wd3-impl-services1.workday.com/ccx/api/v1/mycompany, the Host is https://wd3-impl-services1.workday.com and the Tenant is mycompany.

You also have the option of connecting to reports when the UseWQL property is enabled. See Fine-Tuning Data Access for details on how to configure this.

Authenticating to Workday

You can authenticate to the Workday WQL API as a normal (non-ISU) user, or an ISU (via either OAuth or OAuthJWT).

Normal User

To authenticate as a normal user in Workday, you must first create an API Client. Please refer to Creating a Custom OAuth Application for details on the procedure.

Once you have an API client configured, set the following properties to connect:

• AuthScheme: Set this to OAuth.
• OAuthClientId: The Client ID obtained from the View API Client page.
• OAuthClientSecret: The Client Secret obtained from the View API Client page. If you are using a public client, leave this blank.
• Tenant: The tenant for the account.
• Host: The host for the REST API Endpoint in the View API Clients page.

ISU

To authenticate as an ISU, you must first create either an API Client or an API Client for Integrations. Please refer to Creating a Custom OAuth Application for details on the procedure. You can create either an API Client for Integrations or an API Client using the JWT bearer grant type.

If you created an API Client for Integrations, set the following properties to connect:

• AuthScheme: Set this to OAuth.
• InitiateOAuth: Set this to REFRESH.
• OAuthClientId: The Client ID obtained from the View API Client page.
• OAuthClientSecret: The Client Secret obtained from the View API Client page.
• OAuthRefreshToken: The refresh token obtained from the Manage Refresh Tokens for Integrations page.
• Tenant: The tenant for the account.
• Host: The host for the REST API Endpoint in the View API Clients page.

If you created an API Client with JWT, set the following properties to connect:

• AuthScheme: Set this to OAuthJWT.
• OAuthJWTCertType: Set this to the certificate type. This will be PFXFILE if you created the certificate with keytool or openssl pkcs12.
• OAuthJWTCert: The path of the certificate file you created.
• OAuthJWTCertPassword: The password of the certificate file you created.
• OAuthJWTIssuer: The Client ID obtained from the View API Client page.
• OAuthJWTSubject: The username of the ISU you are using.
• Tenant: The tenant for the account.
• Host: The host for the REST API Endpoint in the View API Clients page.

Connecting to the Workday SOAP API

Connections using the SOAP API support all the same authentication schemes that the WQL and reporting services do, in addition to basic authentication. Each of the above configurations can be used with SOAP by setting the UseWQL property to false.

Basic authentication can also be used with a normal user or an ISU without configuring an API client:

• UseWQL: Set this to false.
• AuthScheme: Set this to Basic.
• User: The Workday user account name.
• Password: The password used to authenticate the user.
• Tenant: The tenant for the account.
• Host: The host for the REST API Endpoint in the View API Clients page.

Other authentication methods are configured the same way as for the WQL and reporting services. Please refer to the corresponding sections for more details on those authentication schemes as well as the Host and Tenant properties.

Fine Tuning Data Access

SOAP API

When connecting with UseWQL disabled, the following properties will determine what tables are exposed:

• Service: A comma-separated list of Workday WSDLs to load. Each WSDL contains one schema which exposes multiple tables.
• WSDLURL: The URL to load a Workday WSDLs from. If provided, this will override Service and present WSDLs tables under the Workday schema.
• WSDLVersion: The version of the Workday API to load the WSDLs for. This can be used to request a newer or older version of the Workday data model.

Accessing Reports as a Service

When connecting with the UseWQL property enabled, the Sync App supports reading reports that have been exposed through Workday Reports as a Service (RaaS). Workday does not have a built-in way for the Sync App to determine which reports have been exposed via RaaS, so you must create a custom report to use this feature:

1. Open the Create Custom Report form.
2. Name the report Reports as a Service.
3. Enter Advanced for the report type.
4. Select Enable As Web Service.
5. Clear Optimized for Performance.
6. Enter All Custom Reports for the Data Source.

After the report is created, you need to add a few columns and filters:

1. In Fields
   • For the first column, enter Report Name.
   • Add a second colum and enter Web Service Namespace.
   • Add a third colum and enter Report Owner.
   • Add a fourth colum and enter Brief Description.
2. Make sure all columns have the primary business object as their Business Object. The primary business object has the name Custom Report and should have a box-and-arrow icon beside it. If the icon is an ellipsis (...) instead, then click menu , select Primary Business Object and then Custom Field.
3. Open the Filter tab and create a new filter. Enter Web Service Namespace as the field and is not blank as the Operator.
4. Add a second filter. Enter Current User as the field, in the selection list as the Operator, Value from Another Field as the comparison type, and Authorized Users as the comparison value.
5. Click OK to save the report. If Workday displays any warnings then click OK again to dismiss them.

Note that the Current User filter is optional but recommended. It is there to ensure that the Sync App does not surface reports that your account does not have permissions to view. However, if the report has performance issues then the filter can be removed.

The final step is to find the URL associated with the report. This URL is used to set the CustomReportURL connection property.

1. Open the newly created report.
2. Click the ellipsis (...) button beside the report title in the upper-left corner of the screen
3. Find the Web Services tab within the pop-up. You may have to scroll down inside the pop-up to see it.
4. Hover over it and select View URLs.
5. Copy the Workday XML link.

Troubleshooting

Invalid Request

While connecting, you may receive an error stating "Invalid Request". This is a server-side Workday error. It often indicates that your user account has not been granted the permissions required to either connect via the API, or to obtain the specific information you have requested.

The tables and columns are retrieved from a publicly available service that requires no authentication, so this error may appear while either testing the connection, or when trying to retrieve data after metadata has been obtained.

The Task Submitted is not Authorized

While connecting, you may receive an error stating "Processing error occurred. The task submitted is not authorized".

This is a server-side error Workday error. This error typically indicates that your Workday account does not have the necessary module activated to access the table or Service you are attempting to connect to.

Ensure the correct module is activated if you receive this error. The Sync App is unable to dynamically determine which modules are available at runtime, but the exposed services can be configured via the Service connection property.

This section details a selection of advanced features of the Workday Sync App.

User Defined Views

The Sync App allows you to define virtual tables, called user defined views, whose contents are decided by a pre-configured query. These views are useful when you cannot directly control queries being issued to the drivers. See User Defined Views for an overview of creating and configuring custom views.

SSL Configuration

Use SSL Configuration to adjust how Sync App handles TLS/SSL certificate negotiations. You can choose from various certificate formats; see the SSLServerCert property under "Connection String Options" for more information.

Firewall and Proxy

Configure the Sync App for compliance with Firewall and Proxy, including Windows proxies and HTTP proxies. You can also set up tunnel connections.

Query Processing

The Sync App offloads as much of the SELECT statement processing as possible to Workday and then processes the rest of the query in memory (client-side).

See Query Processing for more information.

Logging

See Logging for an overview of configuration settings that can be used to refine CData logging. For basic logging, you only need to set two connection properties, but there are numerous features that support more refined logging, where you can select subsets of information to be logged using the LogModules connection property.

Customizing the SSL Configuration

By default, the Sync App attempts to negotiate SSL/TLS by checking the server's certificate against the system's trusted certificate store.

To specify another certificate, see the SSLServerCert property for the available formats to do so.

Connecting Through a Firewall or Proxy

HTTP Proxies

To connect through the Windows system proxy, you do not need to set any additional connection properties. To connect to other proxies, set ProxyAutoDetect to false.

In addition, to authenticate to an HTTP proxy, set ProxyAuthScheme, ProxyUser, and ProxyPassword, in addition to ProxyServer and ProxyPort.

Other Proxies

Set the following properties:

• To use a proxy-based firewall, set FirewallType, FirewallServer, and FirewallPort.
• To tunnel the connection, set FirewallType to TUNNEL.
• To authenticate, specify FirewallUser and FirewallPassword.
• To authenticate to a SOCKS proxy, additionally set FirewallType to SOCKS5.

WQL APIs

When UseWQL is enabled, the Sync App models Workday data sources as views. You can get a complete list of these data sources using the Data Sources standard report in Workday. The Sync App exposes each data source using its WQL Alias which is shown on the View Data Source page. All WQL data sources appear under the REST schema.

The Sync App does not list all the data sources defined within Workday:

1. The Sync App only exposes data sources that are accessible to the user you have authenticated as. For example, a user with only HR roles is able to view data sources containing employee records but not data sources about financial assets.
2. The Sync App only supports one data source filter per data source. The Sync App uses the unfiltered version of the data source when it is available. For data sources that require a data source filter, the Sync App automatically picks the first one listed on the data source. Different data source filters expose different prompts and may return different rows, but all return the same data fields.

You can use UseSplitTables to work around this limtiation by splitting each data source into multiple views with fewer columns.

Reports

When you enable UseWQL, the Sync App also grants access to reports that are exposed using Reports as a Service (RaaS). These reports are exposed as views within the Reports schema. Accessing these reports requires extra connection setup beyond the basic settings for WQL access. See Fine-Tuning Data Access for details on what is required.

The Sync App considers WQL views as higher priority than report views. If you write a query that does not specify a schema, the Sync App first tries to find a WQL data source with the name of the table. If it cannot find one then it tries to find a report with a title that matches the table name. Though in practice this kind of conflict is unlikely, as WQL data sources and report titles have different naming conventions.

SELECT * FROM [Possible Report Or Data Source]
/* Executed as SELECT * FROM REST.[Possible Report Or Data Source] 
   if there is both a report and WQL data source with this name */

Prompts

Many Workday data sources and reports have prompts that affect the output of the report. The Sync App exposes these prompts as input columns that have the _Prompt suffix. Most prompts accept only a single value, but prompts that accept multiple values can be set with IN or equals:

SELECT * FROM [Account Balance Data]
WHERE Company_Prompt IN ('1234567890abcdef', 'f1234567890abcde')
AND Region_Prompt = 'ef1234567890abcd'
AND Include_Managers_Prompt = TRUE
AND Start_Date_Prompt = '2022-01-01'

Other filters may be included with prompts. These do not affect the way Workday generates the report, but the Sync App removes non-matching rows from the response:

SELECT * FROM [Account Balance Data]

/* Prompts */
WHERE Company_Prompt IN ('1234567890abcdef', 'f1234567890abcde')
AND Region_Prompt = 'ef1234567890abcd'
AND Include_Managers_Prompt = TRUE
AND Start_Date_Prompt = '2022-01-01'

/* Other filters */
AND Department = 'Sales and Marketing'
AND Account_Type = 'LIABILITY'

SOAP APIs

The data models listed in Service are only available in the SOAP API. Accessing them requires disabling UseWQL.

Views are composed of columns and pseudo columns. Views are similar to tables in the way that data is represented; however, views do not support updates. Entities that are represented as views are typically read-only entities. Often, a stored procedure is available to update the data if such functionality is applicable to the data source.

Queries can be executed against a view as if it were a normal table, and the data that comes back is similar in that regard.

Dynamic views, such as queries exposed as views, and views for looking up specific combinations of project_team work items are supported.

Workday Connector for CData Sync Views

Accesses the Allowance Plan as the primary object and returns one row per plan. Includes all allowance plans. Does not contain built-in prompts. This data source delivers the additions and removals for plans over time.

Columns

Accesses the Bonus Plan as the primary object and returns one row per bonus plan. Includes all active bonus plans. Does not contain built-in prompts. The data source delivers the additions and removals for bonus plans over time.

Columns

Accesses the Compensation Plan as the primary object and returns one row per plan. Includes all active plans. Does not contain built-in prompts. This data source delivers the additions and removals for plans over time.

Columns

Accesses the Compensation Rule as its primary object. The Compensation Rule object returns one row per Compensation Rule. Includes all Compensation Rules. Does not contain any built-in prompts.

Columns

Accesses Job Profile as the primary object and returns one row per job profile. Includes all active and inactive job profiles. Does not contain built-in prompts.

Columns

Accesses the Merit Plan as the primary object and returns one row per plan. Includes all active and inactive plans. Does not contain any built-in prompts. The data source delivers the additions and removals for plans over time.

Columns

Accesses the Position as its primary object. The Position object returns one row per position. Includes only open positions that are in supervisory organizations that the user has access. Does not contain any built-in prompts.

Columns

Accesses Pre-Hire as the primary object and returns one row per pre-hire. Includes all pre-hires as well as pre-hires converted to hires. Does not contain built-in prompts.

Columns

Accesses the Workday Account object and returns one row per Workday account. Includes all Workday accounts ever created, either currently enabled or not. Does not contain built-in prompts. This data source will show settings of the user login information and preferences in Workday.

Columns

Accesses the Worker as its primary object and returns one row per worker. Includes all workers even workers to be hired in the future. Does not contain any built-in prompts. This data source can be used to build reports on all workers. Helpful Tips - 1) If the worker is hired in the future, all fields will be returned based on the effective date. 2) If no effective date is specified, the system will use the current date as the effective date. 3) If the effective date is less than the worker's hire date, no effective dated information (such as position information, compensation information and so on) will be returned. 4) If effective dated behavior is desired, use the "All Active and Terminated workers" data source instead.

Columns

Returns all classes accessible by the current user

Columns

Accesses the Organization as its primary object. The Organization object returns one row per organization. Only includes supervisory organizations that the user manages. Prompts the user at run-time for Supervisory Organization to automatically filter the report results.

Columns

Accesses the Position Group as its primary object. The Position Group object returns one row per Position Group. Includes all unfilled and filled Positions. Prompts the user at run-time for a Compensation Rule to automatically filter the report results.

Columns

Accesses the Organization object and returns one row per organization. Includes all active and inactive organizations with no superior. Does not contain built-in prompts.

Columns

Accesses the Organization as its primary object. The Organization object returns one row per organization.

Columns

The connection string properties are the various options that can be used to establish a connection. This section provides a complete list of the options you can configure in the connection string for this provider. Click the links for further details.

Authentication

OAuth

JWT OAuth

SSL

Firewall

Proxy

Logging

Schema

Miscellaneous

This section provides a complete list of the Authentication properties you can configure in the connection string for this provider.

The type of authentication to use when connecting to Workday.

Remarks

The available authentication methods depend upon the service you are connecting to:

WQL and Reports as a Service

When connecting with UseWQL enabled, the following authentication schemes are available:

• OAuth: Use OAuth with a OAuthClientId and OAuthClientSecret. May be used with normal users or integration system users (ISUs). Normal users log into Workday interactively with a web browser, while the Sync App authenticates ISUs automatically.
• OAuthJWT: Use OAuth with an x509 certificate. Only available for ISUs.

SOAP

When connecting with UseWQL disabled, the following authentication schemes are available:

• Basic: Authenticate using the User and Password for a normal user or ISU.
• OAuth, OAuthJWT, AzureAD: These authentication schemes behave the same in WQL and Reports as a Service.

The tenant for the account.

Remarks

The tenant will be used when constructing the URL to use when attempting to retrieve data from Workday. For example:

https://wd3-impl-services1.workday.com/ccx/service/mycompany_gms1/Human_Resources

In this example, "mycompany_gms1" would be the tenant.

The host for the API URL.

Remarks

The host will be used when constructing the APIURL. To obtain the Host, log into Workday and search for View API Clients. In the listed values, find the Workday REST API Endpoint. For example:

https://wd3-impl-services1.workday.com/ccx/api/v1/mycompany

In this case the Host is "https://wd3-impl-services1.workday.com".

Set to True to use Workday WQL REST API.

Remarks

Set to True to use Workday WQL REST API.

The Workday user account used to authenticate.

Remarks

Together with Password, this field is used to authenticate against the Workday server.

The password used to authenticate the user.

Remarks

The User and Password are together used to authenticate with the server.

The specific SOAP service or services to retrieve data from. Enter as a comma seperated list.

Remarks

Combined with the WSDLVersion, the service determines which WSDLs may be used to dynamically obtain metadata from. Enter them as a comma seperated list, or leave this value blank to use all services the CData Sync App supports. The following values may be specified:

• Absence_Management
• Academic_Advising
• Academic_Foundation
• Admissions
• Adoption
• Benefits_Administration
• Campus_Engagement
• Cash_Management
• Compensation
• Compensation_Review
• Dynamic_Document_Generation
• Financial_Aid
• Financial_Management
• Human_Resources
• Identity_Management
• Integrations
• Inventory
• Learning
• Payroll
• Payroll_CAN
• Payroll_GBR
• Payroll_Interface
• Performance_Management
• Professional_Services_Automation
• Recruiting
• Resource_Management
• Revenue_Management
• Settlement_Services
• Staffing
• Student_Core
• Student_Finance
• Student_Recruiting
• Talent
• Tenant_Data_Translation
• Time_Tracking
• Workday_Connect
• Workday_Extensibility
• Workforce_Planning

Note that services come from the following: https://community.workday.com/sites/default/files/file-hosting/productionapi/index.html

The URL Of the report that shows all Reports as a Service (RaaS) reports.

Remarks

Workday does not have a built-in way of finding all the reports which can be used with RaaS. In order to discover these reports automatically, the Sync App uses a custom report that lists all reports enabled for RaaS.

See Fine-Tuning Data Access for instructions on how to create the report and retrieve its URL.

Whether to split WQL data sources into multiple tables.

Remarks

Workday data sources will often have several hundred fields, with some data sources like allWorkers having thousands of fields. Many database and reporting tools do not support tables with this many columns. By default the Sync App exposes the data sources the same way Workday does, so tools with these limitations cannot use larger data sources.

Enabling this option allows the Sync App to be used with these tools. When split tables are enabled, the Sync App creates multiple tables for complex Workday data sources. Each split table contains between 50-100 columns, along with the primary key, last modified timestamp and effective and entry inputs.

JOINs can be used if data is required from columns that are part of different split tables.

SELECT a.academicDegree, b.yearsExperience
FROM allWorkers_1 a INNER JOIN allWorkers_60 b
ON a.workdayID = b.workdayID

This section provides a complete list of the OAuth properties you can configure in the connection string for this provider.

Set this property to initiate the process to obtain or refresh the OAuth access token when you connect.

Remarks

The following options are available:

1. OFF: Indicates that the OAuth flow will be handled entirely by the user. An OAuthAccessToken will be required to authenticate.
2. GETANDREFRESH: Indicates that the entire OAuth Flow will be handled by the Sync App. If no token currently exists, it will be obtained by prompting the user via the browser. If a token exists, it will be refreshed when applicable.
3. REFRESH: Indicates that the Sync App will only handle refreshing the OAuthAccessToken. The user will never be prompted by the Sync App to authenticate via the browser. The user must handle obtaining the OAuthAccessToken and OAuthRefreshToken initially.

The client Id assigned when you register your application with an OAuth authorization server.

Remarks

As part of registering an OAuth application, you will receive the OAuthClientId value, sometimes also called a consumer key, and a client secret, the OAuthClientSecret.

The client secret assigned when you register your application with an OAuth authorization server.

Remarks

As part of registering an OAuth application, you will receive the OAuthClientId, also called a consumer key. You will also receive a client secret, also called a consumer secret. Set the client secret in the OAuthClientSecret property.

The OAuth refresh token for the corresponding OAuth access token.

Remarks

The OAuthRefreshToken property is used to refresh the OAuthAccessToken when using OAuth authentication.

The lifetime in seconds of the OAuth AccessToken.

Remarks

Pair with OAuthTokenTimestamp to determine when the AccessToken will expire.

The Unix epoch timestamp in milliseconds when the current Access Token was created.

Remarks

Pair with OAuthExpiresIn to determine when the AccessToken will expire.

This section provides a complete list of the JWT OAuth properties you can configure in the connection string for this provider.

The JWT Certificate store.

Remarks

The name of the certificate store for the client certificate.

The OAuthJWTCertType field specifies the type of the certificate store specified by OAuthJWTCert. If the store is password protected, specify the password in OAuthJWTCertPassword.

OAuthJWTCert is used in conjunction with the OAuthJWTCertSubject field in order to specify client certificates. If OAuthJWTCert has a value, and OAuthJWTCertSubject is set, a search for a certificate is initiated. Please refer to the OAuthJWTCertSubject field for details.

Designations of certificate stores are platform-dependent.

The following are designations of the most common User and Machine certificate stores in Windows:

In Java, the certificate store normally is a file containing certificates and optional private keys.

When the certificate store type is PFXFile, this property must be set to the name of the file. When the type is PFXBlob, the property must be set to the binary contents of a PFX file (i.e. PKCS12 certificate store).

The type of key store containing the JWT Certificate.

Remarks

This property can take one of the following values:

The password for the OAuth JWT certificate.

Remarks

If the certificate store is of a type that requires a password, this property is used to specify that password in order to open the certificate store.

The subject of the OAuth JWT certificate.

Remarks

When loading a certificate the subject is used to locate the certificate in the store.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks the first certificate in the certificate store.

The certificate subject is a comma separated list of distinguished name fields and values. For instance "CN=www.server.com, OU=test, C=US, [email protected]". Common fields and their meanings are displayed below.

If a field value contains a comma it must be quoted.

The issuer of the Java Web Token.

Remarks

The issuer of the Java Web Token. This is typically either the Client Id or Email Address of the OAuth Application.

The user subject for which the application is requesting delegated access.

Remarks

The user subject for which the application is requesting delegated access. Typically, the user account name or email address.

This section provides a complete list of the SSL properties you can configure in the connection string for this provider.

The certificate to be accepted from the server when connecting using TLS/SSL.

Remarks

If using a TLS/SSL connection, this property can be used to specify the TLS/SSL certificate to be accepted from the server. Any other certificate that is not trusted by the machine is rejected.

This property can take the following forms:

If not specified, any certificate trusted by the machine is accepted.

Use '*' to signify to accept all certificates. Note that this is not recommended due to security concerns.

This section provides a complete list of the Firewall properties you can configure in the connection string for this provider.

The protocol used by a proxy-based firewall.

Remarks

This property specifies the protocol that the Sync App will use to tunnel traffic through the FirewallServer proxy. Note that by default, the Sync App connects to the system proxy; to disable this behavior and connect to one of the following proxy types, set ProxyAutoDetect to false.

To connect to HTTP proxies, use ProxyServer and ProxyPort. To authenticate to HTTP proxies, use ProxyAuthScheme, ProxyUser, and ProxyPassword.

The name or IP address of a proxy-based firewall.

Remarks

This property specifies the IP address, DNS name, or host name of a proxy allowing traversal of a firewall. The protocol is specified by FirewallType: Use FirewallServer with this property to connect through SOCKS or do tunneling. Use ProxyServer to connect to an HTTP proxy.

Note that the Sync App uses the system proxy by default. To use a different proxy, set ProxyAutoDetect to false.

The TCP port for a proxy-based firewall.

Remarks

This specifies the TCP port for a proxy allowing traversal of a firewall. Use FirewallServer to specify the name or IP address. Specify the protocol with FirewallType.

The user name to use to authenticate with a proxy-based firewall.

Remarks

The FirewallUser and FirewallPassword properties are used to authenticate against the proxy specified in FirewallServer and FirewallPort, following the authentication method specified in FirewallType.

A password used to authenticate to a proxy-based firewall.

Remarks

This property is passed to the proxy specified by FirewallServer and FirewallPort, following the authentication method specified by FirewallType.

This section provides a complete list of the Proxy properties you can configure in the connection string for this provider.

This indicates whether to use the system proxy settings or not. This takes precedence over other proxy settings, so you'll need to set ProxyAutoDetect to FALSE in order use custom proxy settings.

Remarks

This takes precedence over other proxy settings, so you'll need to set ProxyAutoDetect to FALSE in order use custom proxy settings.

To connect to an HTTP proxy, see ProxyServer. For other proxies, such as SOCKS or tunneling, see FirewallType.

The hostname or IP address of a proxy to route HTTP traffic through.

Remarks

The hostname or IP address of a proxy to route HTTP traffic through. The Sync App can use the HTTP, Windows (NTLM), or Kerberos authentication types to authenticate to an HTTP proxy.

If you need to connect through a SOCKS proxy or tunnel the connection, see FirewallType.

By default, the Sync App uses the system proxy. If you need to use another proxy, set ProxyAutoDetect to false.

The TCP port the ProxyServer proxy is running on.

Remarks

The port the HTTP proxy is running on that you want to redirect HTTP traffic through. Specify the HTTP proxy in ProxyServer. For other proxy types, see FirewallType.

The authentication type to use to authenticate to the ProxyServer proxy.

Remarks

This value specifies the authentication type to use to authenticate to the HTTP proxy specified by ProxyServer and ProxyPort.

Note that the Sync App will use the system proxy settings by default, without further configuration needed; if you want to connect to another proxy, you will need to set ProxyAutoDetect to false, in addition to ProxyServer and ProxyPort. To authenticate, set ProxyAuthScheme and set ProxyUser and ProxyPassword, if needed.

The authentication type can be one of the following:

• BASIC: The Sync App performs HTTP BASIC authentication.
• DIGEST: The Sync App performs HTTP DIGEST authentication.
• NEGOTIATE: The Sync App retrieves an NTLM or Kerberos token based on the applicable protocol for authentication.
• PROPRIETARY: The Sync App does not generate an NTLM or Kerberos token. You must supply this token in the Authorization header of the HTTP request.

If you need to use another authentication type, such as SOCKS 5 authentication, see FirewallType.

A user name to be used to authenticate to the ProxyServer proxy.

Remarks

The ProxyUser and ProxyPassword options are used to connect and authenticate against the HTTP proxy specified in ProxyServer.

You can select one of the available authentication types in ProxyAuthScheme. If you are using HTTP authentication, set this to the user name of a user recognized by the HTTP proxy. If you are using Windows or Kerberos authentication, set this property to a user name in one of the following formats:

user@domain
domain\user

A password to be used to authenticate to the ProxyServer proxy.

Remarks

This property is used to authenticate to an HTTP proxy server that supports NTLM (Windows), Kerberos, or HTTP authentication. To specify the HTTP proxy, you can set ProxyServer and ProxyPort. To specify the authentication type, set ProxyAuthScheme.

If you are using HTTP authentication, additionally set ProxyUser and ProxyPassword to HTTP proxy.

If you are using NTLM authentication, set ProxyUser and ProxyPassword to your Windows password. You may also need these to complete Kerberos authentication.

For SOCKS 5 authentication or tunneling, see FirewallType.

By default, the Sync App uses the system proxy. If you want to connect to another proxy, set ProxyAutoDetect to false.

The SSL type to use when connecting to the ProxyServer proxy.

Remarks

This property determines when to use SSL for the connection to an HTTP proxy specified by ProxyServer. This value can be AUTO, ALWAYS, NEVER, or TUNNEL. The applicable values are the following:

A semicolon separated list of destination hostnames or IPs that are exempt from connecting through the ProxyServer .

Remarks

The ProxyServer is used for all addresses, except for addresses defined in this property. Use semicolons to separate entries.

Note that the Sync App uses the system proxy settings by default, without further configuration needed; if you want to explicitly configure proxy exceptions for this connection, you need to set ProxyAutoDetect = false, and configure ProxyServer and ProxyPort. To authenticate, set ProxyAuthScheme and set ProxyUser and ProxyPassword, if needed.

This section provides a complete list of the Logging properties you can configure in the connection string for this provider.

Core modules to be included in the log file.

Remarks

Only the modules specified (separated by ';') will be included in the log file. By default all modules are included.

See the Logging page for an overview.

This section provides a complete list of the Schema properties you can configure in the connection string for this provider.

A path to the directory that contains the schema files defining tables, views, and stored procedures.

Remarks

The path to a directory which contains the schema files for the Sync App (.rsd files for tables and views, .rsb files for stored procedures). The folder location can be a relative path from the location of the executable. The Location property is only needed if you want to customize definitions (for example, change a column name, ignore a column, and so on) or extend the data model with new tables, views, or stored procedures.

Note: Given that this Sync App supports multiple schemas, the structure for Workday custom schema files is as follows:

• Each schema is given a folder corresponding to that schema name.
• These schema folders are contained in a parent folder.
• The parent folder should be set as the Location, not an individual schema's folder.

If left unspecified, the default location is "%APPDATA%\\CData\\Workday Data Provider\\Schema" with %APPDATA% being set to the user's configuration directory:

This property restricts the schemas reported to a subset of the available schemas. For example, BrowsableSchemas=SchemaA,SchemaB,SchemaC.

Remarks

Listing the schemas from databases can be expensive. Providing a list of schemas in the connection string improves the performance.

This property restricts the tables reported to a subset of the available tables. For example, Tables=TableA,TableB,TableC.

Remarks

Listing the tables from some databases can be expensive. Providing a list of tables in the connection string improves the performance of the Sync App.

This property can also be used as an alternative to automatically listing views if you already know which ones you want to work with and there would otherwise be too many to work with.

Specify the tables you want in a comma-separated list. Each table should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Tables=TableA,[TableB/WithSlash],WithCatalog.WithSchema.`TableC With Space`.

Note that when connecting to a data source with multiple schemas or catalogs, you will need to provide the fully qualified name of the table in this property, as in the last example here, to avoid ambiguity between tables that exist in multiple catalogs or schemas.

Restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC.

Remarks

Listing the views from some databases can be expensive. Providing a list of views in the connection string improves the performance of the Sync App.

This property can also be used as an alternative to automatically listing views if you already know which ones you want to work with and there would otherwise be too many to work with.

Specify the views you want in a comma-separated list. Each view should be a valid SQL identifier with any special characters escaped using square brackets, double-quotes or backticks. For example, Views=ViewA,[ViewB/WithSlash],WithCatalog.WithSchema.`ViewC With Space`.

Note that when connecting to a data source with multiple schemas or catalogs, you will need to provide the fully qualified name of the table in this property, as in the last example here, to avoid ambiguity between tables that exist in multiple catalogs or schemas.

This section provides a complete list of the Miscellaneous properties you can configure in the connection string for this provider.

The complete url to the API endpoint to use for making SOAP requests.

Remarks

Instead of entering the Tenant, Service, and Host individually, the complete API URL may be specified in the following format. For example:

https://<host>.workday.com/ccx/service/<tenant>/<Service>

For example, a complete API URL might appear as:

https://wd3-impl-services1.workday.com/ccx/service/mytenant/Human_Resources

Alternatively, the Service may be left out, which will enable all services enabled via the Service property. For example:

https://wd3-impl-services1.workday.com/ccx/service/mytenant

Determines whether the provider restricts queries to returning only 1 million rows.

Remarks

By default the Sync App will add a LIMIT 1000000 to any WQL query it executes. This prevents Workday from raising an error if the query would return too many values.

If you disable this option, the Sync App will not add the LIMIT clause. Any queries that would return more rows than the Workday row limit will instead raise an error.

Whether to expand multiple ID types when they appear in reports. Only has an effect for queries using the Reports as a Service (RaaS) API.

Remarks

Every Workday entity is identified by a WID (a GUID generated by Workday) but some types of entities have other types of identifiers. For example, a Workday country record for the United States would be identified using the "US" country code in addition to its WID.

By default the Sync App collects all these IDs under one column and produce an aggregate. This is the value of the Country_Reference.ID column for the US record:

<wd:Country_Reference>
    <wd:ID type="WID">abcdef1234567890</wd:ID>
    <wd:ID type="Country_Code">US</wd:ID>
</wd:Country_Reference>

If this option is enabled, the Sync App instead produces a separate column for each ID type. For the US record:

• The column Country_Reference.ID.WID is set to abcdef1234567890
• The column Country_Reference.ID.Country_Code is set to US

The maximum number of output rows that may be expanded from a single input row.

Remarks

When using ExpandMultiValues, the Sync App can generate multiple output rows for each input row from Workday. Each multi-value column included in the query increases the number of output rows exponentially. For example, if a table has five array columns and has one row has three values for each, then rows are generated in this pattern:

Realistic queries can output thousands of rows which can be expanded into hundreds of thousands of output rows. Generating these rows reduces the Sync App's performance and can potentially cause the Sync App to run out of memory.

To avoid this, the Sync App counts the number of output rows before actually generating them. If any input row would generate more rows than the ExpandMultiValueLimit, the Sync App reports an error instead. When this happens you should carefully evaluate the query and remove any array columns that are not required. Only increase this limit if there is no way to simplify your query.

Determines if multi-instance fields are expanded into separate rows.

Remarks

The behavior of this option depends upon the service you are connecting to. Please refer to the WQL section for an overview, as the reporting and SOAP sections only cover details specific to those services. Also refer to ExpandMultiValueLimit to understand the performance consequences of enabling this option.

WQL

WQL uses multi-value fields to reference multiple rows from another table, such one journal entry referencing multiple journal line items. By default the Sync App displays these as JSON aggregates which must be parsed to get individual values.

Enabling this option expands each of these multi-value references across multiple rows. The Sync App separates out each aggregate into an ID column and a descriptor column (the same as single-value ID fields). It also generates a new field called workdayIDIndex that counts the number of rows expanded from one WQL row. The workdayID and workdayIDIndex form a composite primary key, instead of the workdayID being the primary key on its own.

The Sync App only expands rows that are included in the SELECT clause of the query. If more than one multi-value reference is selected, its values are combined with the other multi-value fields using a CROSS JOIN. This ensures that all combinations are included in the output so they can be used in WHERE or JOIN conditions.

Reporting

The reporting API behaves similarly to the WQL API, with two main differences. The first is that two extra columns are added instead of just one. One is called RowIndex and it behaves the same as workdayIDIndex. The other is called RowNumber and it counts the number of original rows from the report. It is included because reports do not have a built-in primary key like WQL data sources do.

The second is that reporting supports the ExpandIDTypes option. By default single-value IDs are treated as multi-value fields and expanded in the same way. This is because even single-value references can have a separate value for each type of ID. If ExpandIDTypes is enabled then each type of ID gets its own column and only multi-value references are expanded across rows.

SOAP

The SOAP API exposes a more complex data model with different types of repeated values:

1. Mutli-value references that are similar to WQL and reporting multi-value references.
2. Basic multi-value fields like Address_Line_Data in the Workers_Address_Data table.
3. Complex multi-value structures that contain multiple fields.

This property only applies to the first two types because complex repeated structures are always exposed as child tables. The other two types behave similarly to WQL and reporting APIs with a few exceptions:

• Multi-value references have only an ID. No descriptor is included.
• If the table normally has a primary key, the Sync App adds only an IDIndex column that behaves like workdayIDIndex. Otherwise the Sync App adds a row counter called RowID in addition to the IDIndex column.

Limits the number of rows returned rows when no aggregation or group by is used in the query. This helps avoid performance issues at design time.

Remarks

Limits the number of rows returned rows when no aggregation or group by is used in the query. This helps avoid performance issues at design time.

Specifies what types of fields are ignored by the provider.

Remarks

Several types of fields in Workday are slow to read or are common sources of query errors. Excluding these fields at the Sync App level allows for faster and more reliable queries without explicitly excluding these columns for every query. If a field is included in this property, it does not show up in table metadata and it cannot be used in queries.

This property can be set to a comma-separated list containing any combination of the following field types. For example, Calculated,MultiInstance will exclude both calculated and multi-instance fields.

• Calculated Calculated fields require additional processing in Workday that can slows down queries. These fields typically start with a "cf_" prefix.
• MultiInstance Multi-instance fields are lists of IDs which refer to other Workday records. These lists can be large, which leads to slower queries because Workday must collect and format the entire list before returning it.
• Undefined Undefined fields are listed as being part of a WQL data source, but don't have a separate field definition. This can lead to errors when querying them because Workday cannot find their metadata.

These hidden properties are used only in specific use cases.

Remarks

The properties listed below are available for specific use cases. Normal driver use cases and functionality should not require these properties.

Specify multiple properties in a semicolon-separated list.

Integration and Formatting

The maximum number of results to return per page from Workday.

Remarks

The Pagesize property affects the maximum number of results to return per page from Workday. Setting a higher value may result in better performance at the cost of additional memory allocated per page consumed.

This property indicates whether or not to include pseudo columns as columns to the table.

Remarks

This setting is particularly helpful in Entity Framework, which does not allow you to set a value for a pseudo column unless it is a table column. The value of this connection setting is of the format "Table1=Column1, Table1=Column2, Table2=Column3". You can use the "*" character to include all tables and all columns; for example, "*=*".

The value in seconds until the timeout error is thrown, canceling the operation.

Remarks

If Timeout = 0, operations do not time out. The operations run until they complete successfully or until they encounter an error condition.

If Timeout expires and the operation is not yet complete, the Sync App throws an exception.

A filepath pointing to the JSON configuration file containing your custom views.

Remarks

User Defined Views are defined in a JSON-formatted configuration file called UserDefinedViews.json. The Sync App automatically detects the views specified in this file.

You can also have multiple view definitions and control them using the UserDefinedViews connection property. When you use this property, only the specified views are seen by the Sync App.

This User Defined View configuration file is formatted as follows:

• Each root element defines the name of a view.
• Each root element contains a child element, called query, which contains the custom SQL query for the view.

For example:

{
	"MyView": {
		"query": "SELECT * FROM [CData].[Human_Resources].Workers WHERE MyColumn = 'value'"
	},
	"MyView2": {
		"query": "SELECT * FROM MyTable WHERE Id IN (1,2,3)"
	}
}

"UserDefinedViews", "C:\\Users\\yourusername\\Desktop\\tmp\\UserDefinedViews.json"

The URL to the WSDL. Only avaialble for the SOAP API.

Remarks

As an alternative to entering Service and WSDLVersion, the WSDL URL may be entered directly. For example:

https://community.workday.com/sites/default/files/file-hosting/productionapi/Human_Resources/v34.1/Human_Resources.wsdl

The version of the WSDL to use. Only available for the SOAP API.

Remarks

The WSDL Version for Workday changes often. If you would like to use the latest version, the version may be set to a higher value here to match the latest release. Alternatively, set the WSDLURL directly and this property will be ignored.