Connecting to Workday HCM

Edit online

Workday Human Capital Management (HCM) is a leading enterprise cloud application for managing human resources, payroll, talent acquisition, benefits, and workforce planning. Integrating Workday HCM with IBM watsonx Orchestrate enables seamless automation of HR operations, real-time data synchronization, and improved employee lifecycle management.

To integrate Workday HCM with watsonx Orchestrate, you must establish a secure connection that allows both systems to communicate. For more information on managing connections, refer to Managing connections.

Note:

The Single sign-on (SSO) toggle is enabled only for supported OAuth 2.0 authentication types and applications. If the application does not support an SSO-enabled authentication type, the toggle remains disabled. For supported configurations, see Configuring single sign-on for applications.

Steps to connect

Use the following steps to connect Workday HCM to watsonx Orchestrate:

Go to Manage > Connections and search for the corresponding Workday HCM Connection ID.
Click edit next to the matching connection ID.
Select the authentication method your organization uses: (OAuth 2.0 or Key Value Pair).
Enter the Workday HCM fields described in the corresponding authentication details section. See Connecting apps for prebuilt agents page for general connection workflow.
Complete the Draft and Live setup steps.
Save and test the connection to confirm successful configuration.

Authentication methods

Workday HCM supports the following authentication types in watsonx Orchestrate:

OAuth 2.0 (Authorization Code): Recommended for production connections
Key Value Pair (KVP): Supported for API key–based and legacy scenarios

Note:

For agents created after August 2025, OAuth 2.0 is the only supported authentication for Workday HCM.
When using Key Value Pair, only Team credentials are supported.

Connection ID

Use the following Connection IDs when locating your Workday HCM connection in the Connections settings page. To understand how to search for a Connection ID and open a connection for editing, see Connecting apps for prebuilt agents.


Workday integration type	Authentication type	Connection ID
Workday HCM OAuth2	OAuth2 Authorization Code	`workday_ibm_184bdbd3`
Workday HCM (Base)	Key Value Pair	`workday_base_key_value_ibm_184bdbd3` (deprecated)
Workday HCM Employee	Key Value Pair	`workday_employee_key_value_ibm_184bdbd3` (deprecated)
Workday HCM Manager	Key Value Pair	`workday_manager_key_value_ibm_184bdbd3` (deprecated)

OAuth 2.0 connection details

If your organization uses OAuth‑based authentication, set Authentication type to OAuth2 Authorization Code and enter the following fields:


Field	Description
`Server URL`	Base URL of the Workday server You can get the server URL from the `TOKEN URL` by copying the portion of the URL upto `/ccx` and adding `/<tenant_name>` at the end. The tenant name is the part of the `TOKEN URL` found between `/oauth2/` and `/token`. Example : `https://wd2-impl-services1.workday.com/ccx/ibmsrv_dpt1`
`Token URL`	Endpoint to exchange the authorization code for an access token
`Scope`	Defines what access is being requested (for example, read write profile)
`Authorization URL`	URL where users are redirected to log in and authorize access
`Client ID`	Unique ID for your application (available in Workday UI)
`Client Secret`	A secret key used to authenticate your app with Workday

To get these values, see the Workday API documentation.

Key Value Pair connection details (Workday HCM Base)

If your organization uses API keys or a legacy configuration, set Authentication type to Key Value Pair and add each of the following fields using Add new field:


Key	Description
`base_url`	The base URL of your Workday API instance
`token_url`	The URL used to obtain the OAuth token
`tenant_name`	Your Workday tenant identifier
`client_id`	The client ID of your Workday integration system
`client_secret`	The client secret to authenticate your Workday integration

Note: When using Key Value Pair, only Team credentials are supported.

To get these values, see the Workday API documentation.

Key Value Pair connection details (Workday HCM Employee)

If your organization uses API keys or a legacy configuration, set Authentication type to Key Value Pair and add each of the following fields using Add new field:


Key	Description
`bearer_token`	The access token used for API authentication
`refresh_token`	The token used to refresh the bearer token

To get these values, see the Workday API documentation.

Key Value Pair connection details (Workday HCM Manager)

If your organization uses API keys or a legacy configuration, set Authentication type to Key Value Pair and add each of the following fields using Add new field:


Key	Description
`bearer_token`	The access token used for API authentication
`refresh_token`	The token used to refresh the bearer token

To get these values, see the Workday API documentation.

What to do next

Now that your app connection is live, you can start using it in watsonx Orchestrate.

Run an agent in Orchestrate Chat to complete tasks using natural language. See Using Orchestrate Chat for more details.
Use relevant agents and tools to perform app-specific actions. See Prebuilt agents and Prebuilt tools for more details.