Scenario
You use Workday as your HRIS and want to load your employee data into PlusPlus by having PlusPlus fetch it directly from Workday on a recurring basis. Workday is supported natively by PlusPlus, using Workday's Report as a Service (RaaS) feature, and is configurable in System Settings without engineering work.
Solution
Workday integration setup is partially self-serve. You configure the connection from PlusPlus to Workday in System Settings, and PlusPlus support handles attribute mapping and validation.
Before you begin
Request a custom Report as a Service (RaaS) report from your Workday admins for this integration. They will provide:
A unique Workday RaaS URL for fetching all people
A username and password for Basic Authentication, or OAuth2 credentials (Token URL, Client ID, Client Secret, Refresh Token) if your organization doesn't allow Basic Auth
(Optional) A second Workday RaaS URL for fetching a single person, with a placeholder for the user identifier
Configure attribute mappings ahead of time by working with your CSM and reviewing People Integration: Attribute Mapping.
Configure the connection
Sign in to PlusPlus as a platform admin.
Go to System Settings > Integrations > Data Sources > Workday.
Fill in the required connection settings:
Workday URL (all people) — the RaaS URL provided by your Workday admins for fetching all people.
One of the two authentication methods (see Authentication options below).
Optionally, fill in the Workday URL (single person) to enable per-user syncs. See Enable per-user syncs below.
Toggle Enable Workday integration on.
Save your settings.
Notify your CSM or PlusPlus Support that the configuration is in place. They will validate the connection, finalize attribute mappings, and confirm the integration is working end-to-end.
Authentication options
Workday supports two authentication methods. Use whichever your Workday environment allows.
Basic Authentication
For Workday environments that allow Basic Auth:
Workday Username — the username for authenticating against Workday (required for Basic Auth).
Workday Password — the password for authenticating against Workday (required for Basic Auth).
OAuth2 Token Authentication
For Workday environments that have disabled Basic Auth:
Toggle Enable Workday Token-based Authentication on.
Fill in:
Workday Token URL — the URL contacted to get a new bearer token.
Workday Client ID — used to authenticate against Workday's token endpoint.
Workday Client Secret — used to authenticate against Workday's token endpoint.
Workday Refresh Token — used to request a bearer token.
Enable per-user syncs
Filling in the Workday URL (single person) enables admins to trigger an on-demand sync for an individual user from their profile in PlusPlus — useful for troubleshooting a specific user or applying recent Workday changes immediately without waiting for the next scheduled bulk sync.
The single-person URL is a Workday RaaS URL template containing a {} placeholder where PlusPlus substitutes the user's identifier (typically email). For example: https://wd.workday.com/...?Email={}.
The identifier substituted into the placeholder is determined by the User identifier (lookup) setting (typically the user's email).
Once configured, the per-user sync is triggered from a user's profile via the kebab menu (⋮) > Sync User Data. See PI Sync Logs Dashboard for details.
Map attributes
PlusPlus support handles attribute mapping during initial validation. For an overview of how mapping works, the JMESPath syntax used to extract values from your Workday payload, and how to test mapping changes, see People Integration: Attribute Mapping.
Validate the integration
Use the PI Sync Logs Dashboard to:
Run a dry sync before any configuration change goes live
Inspect the raw payload PlusPlus receives from Workday
Confirm attribute mappings are extracting the right values
Review per-user outcomes (created, updated, skipped, failed) to catch issues before they affect users
Go deeper
Connection settings reference
The following settings are exposed under System Settings > Integrations > Data Sources > Workday.
Setting | Description | Default |
Enable Workday integration | Master toggle for the integration | Off |
Workday URL (all people) | RaaS URL for fetching all people. Required. | — |
Workday URL (single person) | RaaS URL template for fetching a single person. Optional but required for per-user sync. | — |
User identifier (lookup) | Field used to identify a user in the single-person URL placeholder | — |
Workday Username | Username for Basic Authentication. Required for Basic Auth. | — |
Workday Password | Password for Basic Authentication. Required for Basic Auth. | — |
Enable Workday Token-based Authentication | Toggle for OAuth2 instead of Basic Auth | Off |
Workday Token URL | URL contacted to get a new bearer token. Required for token auth. | — |
Workday Client ID | Client ID for Workday's token endpoint. Required for token auth. | — |
Workday Client Secret | Client secret for Workday's token endpoint. Required for token auth. | — |
Workday Refresh Token | Refresh token used to request a bearer token. Required for token auth. | — |
Workday Connection Timeout | Maximum connection timeout (seconds) when contacting Workday | 30 |
Workday Read Timeout | Maximum read timeout (seconds) when receiving data from Workday | 60 |
Workday Max Retries | Maximum retry count when contacting Workday | 5 |
Workday Employee ID field name | Name of the Workday field containing Employee ID. Optional. | — |
When Workday isn't an option
If your organization restricts the creation of RaaS reports or the data they expose, the available alternatives are:
SCIM — for organizations that route provisioning through an SSO/identity provider rather than HRIS.
CSV over SFTP — fallback when no API option is feasible.