Platform access level: Org Admins
This guide is the technical reference for connecting Arist to Workday. It covers the connection end to end: how your worker data flows into Arist to create and target learners, how the daily sync runs, and how the courses and completions Arist generates flow back onto each worker's Workday record. It is written for the IT and Workday administrators who provision and secure the integration.
1. One connection, data flowing both ways
Arist connects directly to your Workday tenant over its web services, using SOAP and Report-as-a-Service (RaaS) alongside REST, authenticated with OAuth 2.0. Workday HCM is your HRIS system of record for workers and metadata, and Workday Learning holds your course catalog and completions. Two things move across the one connection.
Direction | What moves | Why |
Arist reads | Worker and HRIS metadata | Creates learners and triggers automations |
Arist writes | Course records | Gives completions something to tie back to |
Arist writes | Completions | Recorded as learning records on the worker |
The inbound worker sync is fully automated and runs once a day, provisioning learners in batches. The outbound completion writeback is on the roadmap, so section 6 flags what is live today and what is targeted for later.
2. Before you begin
Confirm the eight items below in the weeks before your setup session, not on the day itself. This integration touches four groups, and a security review can run on its own timeline, so line these people up early.
Workday tenant and integrations: Provisions the Integration System User and its security group, registers the API client, builds the RaaS report, and confirms tenant details.
HRIS and HCM: Owns worker data, and confirms which fields are populated, accurate, and how workers are identified.
L&D and Learning admin: Decides who enrolls and how status and terminations are handled, and grants Workday Learning write access.
IT and Security: Reviews the endpoints and applies any IP allow-listing. This is often the longest lead time, so loop them in first.
Item | What to confirm |
Integration System User created | A dedicated ISU for the integration to run as, with a non-expiring or rotation-managed password and a security group of its own. |
API client for integrations registered | An API Client for Integrations registered against the ISU. Capture the client secret and refresh token at creation, since the secret cannot be retrieved later. |
Tenant details confirmed | The Tenant ID, OAuth authorization and token endpoints, and the Workday Web Services version your tenant runs, for example v44.1. |
RaaS custom report built and exposed | The custom report that serves as Arist's worker feed, exposed as a web service under the ISU. Its |
HRIS metadata fields selected | Decide which worker fields Arist receives, and confirm they are populated and included as columns on the custom report, or covered by a domain granted to the ISU. |
Worker population and status decisions made | Decide who syncs and what happens when employment changes: types, status, and terminations. |
Write access to Workday Learning granted | If writeback is in scope, the ISU's security group holds the domain permissions to create learning content and record completions. |
Endpoints reviewed with security | Share the endpoint list in sections 5 and 6 with your security team, and apply any IP allow-listing your policy requires. |
3. Decisions to settle before mapping
These questions define who syncs to Arist and what happens when a worker's situation changes. They are the items most likely to surface mid-project if they are not decided up front, so bring answers, or the right people, to your first session.
Question | What to decide |
Which worker populations are in scope | Whether the custom report includes full-time only, or also part-time, seasonal, and contingent workers, and confirm its filters match. |
When new hires enter the feed, and whether they arrive complete | Decide at what point in onboarding a new hire is added to the report, and whether they arrive with a work email or are provisioned without one first. A worker sent before their email is populated cannot be reached and is filtered out until the email is added on a later sync, which delays when Arist can start training them. Confirm whether records are sent only once complete, or sent early and expected to become reachable later, and agree the acceptable lag. |
What happens when a worker changes employment type | Conversions often issue a new Worker ID in a different format, so decide which record wins and whether learning history follows the person. |
How active and inactive workers are handled | Map employment status as a synced field, and decide whether a worker on leave keeps receiving training, pauses, or deactivates. |
What happens at termination and rehire | How quickly messages stop, whether the learner record deactivates or is removed, and whether a rehire reuses the same Worker ID or a new one. |
Which email is authoritative | Workday email, Microsoft UPN, and contact email can differ, so name the system of record, the update lag, and which address reaches each worker. |
What other systems create or update users | If Teams or a device-management sync also provisions learners, list every source and the identifier each keys on so no one arrives twice. |
Whether legacy, shared, or generic emails exist | Acquired-company domains, regional domains, and shared mailboxes break one person to one email, so skim the report and decide how each is reconciled. |
How fresh the data must be | Agree a sync frequency that matches how fast your workforce changes. Daily is typical, so say so now if transitions must reflect within hours. |
Who is excluded | Executives, unions, specific countries, or workers without corporate email are easiest to handle as report filters, so name them now. |
4. Establishing the connection
Arist authenticates to your tenant using OAuth 2.0 against your Workday web services. No user passwords are stored. Arist exchanges a refresh token for a short-lived access token, presents it on every call, and refreshes it automatically.
It posts to the token endpoint at https://services1.myworkday.com/ccx/oauth2/<tenant>/token, which returns an access token valid for about 30 minutes. All traffic runs over TLS 1.2 or higher, and the credential is tied to a dedicated Integration System User scoped only to the services and domains this integration uses.
Your IT team provides the eight values below, generated and located inside your Workday tenant under the Register API Client for Integrations task and your tenant URL.
Field | What it is | Where to find it |
Tenant ID | Your Workday tenant identifier | In your Workday URL: |
WSDL URL | The endpoint Arist reads worker data from (your RaaS report) | The custom report's web-service URL with |
Client ID | The OAuth API client (application) identifier | Workday, View API Clients task |
Client Secret | The secret paired with the Client ID, shown once | The same Register API Client task, captured once at creation |
Refresh token | Long-lived token bound to the ISU | From authorizing the ISU under API Clients for Integrations |
Authorization endpoint | OAuth authorize URL for your tenant |
|
Token endpoint | OAuth token URL for your tenant |
|
Web services version | The Workday Web Services (WWS) version Arist calls | Current tenant version, for example v44.1 |
Important: Create a dedicated ISU, then register an API Client for Integrations against it, and capture the client secret and refresh token at creation, because the secret cannot be retrieved later. The connection type is Cloud unless you use an on-prem agent.
5. HRIS endpoints Arist reads
Arist reads worker records and their HRIS metadata from your tenant, primarily through a Custom Report-as-a-Service (RaaS) you expose. You define the report's columns, and Arist reads them as the worker fields.
Purpose | Endpoint |
Worker feed, RaaS custom report |
|
Worker records and HRIS metadata |
|
Resolve and validate a worker | Workday Query Language (WQL) or Staffing REST, by Employee ID |
The ?wsdl form of the same custom report is the connection's WSDL URL. Get_Workers supplements the report with manager, supervisory org, location, and job metadata, and WQL or Staffing REST resolves an individual worker by Employee ID when a targeted lookup is needed.
Decide which worker fields should reach Arist, since this metadata creates learners, segments audiences, and triggers automations. Commonly mapped fields are Employee ID (Worker ID), Email, Manager, Supervisory org, Cost center or Department, Company or Business unit, Job profile or Business title, Job code, Location, Country, Hire date, Worker type, Employment status, Preferred language or locale, and custom and calculated fields.
Important: Worker type and employment status drive the lifecycle decisions from section 3, so include them even if you do not target on them. Confirm each field is populated and included as a report column, or covered by a granted domain. A field that is not is not visible to Arist and cannot be used for targeting.
6. Learning endpoints Arist writes
Learning created in Arist is written back into Workday in two stages, first the course record and then each learner's completion against it, so the activity is captured on the worker's learning record. First, when a course is built in Arist, it is sent to Workday Learning as learning content for an administrator to make available in the catalog. A completion cannot be recorded against a course that has not been created. Second, as learners finish in Arist, each completion is posted to Workday Learning as a learning record and lands on the worker's learning record.
Stage | Endpoint |
Publish course content |
|
Import completions |
|
Poll import status (planned) |
|
When a course is built in Arist it is published to the Workday Learning catalog as learning content, so completions have a course to attach to. As learners finish, Arist collects the newly completed enrollments in pages of up to 500, and the integration layer imports them to Workday Learning through Import_Learning_Enrollment, an asynchronous bulk call that returns an Import_Process_Reference_WID. Each enrollment maps to Learning_Enrollment_Data.ID, the learner's external identifier maps to Learner_Reference, and a transient failure is retried twice. Workday validates and records the enrollments, and the import status is polled with Get_Import_Processes and Get_Import_Process_Messages, a step planned as part of this flow.
Note: The inbound worker sync in section 7 is the live production path today. The outbound completion writeback is on the roadmap and targeted for end of year, so treat this section as the target-state design rather than a live flow.
7. How the daily sync runs
The inbound worker sync is fully automated and runs once a day. It moves through three lanes: your Workday tenant, an integration layer that transforms and validates, and the Arist platform that provisions learners. A typical run processes 500 to 1,250 workers per batch.
Your Workday RaaS custom report is scheduled to run daily, for example at 3:15 AM Pacific, and the integration layer picks it up on a scheduled trigger.
A pre-flight validation guard filters out any record with a missing email or an unknown time zone before processing.
The batch is transformed: emails are normalized, an IANA time zone is derived, names are split, and an inactive employment status is mapped to an inactivation timestamp on the learner.
A failure gate stops the run on hard errors, tolerates a 404, and retries a transient failure twice.
Arist performs a bulk upsert that maps the worker and manager identifiers to learner records, and returns the successful and failed records for the run.
Note: If a run stops, Arist sends a failure alert to its integration support team with the flow name, the error, and the failing records. An optional per-customer job-results email can summarize each run as created, updated, inactivated, and failed counts.
8. Responsibilities and security
Your responsibilities during and after setup are the following.
Provide and maintain credentials: Supply the Tenant ID, WSDL URL, Client ID, Client Secret, Refresh token, and OAuth endpoints, and tell Arist before you rotate the secret or refresh token so the connection is not interrupted.
Grant write access to Learning: If writeback is in scope, scope the ISU's security group to create learning content and record completions, so course and completion records can post to the worker's learning record.
Select and populate HRIS metadata: Decide which worker fields Arist receives, and ensure they are filled in and exposed as report columns or granted domains.
Keep the integration account healthy: Maintain an active ISU with a non-expiring or rotation-managed password and refresh token, and apply any IP allow-listing your security policy requires.
Arist's security and data handling posture is deliberately narrow.
OAuth 2.0, no passwords: Access uses short-lived bearer tokens of about 30 minutes, and no end-user passwords are stored or transmitted.
Encrypted in transit: Every call between Arist and Workday runs over TLS 1.2 or higher.
Least privilege: The ISU is scoped only to the Workday web services and domains this integration needs.
Data minimization: Only the metadata fields you choose to expose are read, nothing beyond what is needed to run learning.
Related articles
HRIS Integration - Workday
LMS Integration - Workday
HRIS Data Preparation
Note: Need help at any point? Reach out to your Arist Customer Success contact, or email [email protected].