Workday
Connect Workday HRIS to Layer to sync employees, departments, managers, cost centers, and termination events for offboarding and headcount cost roll-ups.
The Workday integration pulls your full worker roster from Workday's REST API v1 and feeds it into Layer's People view. Each worker becomes a User asset with department, title, manager, cost center, hire date, and termination date. Active, on-leave, and terminated workers all sync — Layer maps Workday's worker state to Layer's user status so offboarding workflows fire the moment a termination is recorded in Workday.
What you'll need
- Workday Integration System User (ISU) or OAuth-enabled service account with read access to the Workers REST API.
- Your tenant's REST API base URL (e.g.
https://wd5-services1.workday.com/ccx/api/v1/{tenantAlias}). - A bearer token from Workday OAuth 2.0.
- Five minutes.
Set it up
Provision an integration system user in Workday
In Workday, create an Integration System User with read access to Workers and the Public Reports domain. Workday's documentation calls this the REST API access permission set. Assign the ISU a security group that scopes it to read-only.
Generate an OAuth bearer token
Workday issues short-lived OAuth 2.0 tokens. Use the client-credentials grant against your tenant's token endpoint, scoped to the ISU above. The resulting access_token is what Layer uses on each sync.
Layer does not orchestrate the token mint — paste the most recent token into the connect modal, and rotate it on your usual cadence.
Find your REST API base URL
Your tenant's base URL is in the format https://{cluster}.workday.com/ccx/api/v1/{tenantAlias}. Workday admins can find it under Setup → Integrations → REST API in the Workday UI.
Paste credentials into Layer
In Layer, go to Integrations, find Workday, click Connect, and paste:
- API Base URL — the full path including
/ccx/api/v1/{tenantAlias} - Access Token — the bearer token from step 2
Wait for the first sync
The initial sync paginates through /workers 100 records at a time. A 5,000-employee tenant typically completes in under five minutes.
What gets synced
| Field | Source | Notes |
|---|---|---|
| Employee name | descriptor | Full name as Workday renders it |
primaryWorkEmail / workEmail | Used as the canonical identity when present | |
| Department | primarySupervisoryOrganization.descriptor | Used in cost roll-ups |
| Title | primaryJob.businessTitle | |
| Location | primaryJob.location.descriptor | |
| Manager | primaryJob.manager (falling back to reportsTo) | Manager id, name, and email are captured from the manager reference |
| Management level | primaryJob.managementLevel.descriptor | |
| Cost center | primarySupervisoryOrganization.costCenter.descriptor | |
| Hire date | hireDate | |
| Termination date | terminationDate | Triggers offboarding when set |
Workers without a primary work email are still synced and identified by their Workday worker ID (workday:{workerId}).
Worker status mapping
Layer maps Workday's worker state to its own user status:
| Workday state | Layer status |
|---|---|
| Active | Active |
| On leave | Suspended |
| Terminated, retiree | Offboarded |
When a worker's status flips to Offboarded, Layer creates an offboarding task automatically if your org has any other Layer integrations (Microsoft 365, Google Workspace, Okta, etc.) connected — see offboarding for the full action plan.
Troubleshooting
Workday OAuth tokens are short-lived. Mint a fresh token using the client-credentials grant against your tenant's token endpoint and paste it into Layer. Layer does not refresh Workday tokens automatically — connect a token-refresh automation on your side, or rotate the token at the cadence Workday issues.
Confirm the ISU has read access to the Workers domain at the tenant level, not just to a specific supervisory organization. Layer paginates /workers with no filter, so missing rows usually indicate scoped security.
Workday exposes work email differently depending on the tenant's HR data model. Layer reads primaryWorkEmail, workEmail.emailAddress, and primaryEmailAddress in that order. If none are populated, the worker is still synced and identified by their Workday worker ID — pair Workday with Microsoft 365 or Google Workspace so the email surfaces from the IdP instead.
Atlassian (Jira & Confluence)
Connect an Atlassian Cloud site to Layer with one-click OAuth to collect Jira operational metadata and Confluence coverage evidence.
CrowdStrike Falcon
Connect CrowdStrike Falcon to Layer to inventory endpoint devices, detections, and prevention policies — and generate endpoint protection evidence for audits.