Workday Financial Management

Workday Financial Management is Workday's cloud finance suite, covering accounting, procurement, expenses and spend management. With Weld you can sync your Workday journals and ledgers, supplier invoices and payments, customer invoices and contracts, purchasing, revenue recognition, inventory and reference data into your data warehouse. Combine it with your CRM, budgeting and operational data to report on the general ledger, payables and receivables, committed spend, billing and revenue, and stock movements.

Features

Data Schema

Setup Guide - ELT

How Workday access works

Weld signs in to Workday as an integration system user (ISU), an account that is not tied to a person. The ISU gets its access from a security group, and the group can only read data in the domains you give it Get access to. A domain is Workday's unit of security: all supplier invoice data, for example, sits behind one domain. Workday ignores permission changes until you activate them.

Weld can sign in as the ISU with an OAuth API client (recommended) or with the ISU's user name and password. Decide before you start, because Step 1 depends on it. Step 5 compares the two.

Step 1 - Create an integration system user

1. Sign in to Workday as a security administrator.
2. Search for the task Create Integration System User and run it.
3. Enter a User Name, for example ISU_Weld, and a strong Password, and note both down.
4. Clear Require New Password at Next Sign In. The ISU never signs in to Workday's screens, so it could never change the password.
5. Do Not Allow UI Sessions: leave it unticked for OAuth, which needs it. Tick it only if you will connect with the user name and password.
6. Click OK, then Done.

Step 2 - Create a security group for the user

1. Search for the task Create Security Group and run it.
2. In Type of Tenanted Security Group, choose Integration System Security Group (Unconstrained).
3. Give the group a Name, for example ISSG_Weld, and click OK.
4. In Integration System Users, add the ISU from Step 1.
5. Click OK, then Done.

Step 3 - Give the group Get access to the domains you need

This is the step most setups get wrong. The group needs Get access to the domains behind every table you plan to sync, or those tables fail.

Make a list of the domains you need

For the most common reports, grant these domains:

• General ledger (journal_entry, journal_source, ledger, account_set, company, cost_center, custom_worktag):
  • Process: Journals (NEW)
  • Set Up: Financial Accounting
  • Set Up: Company
  • Set Up: Accounts
  • Create: Cost Center
  • Set Up: Worktags
• Accounts payable (supplier, supplier_invoice, supplier_invoice_adjustment, payment, payment_term, payment_type):
  • Reports: Supplier
  • Process: Supplier Invoice - View
  • Process: Settlement
  • Process: Supplier Invoice Payment/Settlement, plus the settlement domain of any other payment type you pay out, such as expense reports
  • Set Up: Settlement
  • Set Up: Supplier Accounts
• Accounts receivable (customer, customer_invoice, customer_invoice_adjustment, customer_payment):
  • Reports: Customer
  • Process: Customer Invoice - View
  • Process: Customer Invoice Payment

For any other table, the Table Reference names the domains to grant. To sync every table, grant all the domains it lists.

Grant Get access

1. Search for the task Maintain Permissions for Security Group and run it. Some tenants still call it Maintain Domain Permissions for Security Group.
2. Leave Operation on Maintain, select your group, for example ISSG_Weld, in Source Security Group, and click OK.
3. On the Domain Security Policy Permissions tab, add one row per domain on your list: click + at the top of the table, set View/Modify Access to Get Only, and pick the domain in Domain Security Policy. Weld never writes to Workday, and the View options only apply to people using Workday's screens. Some domains are named after tasks, such as Create: Cost Center, because they are the only domains that secure that data; with Get Only, Weld can read through them but cannot create or change anything.
4. Click OK, then Done.

If a domain on your list is not offered, see If a table fails to sync.

Step 4 - Activate the security changes

1. Search for the task Activate Pending Security Policy Changes and run it.
2. Enter a Description for Change, for example Weld integration access, and click OK.
3. Review the list of changes, tick Confirm and click OK.

Activate again whenever you add or remove domains later.

To check the result, run the report View Security Group for your group. The Domain Security Policy Permissions tab lists the domains the group can read and their functional areas, which you need for OAuth in Step 5.

Step 5 - Choose how Weld signs in

Option A - OAuth (API client for integrations), recommended

Register the API client

1. Search for the task Register API Client for Integrations and run it.
2. Enter a Client Name, for example Weld.
3. Tick Non-Expiring Refresh Tokens. Otherwise the token expires and the connection stops syncing until you generate a new one.
4. Under Scope (Functional Areas), add every functional area that the View Security Group report in Step 4 lists for your group. Weld cannot read a domain whose functional area is missing here, even with Get access.
5. Leave Include Workday Owned Scope unchecked.
6. Click OK.
7. Copy the Client ID and Client Secret from the confirmation page. The client secret is only shown once.

Generate a refresh token for the ISU

1. Search for the task View API Clients and open the API Clients for Integrations tab.
2. Find the client you just registered and open its related actions (the … button).
3. Choose API Client → Manage Refresh Tokens for Integrations.
4. In Workday Account, select the ISU from Step 1 (for example ISU_Weld) and click OK.
5. Tick Generate New Refresh Token and click OK.
6. Copy the Refresh Token from the confirmation page.

Option B - Integration system user and password

No further Workday setup is needed. In Weld you enter the ISU's user name, without an @tenant suffix, and password.

Step 6 - Find your hostname and tenant

Both values come from your Workday Web Services URL, which has the form:

https:///ccx/service//...

• Hostname is the services host, for example wd2-impl-services1.workday.com or services1.wd103.myworkday.com. It always has a services part.
• Tenant is the path segment right after /ccx/service/, for example acme_preview or acme.

Find the URL in either of these places:

• From View API Clients: run the task View API Clients. The Token Endpoint at the top of the page has the form https://<hostname>/ccx/oauth2/<tenant>/token, so you can read both values from it.
• From Public Web Services: run the report Public Web Services, open the related actions of any service (for example Human Resources), choose Web Service → View URLs, and click OK. Each URL has the form https://<hostname>/ccx/service/<tenant>/Human_Resources/....

Sandbox and production tenants have different values, so look them up in the tenant you want to sync.

Step 7 - Create the connection

1. In the Weld app, click Data Sources in the sidebar, then Add Data Source.
2. Search for Workday Financial Management, select it and choose Create new connection.
3. Give the connection a Name.
4. Pick the authentication method you chose in Step 5:
   • OAuth (API client for integrations): enter Hostname, Tenant, Client ID, Client Secret and Refresh Token.
   • Integration system user and password: enter Hostname, Tenant, Username (without the @tenant suffix) and Password.
5. Click Connect to save the connection.

If the connection fails

If a table fails to sync

A successful connection only proves that Weld can sign in. A table that fails with The task submitted is not authorized is missing a domain, and the error names the Workday operation, for example Get_Journals.

1. Grant Get access to the domain the Table Reference lists for the table (Step 3) and activate the change (Step 4). With OAuth, also add the domain's functional area to the API client's scope (Step 5). Then sync the table again.
2. If the table still fails, or the domain is not offered when you grant access, your tenant secures the operation differently. Look up the domains it uses:
   1. Run the report View Security for Securable Item and enter the operation from the error.
   2. Click View Security on the row ending in (Web Service). The Domain Security tab lists the domains that secure the operation; Get access to any one of them is enough.
   3. Grant one of those domains and activate the change. With OAuth, also add its functional area, from the Functional Areas column, to the API client's scope. If the domain is not offered in Maintain Permissions for Security Group:
      • It is part of a larger domain. Some domains, such as Set Up: Journal Source, cannot be granted on their own. Run the report View Domain for the domain and grant its Super Domain instead, Set Up: Financial Accounting in this case.
      • Its functional area is disabled. Search for the task Maintain Functional Areas, enable the functional area, and search again.

Step 8 - Data To Sync

Select the tables you wish to include in the sync. You can view the schema, remove columns or hash sensitive information. Only select tables whose domains you gave the security group access to in Step 3.

85 tables are available, grouped below by area. Selecting a table also brings its child tables for line items and nested details, so journal_entry, for example, brings journal_entry_line with it. The Data Schema above shows them all.

• Accounting: account_set, audit_tag, headcount_plan, journal_entry, journal_source, ledger
• Payables: payment, payment_message, supplier_invoice, supplier_invoice_adjustment, supplier_invoice_assignment_rule, supplier_invoice_request, supplier_invoice_schedule, supplier_refund
• Receivables: consolidated_invoice, customer, customer_activity, customer_invoice, customer_invoice_adjustment, customer_payment
• Procurement: business_entity_contact, catalog_item, purchase_item, purchase_item_list, purchase_order, purchase_order_acknowledgement, purchase_order_schedule, receipt, receipt_adjustment, request_for_quote, request_for_quote_award, request_for_quote_response, requesting_entity, requisition, return, supplier, supplier_catalog, supplier_classification, supplier_contract, supplier_contract_amendment, supplier_contract_lease_amendment, supplier_item
• Revenue: alternate_customer_contract, billing_schedule, billing_schedule_template, customer_contract, customer_contract_amendment, customer_contract_discount_and_premium, customer_contract_renewal_term, customer_contract_template, customer_contract_type, customer_date_milestone, order_fulfillment_transaction, revenue_adjustment_reason, revenue_allocation_configuration, revenue_category, revenue_category_hierarchy, revenue_recognition_schedule, sales_item, sales_item_fair_value_price_list, sales_item_group, sales_item_price_list
• Inventory: goods_delivery_ticket, inventory_par_location, inventory_picking_list, inventory_return_order, inventory_shipment, inventory_stock_request, inventory_transaction, item_lot, manufacturer
• Reference data: commodity_code, commodity_code_type, company, cost_center, currency, currency_conversion_rate, currency_rate_type, custom_worktag, item_identifier_type, organization, payment_term, payment_type, resource_category, spend_category_hierarchy

Step 9 - Configure sync

1. Select how often you would like the data to sync.
2. Choose a start date. It applies to cost_center, journal_entry, organization, payment_message, purchase_item, purchase_order, receipt, resource_category, revenue_category and supplier: only their records updated on or after this date are included in the first sync. All other tables always load in full. Leave it empty to load the full history in your tenant.
3. Check the Destination schema name, which is where the tables land in your warehouse, and click Start Initial Sync.

SQL Templates

View all →

AR aging

Open customer invoices, bucketed by age as of today.

grain: one row per customer invoice with an amount due · builds on 2 models

General ledger

Every line of every posted journal entry, with its ledger account and the account's classification.

grain: journal entry x line index · builds on 5 models

Profit and loss by month

Income statement by month and ledger account, from posted journal lines.

grain: company x ledger x book code x account set x ledger account x month, Revenue and Expense accounts only, months with postings only · builds on 6 models

Trial balance

Month-end balance per ledger account, per company, ledger and book code, built from posted journal lines.

grain: company x ledger x book code x account set x ledger account x month, from the first month with a posting to the current month (or the last posted month, if later), so balances carry through months without activity · builds on 6 models