Workday

Availability

Not self-serve yet

The connection service is built, but the admin console currently shows an Interested button instead of a connect form. Contact us to have it enabled for your organization. The Workday setup steps below follow Workday's standard integration-user pattern and have not yet been confirmed against a live customer tenant.

How an admin connects it

A customer-authorized connection: your Workday admin creates the access inside your own tenant and gives us the credentials. No partner status is needed on our side for you to grant read access.

Who can set it up: Your Workday administrator, then an organization admin in Mucho Gusto.

1. In Workday, create an Integration System User.
2. Add that user to an Integration System Security Group.
3. Grant the group read permission on worker data (names, titles, departments and work email; supervisory organization and manager if you want reporting lines available later).
4. Register an API Client for Integrations using the Client Credentials grant, tied to that integration user.
5. Give Mucho Gusto your Workday host, tenant name, client ID and client secret. We test them by requesting a token and reading a single worker, and save them only if that works.

Permissions requested

Grant read only. Our connection never writes to Workday.

Data we read

This is the least-mature directory integration. It uses Workday's REST worker listing only, and the field mapping has not yet been confirmed against a live customer tenant. If your tenant returns work email under a different field name, a sync can succeed while importing no members; the admin console would show zero people imported. Ask us to verify with you before relying on it.

How the data is used

• Seeds and refreshes your organization's org chart: job title, department and reporting line.
• Records hire and termination dates so tenure and new-hire cohorts in the Connection Score are accurate.
• Matches directory people to existing members by lowercased email address. A manager you have set by hand is never overwritten by a sync.
• A sync never deactivates a seat or deletes a member account. Someone who disappears from the directory is marked as terminated in the employment history only.

Sync frequency

Automatically once a day (04:00 UTC), plus on demand with the admin console's sync button.

Easier alternative

If your Workday already syncs people into Microsoft Entra ID or Google Workspace, you can skip the steps above and connect that directory instead, with a one-click OAuth button. You get names, job titles and reporting lines. You do not get hire or termination dates, which only an HRIS connection supplies, so tenure-based Belonging metrics would be limited.

REST today; SOAP and reports not used

v1 uses Workday's REST worker listing with a short-lived OAuth token. We do not call the SOAP Get_Workers operation and we do not use Report-as-a-Service (RaaS) reports. If a full-detail SOAP integration turns out to be needed for the fields above, that would be a separate piece of work and these pages would change first.

How we protect the connection

We validate the host you enter. It must resolve to a public address, and we refuse to connect to private or internal network addresses. The credentials are stored per organization behind the same tenant isolation as the rest of your data, and the secret is never returned by our API.

Disconnecting and purging data

How: Disconnect the Workday connection (admin console once enabled, or ask us). Also disable or delete the API client and integration user in Workday.

• Our stored Workday connection, including the client secret, is deleted.
• Nightly syncs for your organization stop.
• No refresh token is kept: a short-lived token is requested for each sync, so deleting the Workday API client ends our access immediately.

What remains: Disconnecting removes the stored connection only. Org-chart entries, titles, reporting lines and employment dates already imported stay in your organization's workspace, and member accounts are not deleted. To have previously synced data removed as well, email [email protected] and we will handle it case by case; there is no self-service purge today.