Workday

Capture Workday activity logs detailing records of user actions, system events, and data changes within the Workday platform.

RunReveal connects to the Workday Privacy API (/ccx/api/privacy/v1/{tenant}/activityLogging) using OAuth2 with a refresh token and polls for new activity logs every 5 minutes.

Prerequisites

Before connecting, you need four things from Workday:

Complete Steps 1–4 in Workday before connecting in RunReveal.

Step 1 — Enable tenant-level settings

1. Search for Edit Tenant Setup - System in Workday. Ensure Enable User Activity Logging is checked.
2. Search for Edit Tenant Setup - Security in Workday. Ensure OAuth 2.0 Clients Enabled is checked.

Step 2 — Create an Integration System User

RunReveal needs a dedicated service account (Integration System User) with permission to read the Activity Logging data.

1. Search for Create Integration System User in Workday.
2. Create a new user (for example, RunReveal_ISU). Set a password and uncheck Require New Password at Next Sign In.
3. Search for Maintain Password Rules and add the ISU to the System Users exempt from password expiration list.
4. Search for Create Security Group and create a new Integration System Security Group (Unconstrained) (for example, RunReveal Security Group).
5. Add your ISU to the new security group.
6. Search for Maintain Domain Security Policies and grant the security group Get access to the following domain:
   • System Auditing (under the Worker Data or Privacy category — search for Manage: Workday Account Activity Logs or System Auditing depending on your Workday version)
7. Search for Activate Pending Security Policy Changes and activate the changes.

Step 3 — Register an API Client

1. Search for Register API Client for Integrations in Workday.
2. Fill in:
   • Client Name: RunReveal (or any descriptive name)
   • Non-Expiring Refresh Tokens: check this box
   • Scope: add System (this covers the Privacy API used for activity logging)
3. Click OK. Workday displays the Client ID and Client Secret — copy both immediately. The secret is shown only once.

Step 4 — Generate a Refresh Token

1. Search for View API Clients in Workday and open the client you registered in Step 3.
2. Click the Related Actions icon → API Client → Manage Refresh Tokens for Integrations.
3. In the Workday Account field enter the ISU you created in Step 2.
4. Check Generate New Refresh Token and click OK.
5. Copy the refresh token — save it securely. It is only shown once.

Step 5 — Find your Host and Tenant

Your Host is the API hostname Workday uses for your tenant — it is different from your browser login URL and looks like wd5-impl-services1.workday.com.

To find the correct host and tenant:

1. Search for View API Clients in Workday and open the API Client you registered in Step 3.
2. Look at the Token Endpoint URL — it will be in the format https://{host}/ccx/oauth2/{tenant}/token.
3. Extract the hostname (for example wd5-impl-services1.workday.com) and tenant (for example mycompany) from that URL.

Step 6 — Connect in RunReveal

1. Go to Sources → Add Source and select Workday.
2. Give the source a name and fill in the fields:

3. Click Save. Logs begin appearing within a few minutes.

Verify It's Working

You can validate RunReveal is receiving your logs by running the following SQL query:

SELECT * FROM workday_logs LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Helpful Links

• Workday REST API documentation
• Workday Community
• Register API Clients for Integrations (Workday docs)
• Datadog Workday integration setup — a useful reference for the same Workday API steps