Getting started

What wdops is

wdops moves data between Workday and Snowflake through Workday's own public web services. It is a Snowflake Native App: it installs into your Snowflake account from the Marketplace, keeps its tables in its own schema there, and reaches exactly one outside system, your Workday tenant. Four things happen in it:

• Extract. Any Workday operation into Snowflake tables with history, on a schedule or on demand, with ready-to-query views.
• Submit. Records from Snowflake tables, uploaded files or files dropped on the app's inbox into Workday, checked first, each answered with its new Workday ID or with the field to fix.
• Correct. The owner of a rejected record fixes it in the app or in a spreadsheet and submits it again. The original is superseded and linked.
• Reconcile. Every submitted record is confirmed against the extract by Workday ID, and every line by position.

The app carries every public Workday SOAP web service, 54 of them with 3,239 operations, grouped by the business object each one serves. You switch on the web services your tenant uses, then the business objects. Nothing is loaded until it is switched on.

What you need

• A Snowflake account where you can install a Marketplace app and let it run its own serverless tasks.
• A Workday tenant and an Integration System User (ISU) in an Integration System Security Group. The app lists exactly what that group must be allowed to do per operation, and tests each one without creating anything. See Workday setup and credentials.
• The web services hostname of your tenant, such as wd2-impl-services1.workday.com, and the tenant name.

Make the Workday grants in your sandbox tenant first and prove them with the app's Test. Object Transporter carries security policy changes to production, and a tenant refresh copies them back, so they are made once.

Install

1. Install the app from the Snowflake Marketplace and grant the privilege it asks for: executing its own serverless tasks. That is how the app runs extracts and submits without holding a warehouse.
2. Bind the two references when Snowsight prompts. The first is network access to your Workday host: a network rule and an external access integration. The second is a secret holding the integration user's credentials as JSON. The app tells Snowsight how to create both, and Admin's Connection tab can request them again later.
3. Open the app. On Admin, set the Workday host and tenant, then run the connection test.
4. Switch on a business object. On Operations, pick a web service, find a business object and tick it on. Its tables and views are created, the submit is paired with the extract that verifies it, and the Setup tab lists what your Workday administrator must grant. Press Test setup until every part is authorized.
5. Resume the heartbeat on Admin. From then on, scheduled extracts run, dropped files are picked up, and staged rows are batched and submitted.

The secret

With basic authentication, the default, the secret holds the integration user's name and password. The name is stored bare; the app appends the tenant.

{"default": {"username": "ISU_wdops", "password": "..."}}

With OAuth, it holds the credentials of an API client registered in your tenant for integrations, with the web service scopes the operations need.

{"oauth": {"client_id": "...", "client_secret": "...", "refresh_token": "..."}}

Keep the default entry beside oauth if large batches should go through Workday's bulk import: the import process signs in again as the integration user, which a bearer token cannot do. Without it, every batch goes one record at a time.

The first business object

Journals is a good first object: it has lines, a balancing rule and a clear round trip.

1. On Operations, choose Financial Management and tick Journals on. The app creates the IN_JOURNAL_* extract tables, the OUT_JOURNAL_* staging tables and the V_JOURNAL_* views, and pairs Submit Accounting Journal with Get Journals.
2. Open the Setup tab and hand the steps to your Workday administrator. Press Test setup until both parts say authorized.
3. On Upload, pick Journals, download the template, fill in a journal or two and upload the file. The batch is checked at once and opens in History.
4. Press Submit. Each record comes back with its Workday ID, or with the message and the cell to fix.
5. Run the extract from the Operation page. Reconcile shows every submitted journal confirmed by its Workday ID, and every line matched to what Workday holds.

Who sees what

The app has two application roles. The admin role owns the tables, sees every page and can grant on the schema. The user role reaches data only through the app and the inbox stage, and sees two pages: Upload and History. Within the app, entitlements say which companies or agencies a user may submit for and see. See Security and data handling.

Where to next

• The app, page by page for what each page is for.
• Getting records into Workday for the three ways to feed a submit.
• Operating guide for the heartbeat, compute and day-to-day care.