Where everything lives
wdops is a Snowflake Native App. It runs inside your Snowflake account, keeps every table in its own schema there, and reaches exactly one outside host: your Workday tenant's web services, through a network rule and an external access integration that you create and can inspect. Credentials sit in a Snowflake secret you own.
Nothing is sent to the vendor. There is no telemetry, no callback, no license check that leaves your account. Snowflake may report install and usage counts to the listing provider, with no customer data attached. The vendor has no access to your data, your credentials or your connection.
Application logs stay in your account, in your event table, at the level you choose.
What the app holds
- Extracted records, in tables and views, for as long as retention says.
- Staged records, what you fed a submit, in text columns, for as long as retention says.
- Results, one row per record per attempt: status, Workday ID, errors.
- Request and response XML, per record, redacted of credentials and of any columns you list under Admin, with its own shorter retention.
- Files dropped on the inbox stage and the result files written beside them.
- Settings, rules, entitlements and the catalog of operations.
Retention is per business object with a tenant-wide default; 0 keeps everything. The daily purge is recorded in History.
Roles
Two application roles come with the app.
The admin role owns the tables, sees every page, and can grant on the app's schema to the roles in your account that should query the extracts directly. Give it to the engineers who run the app.
The user role reaches data only through the app and the inbox stage, and sees two pages: Upload and History. Give it to the people and service users who put files and fix rejected records. They never see a table, a warehouse or a Workday credential.
Snowflake's own grants decide who may open the app at all. Nothing in the app bypasses them.
Scope and entitlements
Within the app, scope is the column that names the company or agency a record belongs to, usually a Company reference ID. A user may only submit records for the scopes they are entitled to, and only sees the batches and files in those scopes. A file dropped under a scope folder binds its whole batch to that scope, and a record inside it that names a different scope fails on that column before anything is sent. Administrators and users entitled to * see everything.
Entitlements are kept in the app and listed on Admin. They can be derived from Workday role assignments on a schedule, so the tenant stays the source of truth for who may act for which company.
In Workday
The app acts as one integration system user, in one security group, with the grants your administrator makes per operation and nothing more. The setup guide lists each one, and the Test on every operation creates nothing. See Workday setup and credentials.
Every request the app sends and every answer it gets is kept per record, so an auditor can see exactly what went to Workday for any record in History.
Compute
The app runs its work in serverless tasks: one heartbeat on a clock and one short-lived task per extract, submit, file load or sync, each dropping itself when done. Nothing holds a warehouse between runs. The pages use the session's warehouse while a browser tab is open, like any Streamlit app in Snowflake, so close the tab when done and keep a short auto-suspend on that warehouse.
Trademarks
Workday is a trademark of Workday, Inc. wdops is an independent product and is not affiliated with, endorsed by or sponsored by Workday. Snowflake is a trademark of Snowflake Inc.