Flamekeeper

Flamekeeper documentation

Connect Workday

Prepare a least-privilege Workday report and OAuth client, connect it to Flamekeeper, and safely synchronize workers and upcoming departures.

Connect Workday to review workers and upcoming departures in Flamekeeper. HR and Admin users can synchronize a read-only directory, review completed termination events and contract-end warnings, add selected people, and create prefilled handover cases.

The private-beta setup uses a customer-owned Workday custom report enabled as Reports as a Service (RaaS), a dedicated Integration System User (ISU), and OAuth 2.0 credentials. Flamekeeper reads the approved report and never writes to Workday.

Before you begin

You need:

  • a Flamekeeper HR or Admin account;
  • a Workday administrator who can create reports, security groups, integration users, and API clients;
  • an Implementation or Sandbox tenant for initial validation;
  • approval to share the selected employee fields with Flamekeeper; and
  • Flamekeeper private-beta access for Workday.

Workday recommends creating and validating custom reports in an Implementation or Sandbox tenant before moving them to Production. Workday does not offer a generally available anonymous HCM sandbox. Customers normally use their own non-production tenant; eligible partner/developer programs can provide additional development access.

1. Choose the test environment

Start in a Workday Implementation or Sandbox tenant with fictitious data whenever possible. Do not begin against Production employee data.

Record the tenant refresh schedule. A Sandbox refresh can replace its configuration and invalidate credentials, so plan to recreate or migrate the report, security configuration, API client, and refresh token afterward.

Use these acceptance records:

  • an active employee;
  • an approved future termination;
  • an in-progress termination that must not appear as confirmed;
  • corrected and rescinded terminations;
  • a fixed-term employee with an End Employment Date;
  • an employee without a work email;
  • a rehire and a worker with multiple jobs; and
  • a Last Day of Work earlier than the Termination Date.

2. Create a dedicated integration identity

In Workday:

  1. Run Create Integration System User and create a user such as ISU_Flamekeeper.
  2. Create a dedicated, unconstrained Integration System Security Group and add only that ISU.
  3. Grant read access only to the worker, work-contact, current staffing, report/data-source, and approved-termination fields required below.
  4. Do not grant compensation, personal contact, bank, identity, absence, health, performance, document, recruiting, or write domains.
  5. Run Activate Pending Security Policy Changes.

Exact domain names can vary with the Workday tenant and selected report data source. Use View Security for Securable Item or your organization's normal security-review process to confirm each dependency. If broader access is needed, stop and review the report design instead of granting a general HR administrator role.

3. Build the custom report

Create an Advanced custom report named Flamekeeper Worker Directory. Select a worker data source that supports active employees and approved future terminations in your tenant. Configure it to return the primary employment/job only, filter Worker Type to employees, and include only the minimum recently terminated population needed to reconcile rescinds and corrections.

Select Enable As Web Service. Do not use required prompts in the web-service URL; apply complete server-side report filters or populated defaults instead.

Give every column the exact XML alias below. Aliases, not translated display headings, form the integration contract.

XML alias Required Workday value and purpose
worker_wid Yes Stable Worker WID; the employee identity key.
employment_wid Yes Stable employment/position relationship WID; protects rehire handling.
employee_id Recommended Human-readable employee identifier; never used as the identity key.
first_name Recommended Legal or configured first name.
last_name Recommended Last name.
preferred_name Optional Preferred first name.
work_email Optional Primary work email used for import and invitation.
worker_status Recommended Current worker status for the directory.
worker_type Recommended Employee classification; report filters should exclude contingent workers.
business_title Optional Primary-job business title for case prefill.
department Optional Primary-job department for case prefill.
termination_date Optional Effective approved termination date.
last_day_of_work Optional Suggested handover deadline.
end_employment_date Optional Fixed-term end warning.
termination_event_wid Recommended Stable termination-event identity.
termination_event_status Required for a termination Business-process status; only approved/completed values become confirmed departures.
source_updated_at Recommended Source update timestamp for diagnosis and drift review.

Exclude termination-reason text. Flamekeeper does not need it and it can contain sensitive employment information.

Share the report with the dedicated integration security group. Use a durable integration/report owner, not an employee likely to leave. Workday recommends custom reports for RaaS so changes to a delivered standard report do not unexpectedly break the integration. See Workday's RaaS overview and custom-report guidance.

4. Copy the JSON report URL

Run the report as the integration identity and confirm that it returns the expected rows and aliases. From the report's related actions, choose Web Services → View URLs and copy the JSON URL.

The URL must:

  • use HTTPS on a supported workday.com or myworkday.com host;
  • contain /customreport2/{tenant}/{owner}/{report};
  • use JSON output; and
  • contain no required prompt values or secrets.

Flamekeeper removes all query parameters except format=json, rejects redirects, IP addresses, private networks, custom ports, and unsupported hosts, and limits report responses to 25 MB. Workday documents the URL shape in Accessing RaaS Output.

5. Register OAuth credentials

In the same tenant:

  1. Run Register API Client for Integrations.
  2. Create a client dedicated to Flamekeeper and grant only the functional-area scope required to read the approved report, normally including the relevant Staffing access.
  3. Copy the client ID and client secret.
  4. Run Manage Refresh Tokens for Integrations and generate a token for ISU_Flamekeeper.
  5. Copy the tenant-specific OAuth token endpoint. It normally follows /ccx/oauth2/{tenant}/token on the same Workday host as the report.

Store the client secret and refresh token temporarily in your approved secrets manager. Never email them, include them in a support ticket, or paste them into chat. Workday tokens are environment-specific: create and validate separate credentials for Sandbox, Sandbox Preview, Implementation, and Production as applicable.

6. Connect Workday in Flamekeeper

In Flamekeeper:

  1. Open Admin → Integrations → Connection.
  2. Select Workday, then Configure integration.
  3. Choose Sandbox, Implementation, or Production.
  4. Paste the JSON report URL and OAuth token endpoint.
  5. Enter the client ID, client secret, and refresh token.
  6. Enter your organization's IANA timezone, for example Europe/Berlin or America/New_York.
  7. Select Connect Workday.

Flamekeeper checks the URLs, exchanges the refresh token, fetches and validates the report, and only then encrypts and stores the credentials. Secrets and the full report URL are never returned to the browser. If Workday rotates the refresh token during a sync, Flamekeeper replaces it atomically.

If connection validation fails, recheck the environment, exact report aliases, report sharing, activated security changes, token endpoint, and the API client's tenant.

7. Run the first synchronization

Select Sync now. After it completes:

  • Next 3 months shows approved/completed terminations and separate contract-end warnings in the configured timezone;
  • People shows the accessible Workday directory and whether each person has been added to Flamekeeper; and
  • Connection shows status, environment, tenant, and the last successful sync.

Flamekeeper also reconciles Workday daily. A sync never adds a Flamekeeper user, creates a case, sends an invitation, or changes Workday automatically. The previous successful cache remains intact if Workday is unavailable, returns an unexpectedly empty report or invalid JSON, changes the required aliases, or exceeds the response limit.

Understand departure behavior

A termination appears as confirmed only when the report contains a Termination Date and a business-process status of Approved, Completed, or Successfully Completed. An in-progress request does not appear as confirmed.

Flamekeeper uses:

  • Termination Date for the three-month window; and
  • Last Day of Work, when present, as the proposed handover deadline.

An End Employment Date without a confirmed termination appears as Contract end — verify. It is not proof that the employee will leave. Leave of absence and contingent-worker end events are outside this integration's first version.

When Workday corrects or rescinds an event, the next complete sync updates or cancels the source event. It does not silently delete an existing handover case.

Unlinked workers that disappear from the complete report are marked as removed and purged after 30 days. Workers linked to a Flamekeeper user and records needed to preserve an existing case are retained independently of the synchronized directory view.

Add a person or create a case

In People, select Add person to create or link a pending Flamekeeper employee. A work email is required. This action does not send an invitation.

In Next 3 months, select Create case. Confirm the job title, role template, case type, actual last working day, replacement status, and whether to invite the employee. A case can be created without a work email, but import and invitation remain unavailable.

Repeated submissions for the same Workday event return the existing case rather than creating a duplicate.

Troubleshooting

What you see What to check
Credentials rejected or reauthorization required Confirm the client secret and refresh token belong to this exact tenant/environment and have not been revoked by a refresh.
Permission denied Confirm report sharing, ISU membership, security domains, API scope, and Activate Pending Security Policy Changes.
Report not found Copy the current JSON URL from Web Services → View URLs and confirm the durable report owner.
Report schema changed Restore the exact aliases, especially worker_wid and employment_wid, then reconnect or sync.
No departures appear Confirm the date is in the next three calendar months and the termination event status is completed/approved.
A contract end appears instead of a termination Complete the Workday termination process or verify the fixed-term departure manually before creating a case.
A person cannot be added Confirm there is a valid work email. It may already belong to another Flamekeeper organization.
Response too large Reduce the report population/fields. Contact Flamekeeper before changing to a paginated WQL or SOAP design.
Sandbox stopped syncing after a refresh Recreate or migrate the security/report configuration and issue new environment-specific OAuth credentials.

Rotate credentials or disconnect

To rotate credentials, create or copy the current Workday client secret and refresh token, then open Admin → Integrations → Connection → Workday and select Replace connection. Enter every field again, save, run Sync now, and confirm success before revoking the old credential where your rotation process permits overlap.

Select Disconnect to delete the encrypted Workday credentials and cached Workday directory data from Flamekeeper. Previously added users and existing handover cases remain available.

Workday partner and developer access

Flamekeeper is pursuing the Workday Innovation Partner path for an external, read-only HR continuity integration. Workday describes Innovation Partners as the program for complementary solutions and offers a partner application form. Marketplace or Built on Workday certification is a later distribution decision; it is not required by Flamekeeper's current customer-configured RaaS design unless Workday or the customer's agreement says otherwise.

As of September 2026, Workday also advertises pilot access to its Open Developer Program, including a waitlist for a developer tenant. Treat this as an additional development option, not a substitute for validation in a design partner's real Workday configuration. Workday's app lifecycle uses Development, Implementation, Sandbox, and Production environments, but access and entitlements depend on the selected program and agreement.

When applying, ask Workday explicitly about:

  • Innovation Partner versus Marketplace/Built on Workday eligibility;
  • development or GMS sample-tenant access and duration;
  • integration certification, security/privacy review, and release compatibility requirements;
  • permitted authentication and tenant-installation patterns for external RaaS integrations;
  • partner support, branding rules, and Marketplace listing requirements; and
  • whether a stronger immutable tenant identifier is available for partner installations.

See Workday's Partner Program overview, Built on Workday, and Open Developer Platform announcement.

For help, contact Flamekeeper support without including Workday credentials, report output, or employee data.

Keep the knowledge. Carry on with the work.

Open Flamekeeper