API docs by Redocly

Workday Strategic Sourcing SCIM API (2.0)

Download OpenAPI specification:

Customer Support

We've provided detailed documentation below to guide you. However, if you need additional assistance, here's how you can get the support you need:

  • Community Discussions: Join the conversation on our Workday Community Discussion Boards (found under the "Collaborate" section in community). Connect with other users, share best practices, and get answers to your configuration questions.
  • Expert Configuration Assistance (Professional Services): For tailored, hands-on support with your specific project, our Professional Services team is available.
    • Looking for personalized guidance? Workday Success Plan customers can submit an "Ask" for expert insights on configuration and best practices.
    • Need custom solutions? Consider Expert Assist, our consulting service for detailed changes and project support.
  • Reporting System Issues: If you suspect a problem with the Workday system itself, please connect with our dedicated support team. Your company's Named Support Contact (NSC) can log a Product Support Defect case. We'll review the issue based on its impact and Workday's service level agreement (SLA).

Servers

US Region

Environment Base URI
Production https://api.us.workdayspend.com/scim/v2
Sandbox https://api.sandbox.us.workdayspend.com/scim/v2

EU Region

Environment EU region Base URI
Production https://api.eu.workdayspend.com/scim/v2
Sandbox https://api.sandbox.eu.workdayspend.com/scim/v2

CA Region

Environment CA region Base URI
Production https://api.ca.workdayspend.com/scim/v2
Sandbox https://api.sandbox.ca.workdayspend.com/scim/v2

API Specification

The API conforms to version 2.0 of the System for Cross-domain Identity Management: Protocol.

Date and Time Fields

Our API adheres to the ISO 8601 standard when accepting and formatting Date and Time fields. All Date and Time fields returned by this API will be in the UTC timezone.

Date and Time fields sent to this API can be in any timezone, provided they adhere to the ISO 8601 standard.

Support & Limitation

The SCIM endpoints are limited to companies with SSO authentication only.

Requests coming from companies without SSO configured will get a 403 Access forbidden response.

Authentication

The Workday Strategic Sourcing SCIM API uses a combination of HTTP basic authentication and a company token to authenticate requests. Every request will require 2 HTTP headers:

HTTP Header Description
X-Api-Key a company-wide API key
Authorization HTTP basic authentication of: user email and user- API token

You can generate all of those from the API tokens section of your Profile page.

Your API keys carry many privileges, so be sure to keep them secure! Do not share your secret API keys in publicly accessible areas such as GitHub, client-side code, and so forth.

All API requests must be made over HTTPS. Calls made over plain HTTP will fail. API requests without authentication will also fail.

Example 1

curl --request GET 'https://api.us.workdayspend.com/scim/v2/ResourceTypes' \
--header 'Accept: application/scim+json' \
--header 'X-Api-Key: ${COMPANY_KEY}' \
--user "${USER_EMAIL}:${USER_TOKEN}"

Example 2

curl --request GET 'https://api.us.workdayspend.com/scim/v2/ResourceTypes' \
--header 'Accept: application/scim+json' \
--header 'X-Api-Key: ${COMPANY_KEY}' \
--header 'Authorization: Basic ${Base64(USER_EMAIL:USER_TOKEN)}'

Example 3

curl --request GET 'https://${USER_EMAIL}:${USER_TOKEN}@api.us.workdayspend.com/scim/v2/ResourceTypes' \
--header 'Accept: application/scim+json' \
--header 'X-Api-Key: ${COMPANY_KEY}'

Rate Limiting

Rate limit windows are per second and are shared by all API Keys for a company.

The current rate limit is 5 requests per second.

When request submissions exceed the limits, the limit-exceeding requests return 429 Too Many Requests error responses to the client.

Upon receiving a 429 response, it is recommended to retry the request in compliance with the rate limit. One example would be to add a sleep function for 1 second and retry.

User

Use the users API to create, update, and query the users in Workday Strategic Sourcing.

User Object

schemas
Array of strings

URIs that are used to indicate the namespaces of the SCIM schemas that define the attributes present in the current structure

id
string

A unique identifier for a SCIM resource. It should be treated as a non-sequential opaque string of varying length.

object (Meta)

Descriptive information about a resource.

externalId
string

Identifier of the resource useful from the perspective of the provisioning client.

userName
required
string

Email for the user

required
object (Name)

Name compound object

Array of objects (Role)

Roles assigned to User (read-only). See section 4.1 of RFC 7643

active
boolean
{
  • "schemas": [
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "externalId": "701984",
  • "userName": "bjensen@example.com",
  • "name": {
    },
  • "active": true,
  • "roles": [
    ],
  • "meta": {}
}

List Users

Returns a list of users for the specified criteria. The pagination size is 100 results per request.

Authorizations:
(api_keybasic_authentication)
query Parameters
attributes
string

A comma-separated list of attribute names to return in the response

object (UserListInputFilter)
Example: filter=userName eq "jhon.doe@example.com" and meta.lastModified gt "2011-05-13T04:42:34Z"

An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644

startIndex
integer

The 1-based index of the first query result

count
integer

Specifies the desired maximum number of query results per page

sortBy
string

The attribute whose value will be used to order the returned responses. Allowed values are id and externalId

sortOrder
string

Order in which the sortBy param is applied. Allowed values are ascending and descending

Responses

Response samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "totalResults": 2,
  • "startIndex": 1,
  • "itemsPerPage": 100,
  • "Resources": [
    ]
}

Create a User

Create a user with given attributes

Authorizations:
(api_keybasic_authentication)
query Parameters
attributes
string

A comma-separated list of attribute names to return in the response

Request Body schema: application/scim+json
required

Payload that represents the user to create

externalId
string

Identifier of the resource useful from the perspective of the provisioning client.

userName
required
string

Email for the user

required
object (Name)

Name compound object

active
boolean

Responses

Request samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "externalId": "701984",
  • "userName": "bjensen@example.com",
  • "name": {
    },
  • "active": true
}

Response samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "externalId": "701984",
  • "userName": "bjensen@example.com",
  • "name": {
    },
  • "active": true,
  • "roles": [
    ],
  • "meta": {}
}

Get a user

Retrieves a User resource by Id (see section 3.4.1 of RFC 7644)

Authorizations:
(api_keybasic_authentication)
path Parameters
id
required
string
query Parameters
attributes
string

A comma-separated list of attribute names to return in the response

object (UserListInputFilter)
Example: filter=userName eq "jhon.doe@example.com" and meta.lastModified gt "2011-05-13T04:42:34Z"

An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644

Responses

Response samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "externalId": "701984",
  • "userName": "bjensen@example.com",
  • "name": {
    },
  • "active": true,
  • "roles": [
    ],
  • "meta": {}
}

Patch a User

Updates one or more attributes of a User resource using a sequence of additions, removals, and replacements operations. See section 3.5.2 of RFC 7644.

If the user tries to deactivate themselves, they will get a 403 Access forbidden response.

Operations on the userName field will only be processed if both original and target email addresses match the domains list set for the Company's SSO connections.

If not, the response returned will be a 403 Access forbidden.

Authorizations:
(api_keybasic_authentication)
path Parameters
id
required
string
query Parameters
attributes
string

A comma-separated list of attribute names to return in the response

Request Body schema: application/scim+json
required

Payload describing the patch operations to apply upon the resource identified by param id

schemas
Array of strings
required
Array of objects (PatchOperation)

Responses

Request samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "Operations": [
    ]
}

Response samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "externalId": "EXT701984",
  • "userName": "bjensen@example.com",
  • "name": {
    },
  • "active": true,
  • "roles": [
    ],
  • "meta": {}
}

Replace a User

Updates a User resource (see section 3.5.1 of RFC 7644). Update works in a replacement fashion; every attribute value found in the payload sent will replace the one in the existing resource representation. Attributes not passed in the payload will be left intact.

If the user tries to deactivate themselves, they will get a 403 Access forbidden response.

Operations on the userName field will only be processed if both original and target email addresses match the domains list set for the Company's SSO connections.

If not, the response returned will be a 403 Access forbidden.

Authorizations:
(api_keybasic_authentication)
path Parameters
id
required
string
query Parameters
attributes
string

A comma-separated list of attribute names to return in the response

Request Body schema: application/scim+json
required

Payload with the data to replace in the existing user identified by the id param

externalId
string

Identifier of the resource useful from the perspective of the provisioning client.

userName
required
string

Email for the user

required
object (Name)

Name compound object

active
boolean

Responses

Request samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "externalId": "EXT701984",
  • "userName": "bjensen@example.com",
  • "name": {
    },
  • "active": true
}

Response samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "externalId": "EXT701984",
  • "userName": "bjensen@example.com",
  • "name": {
    },
  • "active": true,
  • "roles": [
    ],
  • "meta": {}
}

Deactivate a user

Deactivates a user. You need to supply the unique user identifier that was returned upon user creation.

If the user tries to deactivate themselves, they will get a 403 Access forbidden response.

Authorizations:
(api_keybasic_authentication)
path Parameters
id
required
string

Identifier of the resource to deactivate

Responses

Response samples

Content type
application/scim+json
{
  • "value": {
    }
}

Discovery

Endpoints to facilitate discovery of SCIM service provider features

List Schemas

Endpoint used to retrieve information about schemas supported. See section 3.4 of RFC 7644

Authorizations:
(api_keybasic_authentication)

Responses

Response samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "totalResults": 1,
  • "startIndex": 0,
  • "itemsPerPage": 100,
  • "Resources": [
    ]
}

Get a Schema

Retrieves information about a specific resource

Authorizations:
(api_keybasic_authentication)
path Parameters
uri
required
string
Value: "urn:ietf:params:scim:schemas:core:2.0:User"

Schema URI of a particular resource type

Responses

Response samples

Content type
application/scim+json
{
  • "name": "User",
  • "id": "urn:ietf:params:scim:schemas:core:2.0:User",
  • "description": "Represents a User",
  • "meta": {
    },
  • "attributes": [
    ]
}

List Resource Types

This endpoint is used to discover the types of resources available (see section 4 of RFC 7644)

Authorizations:
(api_keybasic_authentication)

Responses

Response samples

Content type
application/scim+json
{
  • "schemas": [
    ],
  • "totalResults": 1,
  • "startIndex": 0,
  • "itemsPerPage": 100,
  • "Resources": [
    ]
}

Get a Resource Type

Describes the endpoint, schemas and extensions supported by a specific kind of resource. It returns a specific portion of the ouput of the more general /Resources endpoint

Authorizations:
(api_keybasic_authentication)
path Parameters
resource
required
string
Value: "User"

Responses

Response samples

Content type
application/scim+json
{}

List Service Provider Configs

Describes the SCIM specification features available (see section 5 of RFC 7643)

Authorizations:
(api_keybasic_authentication)

Responses

Response samples

Content type
application/scim+json
{
  • "bulk": {
    },
  • "changePassword": {
    },
  • "sort": {
    },
  • "etag": {
    },
  • "patch": {
    },
  • "filter": {
    },
  • "schemas": [
    ],
  • "meta": {},
  • "authenticationSchemes": [
    ]
}