Workday
Let each published-app user read Workday data with their own permissions
Workday is a published app-user connector. Each signed-in app user authorizes their own Workday account, and every request stays bound to that app user and the configured tenant endpoint.
Configure Workday
An administrator enters the Workday API client ID and secret, authorization endpoint, token endpoint, and REST API endpoint. In project chat, ask for app-user mode and enter the final HTTPS app origin.
The connector exposes one bounded get_resource read operation for worker, organization, time-off, and other REST resources allowed by the tenant and user's Workday permissions. It does not expose arbitrary hosts or write operations.
Example prompt:
Add a signed-in employee dashboard that uses Workday to show the current user's approved time off and organization details.
Verify and recover
Connect test user A and read one allowed resource. Sign in as test user B in another browser profile and confirm A's connection and data are absent.
If Workday redirects or rejects the token, check the tenant-specific endpoints, registered callback, client secret, and user's permissions. Reconnect only the affected user. Disconnecting one app user does not affect other users.