An owner or admin on the Business plan connects your Workday tenant in Settings, under Integrations, with your tenant’s web services address and the user name and password of an integration system user. After that, an offer or onboarding template can be filled from a worker or pre-hire record, and when everyone has signed, the signed PDF is filed on the worker as a worker document.

SignWren connects to your own Workday tenant through Workday’s published SOAP web services (version 47.0). It isn’t a Workday product, and Workday doesn’t review or endorse it.

What do we set up in Workday first?

Three things, done by whoever looks after integrations and security in your tenant:

  1. An integration system user. A Workday account tied to an integration system, used only by SignWren, so its access can be kept narrow and its password changed without touching anyone’s own account. SignWren sends its user name and password with each request, over HTTPS only.
  2. A security group for that user. It needs to read workers through web services, read pre-hires too if you send offers before hire, and add worker documents in the category you pick below. Which domains and permissions give exactly that is your security administrator’s call; ask for the least that covers those three things.
  3. A document category for signed copies. Pick the worker document category signed offer letters and onboarding forms should go in (for example, one called Offer Letters), and note its reference ID. Workday refuses a category that is inactive.

How do we connect it in SignWren?

  1. Go to Settings, then Integrations, and choose Connect next to Workday.
  2. Enter your tenant’s web services address. It ends in /ccx/service/ followed by your tenant name, on a workday.com host, and must start with https://. If you paste an address with a service name on the end, such as /Staffing/v47.0, SignWren keeps the part up to the tenant name.
  3. Enter the integration system user’s name and password. SignWren checks them by asking Workday for one worker, then stores the password encrypted.
  4. On the connection’s settings, enter the document category reference ID. If you gave a WID instead of the usual category ID, change Category ID type to match. Set Match workers by to the ID your integration sends (Employee ID unless you say otherwise), and Match pre-hires by the same way.

Until the category is set, signed copies can’t be filed, and the envelope page says so.

How does Workday start a send?

Your own Workday integration, or any script you run, calls the SignWren API to create an envelope from a template. It links the envelope to the record with an external reference (system workday, object type worker or pre_hire, and the worker’s or pre-hire’s ID) and asks SignWren to fill merge fields from that record. If your integration also sets the envelope metadata workday_tenant to your tenant name, SignWren will only file the signed copy back into that same tenant, which matters if you later reconnect to a different tenant.

Which merge fields can a template use?

From a worker or a pre-hire:

  • person.first_name, person.middle_name, person.last_name, person.full_name (the legal name)
  • person.preferred_first_name, person.preferred_name
  • person.email (the email marked primary, or the first one)

From a worker only: worker.id, worker.hire_date, and from the primary job job.position_title, job.business_title, job.profile, job.location, job.start_date. From a pre-hire only: pre_hire.id. Dates come as YYYY-MM-DD. A field the record doesn’t have stays empty, so check the draft before sending.

What lands in Workday when a document is signed?

One worker document on the worker, in your category. It holds the signed PDF with its certificate of completion, named after the PDF with the envelope’s reference added, and a comment that says it was signed with SignWren and gives the envelope’s reference. Status changes such as declined or voided aren’t written to Workday; SignWren’s webhooks and API report those.

If SignWren has to send it again (say Workday didn’t answer in time), the second try carries the same document ID, Workday answers that it already exists, and nothing is filed twice.

An envelope linked to a pre-hire fills its merge fields, but its signed copy can’t be filed, because Workday files worker documents on workers. Link the envelope to the worker after hire if you want the copy filed.

What if filing fails?

SignWren retries for up to three days when Workday is busy or doesn’t answer. If Workday refuses the request, for example because the category ID doesn’t match or the integration system user lacks a permission, the envelope page shows “Couldn’t save to Workday” with Workday’s reason, and the sender gets one email. Fix the cause in Workday or in the connection settings; the signed PDF stays in SignWren either way.