MELTr
Home Vendors Search Download
Login
Vendors / Workday / Workday HCM / Workday HCM API Request
Workday logo

Event type

Workday HCM API Request

User activity and API interactions

Records user interactions with Workday HCM mobile and web applications, including API calls, dashboard views, and system actions. Captures READ and WRITE operations without document downloads.

JSON 11 fields High Generator

api mobile user-activity audit hcm
Preview Sample View Schema
CLI Install
meltr templates install workday

Overview

What this event covers

Captures user interactions with Workday HCM applications through API calls, including mobile app usage, web portal access, and system task execution. Tracks READ and WRITE operations across the platform.

When generated

  • ›When a user opens the Workday mobile app and views their dashboard
  • ›When a user accesses their timesheet, payslip, or benefits information
  • ›When a user performs searches or navigates through the application
  • ›When system processes execute automated tasks on behalf of users
  • ›When users interact with calendar, absence, or approval workflows

Security relevance

Medium

Compliance

SOC 2 GDPR HIPAA (for healthcare organizations) SOX (for financial data access)

Frequency notes

Very high frequency during business hours with mobile usage patterns. Expect 2,400+ events/hour base rate with 3x multiplier during business hours (7,200 events/hour), reduced activity during nights (960 events/hour) and weekends (480 events/hour). Mobile app interactions generate bursts of 5-15 API calls per user action.

Resources

Docs and tools

Workday HCM Documentation official Workday API Reference official Workday Security and Privacy official MELTr CLI Command-line tool for template validation and log generation Workday Studio Eclipse-based IDE for Workday integrations and custom development

Generation

Configuration

Base frequency
2400 events/hour
Time patterns
business_hours night_hours weekend
Business hours
3.0x
Night hours
0.4x
Weekend
0.2x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

deviceType
String Required

Type of device used to access Workday (Phone, Desktop, Tablet)

Source: random_choice(['Phone', 'Desktop', 'Tablet'])

Example Phone
Values
  • Phone Mobile smartphone device
  • Desktop Desktop computer or laptop
  • Tablet Tablet device
ipAddress
String Required

Public IP address of the user's device

Source: random_public_ip()

Format IPv4
Example 108.147.198.52
systemAccount
String Required

Workday internal user identifier (6-digit zero-padded number)

Source: random_int(10000, 999999) formatted as 6-digit zero-padded string

Format 6-digit zero-padded string
Example 000077206
requestTime
DateTime Required

Timestamp of the API request in ISO 8601 format (UTC)

Source: now() | iso8601

Format ISO 8601 with milliseconds and Z suffix
Example 2025-12-20T21:53:19.988Z
taskId
String Required

Unique identifier for the specific API endpoint or task being executed (32-character hex string)

Source: random_guid() with hyphens removed

Format 32-character hexadecimal (UUID without hyphens)
Example b19441175deb100010085ba8525b4db7
userAgent
String Required

User agent string identifying the Workday client application and version

Source: random_choice() from list of common Workday user agents

Example Workday/2025.12.1.27340 (iPhone)
Values
  • Workday/2025.12.1.27340 (iPhone) Workday iOS mobile app
  • Workday/2025.12.0.25234 (AndroidNative) Workday Android mobile app
  • Workday/2025.11.2.26145 (iPhone) Workday iOS mobile app (older version)
sessionId
String Required

Short session identifier (6-character hex string)

Source: random_string(6, 'abcdef0123456789')

Format 6-character hexadecimal
Example 91f19d
taskDisplayName
String Required

Human-readable description of the task or API endpoint being called

Source: random_choice() from list of common Workday task names

Example peopleExperience/allMyHomePageCards/get (GET) (1 - )
activityAction
String Required

Type of action performed (READ or WRITE for API requests)

Source: random_weighted(['READ', 'WRITE'], [95, 5]) - 95% READ, 5% WRITE

Example READ
Values
  • READ Data retrieval or query operation
  • WRITE Data modification or creation operation
tenantId
String Required

Workday tenant identifier (organization's unique ID in Workday)

Source: registry.get_organization_field('netbios_domain') | lower, fallback to 'acmecorp'

Example acmeco
tenantHost
String Required

Workday service hostname for the tenant

Source: random_choice() from list of Workday service hostnames

Format Hostname (FQDN)
Example wd5-services1.myworkday.com