Event type
Workday HCM Document Download
Employee document access and downloads
Records document download activities from Workday HCM, including payslips, tax documents, benefits summaries, and other employee-related documents. Captures DOWNLOAD actions with target document information.
Overview
What this event covers
Tracks when users download documents from Workday HCM, including payslips, tax forms, benefits documents, performance reviews, and other HR-related files. Provides audit trail for document access and compliance monitoring.
When generated
- ›When an employee downloads their payslip or pay statement
- ›When a user accesses tax documents (W-2, 1099, etc.)
- ›When benefits summaries or enrollment documents are downloaded
- ›When performance review documents are accessed
- ›When training certificates or compliance documents are retrieved
- ›When employment verification letters are generated and downloaded
Security relevance
HighCompliance
Frequency notes
Medium frequency with spikes during specific periods. Base rate of 120 events/hour increases during pay periods (2.5x = 300 events/hour), tax season (January-April), and benefits enrollment periods. Lower activity during nights (96 events/hour) and weekends (36 events/hour).
Resources
Docs and tools
Generation
Configuration
- Base frequency
- 120 events/hour
- Time patterns
- business_hours night_hours weekend
- Business hours
- 2.5x
- Night hours
- 0.8x
- Weekend
- 0.3x
Schema
Field definitions
Field reference for this event type — types, requirements, examples, and allowed values.
deviceType
Type of device used to download the document
Source: random_choice(['Phone', 'Desktop', 'Tablet'])
Phone-
PhoneMobile smartphone device -
DesktopDesktop computer or laptop -
TabletTablet device
ipAddress
Public IP address of the user's device
Source: random_public_ip()
IPv4174.224.1.218systemAccount
Workday internal user identifier (6-digit zero-padded number)
Source: random_int(10000, 999999) formatted as 6-digit zero-padded string
6-digit zero-padded string000151329requestTime
Timestamp of the document download request in ISO 8601 format (UTC)
Source: now() | iso8601
ISO 8601 with milliseconds and Z suffix2025-12-20T21:53:16.898ZtaskId
Unique identifier for the download task (32-character hex string)
Source: random_guid() with hyphens removed
32-character hexadecimal (UUID without hyphens)d3e0b8c631221000109d6a5966062492userAgent
User agent string identifying the Workday client application and version
Source: random_choice() from list of common Workday user agents including mobile and web clients
Workday/2025.12.1.27340 (iPhone)-
Workday/2025.12.1.27340 (iPhone)Workday iOS mobile app -
Workday/2025.12.0.25234 (AndroidNative)Workday Android mobile app -
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36Workday web portal via browser
sessionId
Short session identifier (6-character hex string)
Source: random_string(6, 'abcdef0123456789')
6-character hexadecimal065904taskDisplayName
Human-readable description of the document download task
Source: random_choice() from list of common document download tasks
Payslips-
PayslipsPay statement or paycheck document -
Tax DocumentsTax forms and statements -
Download W-2Annual W-2 tax form -
Benefits SummaryEmployee benefits overview document -
Performance Review DocumentPerformance evaluation or review -
Training CertificateTraining completion certificate
activityAction
Type of action performed (always DOWNLOAD for this template)
Source: Fixed value: DOWNLOAD
DOWNLOADtarget
Target document object containing descriptor and unique document ID
Source: Object with descriptor (document filename) and id (UUID without hyphens)
{"descriptor": "Payslip-11_21_2025.pdf", "id": "18e429dcbd6e10016a067d0ac9b30001"}target.descriptor
Document filename or description
Source: random_choice() from list of document filename patterns with dynamic dates
Payslip-11_21_2025.pdftarget.id
Unique document identifier (32-character hex string)
Source: random_guid() with hyphens removed
32-character hexadecimal (UUID without hyphens)18e429dcbd6e10016a067d0ac9b30001tenantId
Workday tenant identifier (organization's unique ID in Workday)
Source: registry.get_organization_field('netbios_domain') | lower, fallback to 'acmecorp'
acmecotenantHost
Workday service hostname for the tenant
Source: random_choice() from list of Workday service hostnames
Hostname (FQDN)wd5-services1.myworkday.com