Docebo Connect for Workday: RaaS reports and SME governance
For a Spanish SME running Workday as the HCM and Docebo as the LMS — common in mid-market companies that adopted Workday after the 2018 wave of SAP-replacement projects — the integration question is not “should we connect them” but “via which Workday API surface, and what does that imply for the data we can sync.” Docebo Connect for Workday uses Workday’s Report as a Service (RaaS) API rather than the broader Web Services or REST APIs, and that choice has consequences worth understanding before the integration owner starts the setup.
Why RaaS — the trade Workday’s report-as-API surface implies
Workday exposes data via three distinct surfaces, and Docebo Connect deliberately uses the third. The Web Services API (SOAP-based) is the broadest surface but requires the most permissions and produces the verbose XML payloads that older Workday integrations are notorious for. The REST API is newer and more developer-friendly but has narrower coverage and varies by Workday module. Report as a Service is the integration-friendly surface: a Workday administrator builds a custom report inside Workday’s report builder, exposes it as a web service, and any external system — Docebo Connect included — can pull the report’s results as a structured response.
The trade RaaS implies is significant. The benefit is that the report definition is the contract: Workday’s security model, field-level access controls, and prompt parameters apply to the report exactly as they would to a human user running it in the UI. The integration cannot pull data the report’s runner could not pull manually. For a Spanish SME under INCIBE supply-chain expectations, this is the cleanest possible governance posture — the SME’s HR team controls the report definition, the SME’s IT team controls the service-account access, and the integration cannot exfiltrate data outside that scope without someone deliberately changing the report.
The cost is that every field the integration needs has to be in the report. Adding a new field — a custom location code, a new cost-centre attribute — means editing the Workday report, re-publishing it, and re-running the Docebo Connect connection’s test. This is operational overhead, but it is overhead in the right place: the change is visible to the Workday admin team, and there is no path for the integration to silently start pulling data the SME’s data-governance committee did not approve.
For an SME that wants the audit story to be defensible — and any Spanish SME under EU AI Act Article 13 transparency expectations on AI-augmented workflows touching personal data should — RaaS is the right surface. The friction is a feature.
Setting up the custom report — the procedure and the field-selection discipline
The setup procedure for Docebo Connect for Workday is a six-step sequence inside Workday, followed by a connector configuration inside Docebo Connect. The Workday side is where most teams trip.
| Step | Where | What |
|---|---|---|
| 1 | Workday | Create a dedicated API user account |
| 2 | Workday | Create a security group, grant “Run as a Service” |
| 3 | Workday | Build Advanced Custom Report on “Workers for HCM Reporting” data source |
| 4 | Workday | Add the field set the integration needs (ID, name, email, dept, manager, status) |
| 5 | Workday | Enable “Web Service” output, capture the report’s WSDL URL |
| 6 | Docebo Connect | Create connection, paste WSDL URL, authenticate as the API user |
The field-selection discipline at step 4 is the most consequential decision. The temptation is to include every field that might be useful — the Workday report builder makes this easy and the report runs against Workday’s database, not against the integration’s API quota. Resist. The fields that belong in the report are the fields the integration uses to populate Docebo user records and Docebo branches: employee ID (the matching key), name, email, department code, manager’s employee ID, employment status, hire date. Every field beyond that set is data leaving the SME’s Workday boundary that should not be leaving it.
The dedicated API user at step 1 is the same service-account discipline that applies to every integration. Reusing a personal admin account means the integration breaks the day that admin moves teams. The dedicated user is named for what it does (svc_docebo_connect), assigned to a security group that grants only the “Run as a Service” permission for the specific custom report, and rotated on the SME’s standard credential cadence.
The Workday tenant URL captured at step 5 is environment-specific — the sandbox tenant URL has a different prefix than production, and pasting the wrong one is the first integration failure most teams encounter. The discipline is to test in sandbox first, capture the production URL only after the sandbox connection passes its test, and document both URLs in the integration’s configuration register.
Operating the integration — scheduling, monitoring, and the SME-friendly rhythm
Once the connection is live, Docebo Connect runs the recipe on a scheduled cadence — typically nightly at 2-4 AM Madrid time, when Workday’s reporting load is low and the daily HRIS export has settled. The recipe pulls the report, transforms each row into a Docebo user-create-or-update payload, and writes the results back as a per-record outcome log.
The monitoring rhythm an SME’s integration owner should run is small but consistent. Daily: a glance at the recipe’s history dashboard to confirm the previous night’s run succeeded — a single failed run is an investigation, not an incident, but two consecutive failures is a credential or report-definition problem that needs same-day attention. Weekly: a check of the Docebo user count against the Workday active-employee count to confirm the integration is keeping pace — a divergence of more than 1-2% is usually a recipe filter that has stopped matching the report’s actual output. Monthly: a review of any custom fields the Workday admin team has added to the underlying report — adding fields without updating the recipe’s transformation step is the silent-failure mode where the integration appears to work but is not actually moving the new data.
For a Spanish SME accessing Kit Digital IA/BI vouchers — Segment III (10-50 employees) up to €12,000, Segment II (3-9 employees) up to €6,000 — the daily/weekly/monthly cadence is the deliverable that converts “we deployed an integration” into “we maintain the integration with documented monitoring.” The Agente Digitalizador can install the integration, ship the runbook, and hand the L&D lead a process the team can run without external help past month three.
The official Workday integration reference lives at help.docebo.com, with the broader Docebo product context at docebo.com for the team members who want the partner-directory view of who else has implemented the same integration.
Ready to get started?
Working on this yourself? J4SGON S.L. delivers Docebo Connect, HRIS, SSO and migration work for European organisations — see what a scoped engagement covers or describe your project and we will reply with a written scope.
Tell us what you are integrating or migrating
Send the platform, the systems involved and where you are stuck. You get a written scope back — phases, deliverables and what is out of scope — before anything is billed.