Workday Extend · Agentic Access
Workday Extend Agentic Access

x-agentic-access generated
Workday Extend exposes 44 API operations that an AI agent could call, of which 23 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 21 read, 22 write, and 1 physical.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
AutomationCustom ApplicationsEnterpriseExtensionsHCMHuman Capital ManagementIntegrationOrchestrationPaaS
Operations: 44 Acting: 23 Human-in-the-loop: 0 Method: generated
By consequence

read 21 write 22 physical 1
Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
Method	Path	Consequence	Human-in-loop
POST	/apps/{appId}/deployments	physical	conditional
Source

Agentic Access

generated: '2026-07-15'
method: generated
source: openapi/workday-extend-custom-objects-openapi.yml, openapi/workday-extend-graph-api-openapi.yml,
  openapi/workday-extend-orchestration-openapi.yml, openapi/workday-extend-rest-api-openapi.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 44
  by_action_class:
    connected: 21
    acting: 23
  by_consequence:
    read: 21
    write: 22
    physical: 1
  human_in_the_loop_required: 0
operations:
- path: /customObjectDefinitions
  method: get
  operationId: listCustomObjectDefinitions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - customObjects:manage
- path: /customObjectDefinitions
  method: post
  operationId: createCustomObjectDefinition
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - customObjects:manage
- path: /customObjectDefinitions/{definitionId}
  method: get
  operationId: getCustomObjectDefinition
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - customObjects:manage
- path: /customObjectDefinitions/{definitionId}
  method: patch
  operationId: updateCustomObjectDefinition
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - customObjects:manage
- path: /customObjectDefinitions/{definitionId}
  method: delete
  operationId: deleteCustomObjectDefinition
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - customObjects:manage
- path: /customObjectDefinitions/{definitionId}/fields
  method: get
  operationId: listCustomObjectFields
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - customObjects:manage
- path: /customObjectDefinitions/{definitionId}/fields
  method: post
  operationId: addCustomObjectField
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - customObjects:manage
- path: /workers/{workerId}/customObjects/{customObjectName}
  method: get
  operationId: getWorkerCustomObject
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - customObjects:manage
- path: /workers/{workerId}/customObjects/{customObjectName}
  method: put
  operationId: updateWorkerCustomObject
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - customObjects:manage
- path: /workers/{workerId}/customObjects/{customObjectName}
  method: delete
  operationId: deleteWorkerCustomObject
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - customObjects:manage
- path: /organizations/{organizationId}/customObjects/{customObjectName}
  method: get
  operationId: getOrganizationCustomObject
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - customObjects:manage
- path: /organizations/{organizationId}/customObjects/{customObjectName}
  method: put
  operationId: updateOrganizationCustomObject
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - customObjects:manage
- path: /query
  method: post
  operationId: executeGraphQuery
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - graph:read
- path: /wql
  method: post
  operationId: executeWqlQuery
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - graph:read
- path: /schema
  method: get
  operationId: getSchema
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - graph:read
- path: /schema/types
  method: get
  operationId: listSchemaTypes
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - graph:read
- path: /schema/types/{typeName}
  method: get
  operationId: getSchemaType
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - graph:read
- path: /orchestrations
  method: get
  operationId: listOrchestrations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - orchestrate:orchestrations
- path: /orchestrations
  method: post
  operationId: createOrchestration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}
  method: get
  operationId: getOrchestration
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}
  method: patch
  operationId: updateOrchestration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}
  method: delete
  operationId: deleteOrchestration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/activate
  method: post
  operationId: activateOrchestration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/deactivate
  method: post
  operationId: deactivateOrchestration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/executions
  method: get
  operationId: listOrchestrationExecutions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/executions
  method: post
  operationId: launchOrchestration
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/executions/{executionId}
  method: get
  operationId: getOrchestrationExecution
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/executions/{executionId}/cancel
  method: post
  operationId: cancelOrchestrationExecution
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/steps
  method: get
  operationId: listOrchestrationSteps
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/triggers
  method: get
  operationId: listOrchestrationTriggers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - orchestrate:orchestrations
- path: /orchestrations/{orchestrationId}/triggers
  method: post
  operationId: createOrchestrationTrigger
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - orchestrate:orchestrations
- path: /apps
  method: get
  operationId: listApps
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - extend:apps
- path: /apps
  method: post
  operationId: createApp
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - extend:apps
- path: /apps/{appId}
  method: get
  operationId: getApp
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - extend:apps
- path: /apps/{appId}
  method: patch
  operationId: updateApp
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - extend:apps
- path: /apps/{appId}
  method: delete
  operationId: deleteApp
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - extend:apps
- path: /apps/{appId}/versions
  method: get
  operationId: listAppVersions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - extend:apps
- path: /apps/{appId}/versions
  method: post
  operationId: createAppVersion
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - extend:apps
- path: /apps/{appId}/versions/{versionId}
  method: get
  operationId: getAppVersion
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - extend:apps
- path: /apps/{appId}/configurations
  method: get
  operationId: listAppConfigurations
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - extend:apps
- path: /apps/{appId}/configurations
  method: put
  operationId: updateAppConfigurations
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - extend:apps
- path: /apps/{appId}/deployments
  method: get
  operationId: listAppDeployments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - extend:apps
- path: /apps/{appId}/deployments
  method: post
  operationId: deployApp
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
    scope:
    - extend:apps
- path: /apps/{appId}/deployments/{deploymentId}
  method: get
  operationId: getAppDeployment
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    token:
      max-ttl: 3600
    audit: none
    scope:
    - extend:apps