Workday Security Account Signons API

openapi: 3.1.0
info:
  title: Workday Security Workday Audit and Compliance Account Signons API
  description: Access audit logs, security reports, and compliance data within the Workday platform. Provides programmatic access to audit trail information for security monitoring, regulatory compliance, and governance reporting. Supports retrieval of configuration change history, security policy modifications, and access control audit records for maintaining a complete compliance trail.
  version: v1
  contact:
    name: Workday Support
    url: https://community.workday.com
    email: support@workday.com
  termsOfService: https://www.workday.com/en-us/legal.html
servers:
- url: https://{host}/ccx/api/v1/{tenant}
  description: Workday REST API Server
  variables:
    host:
      description: Workday host for your tenant environment
      default: wd2-impl-services1.workday.com
    tenant:
      description: Workday tenant identifier
      default: your-tenant
security:
- bearerAuth: []
tags:
- name: Account Signons
  description: Retrieve and monitor Workday account signon events where the username corresponds to a valid Workday account. Provides detailed signon history including timestamps, IP addresses, and authentication methods.
paths:
  /accountSignons:
    get:
      operationId: listAccountSignons
      summary: Workday Security List Workday account signons
      description: Retrieve a collection of signon events for valid Workday accounts. Returns detailed records of authentication events including the signon timestamp, IP address, authentication type, and the associated Workday account. The time range specified in the request criteria must be less than 24 hours. This operation excludes signon attempts where an unidentified or invalid username was provided.
      tags:
      - Account Signons
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: fromDateTime
        in: query
        required: true
        description: Start of the time range for retrieving signons. The range between fromDateTime and toDateTime must be less than 24 hours.
        schema:
          type: string
          format: date-time
      - name: toDateTime
        in: query
        required: true
        description: End of the time range for retrieving signons. The range between fromDateTime and toDateTime must be less than 24 hours.
        schema:
          type: string
          format: date-time
      - name: systemAccount
        in: query
        description: Filter signons by the system account username
        schema:
          type: string
      - name: successful
        in: query
        description: Filter by signon success status. Set to true for successful signons only or false for failed signons only.
        schema:
          type: boolean
      responses:
        '200':
          description: Collection of account signon events
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/AccountSignon'
                  total:
                    type: integer
                    description: Total number of signon events matching the criteria
        '400':
          description: Invalid request. The time range exceeds 24 hours or required parameters are missing.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized - invalid or expired access token
        '403':
          description: Forbidden - insufficient permissions
  /accountSignons/{signonId}:
    get:
      operationId: getAccountSignon
      summary: Workday Security Get a specific account signon
      description: Retrieve detailed information about a specific signon event identified by its unique signon identifier. Returns the full signon record including timestamps, IP address, device information, and authentication method.
      tags:
      - Account Signons
      parameters:
      - name: signonId
        in: path
        required: true
        description: Unique identifier of the signon event
        schema:
          type: string
      responses:
        '200':
          description: Signon event details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountSignon'
        '401':
          description: Unauthorized - invalid or expired access token
        '403':
          description: Forbidden - insufficient permissions
        '404':
          description: Signon event not found
components:
  parameters:
    limit:
      name: limit
      in: query
      description: Maximum number of results to return per page
      schema:
        type: integer
        default: 20
        minimum: 1
        maximum: 100
    offset:
      name: offset
      in: query
      description: Number of results to skip for pagination
      schema:
        type: integer
        default: 0
        minimum: 0
  schemas:
    AccountSignon:
      type: object
      description: A signon event recorded when a user authenticates with a valid Workday account. Contains details about the authentication including timestamps, IP address, device information, and the outcome of the signon attempt.
      properties:
        id:
          type: string
          description: Unique identifier for the signon event
        systemAccount:
          type: string
          description: The Workday system account username used for the signon
        signonDateTime:
          type: string
          format: date-time
          description: Timestamp when the signon occurred
        ipAddress:
          type: string
          description: IP address from which the signon attempt originated
        authenticationType:
          type: string
          description: Authentication method used such as SAML, password, or certificate
        browserType:
          type: string
          description: Browser type used for the signon
        operatingSystem:
          type: string
          description: Operating system of the device used for the signon
        deviceType:
          type: string
          description: Type of device used for the signon
        deviceIsTrusted:
          type: boolean
          description: Whether the device is registered as a trusted device
        isDeviceManaged:
          type: boolean
          description: Whether the device is managed by the organization
        sessionId:
          type: string
          description: Session identifier assigned to the signon
        sessionStart:
          type: string
          format: date-time
          description: Timestamp when the session started
        sessionEnd:
          type: string
          format: date-time
          description: Timestamp when the session ended
        successful:
          type: boolean
          description: Whether the signon attempt was successful
        failedSignonReason:
          type: string
          description: Reason for the signon failure if the attempt was unsuccessful
        passwordChanged:
          type: boolean
          description: Whether the password was changed during this signon
        forgottenPasswordResetRequest:
          type: boolean
          description: Whether a forgotten password reset was requested
        multiFactorType:
          type: string
          description: Multi-factor authentication type used if applicable
        samlIdentityProvider:
          type: string
          description: SAML identity provider used if the signon was via SSO
        uiClientType:
          type: string
          description: Workday UI client type used for the signon
        requestOriginator:
          type: string
          description: Originator of the signon request such as user-initiated or system-initiated
    Error:
      type: object
      description: Error response returned when an API request fails due to invalid parameters or business rule violations.
      properties:
        error:
          type: string
          description: Error code identifying the type of error
        message:
          type: string
          description: Human-readable description of the error
        details:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
                description: Field that caused the error
              message:
                type: string
                description: Description of the field-level error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 bearer token obtained from the Workday token endpoint.
externalDocs:
  description: Workday Audit and Compliance API Documentation
  url: https://community.workday.com/sites/default/files/file-hosting/productionapi/Security/v44.0/Audit.html