Workday Security Audit Logs API

openapi: 3.1.0
info:
  title: Workday Security Workday Audit and Compliance Account Signons Audit Logs API
  description: Access audit logs, security reports, and compliance data within the Workday platform. Provides programmatic access to audit trail information for security monitoring, regulatory compliance, and governance reporting. Supports retrieval of configuration change history, security policy modifications, and access control audit records for maintaining a complete compliance trail.
  version: v1
  contact:
    name: Workday Support
    url: https://community.workday.com
    email: support@workday.com
  termsOfService: https://www.workday.com/en-us/legal.html
servers:
- url: https://{host}/ccx/api/v1/{tenant}
  description: Workday REST API Server
  variables:
    host:
      description: Workday host for your tenant environment
      default: wd2-impl-services1.workday.com
    tenant:
      description: Workday tenant identifier
      default: your-tenant
security:
- bearerAuth: []
tags:
- name: Audit Logs
  description: Retrieve audit log entries that record system events, configuration changes, and administrative actions for compliance monitoring.
paths:
  /auditLogs:
    get:
      operationId: listAuditLogs
      summary: Workday Security List audit log entries
      description: Retrieve a collection of audit log entries for the tenant. Audit logs record system events, configuration changes, data modifications, and administrative actions. Supports filtering by date range, event type, and the actor who performed the action.
      tags:
      - Audit Logs
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: fromDateTime
        in: query
        description: Start of the date range for filtering audit log entries
        schema:
          type: string
          format: date-time
      - name: toDateTime
        in: query
        description: End of the date range for filtering audit log entries
        schema:
          type: string
          format: date-time
      - name: eventType
        in: query
        description: Filter by the type of audit event
        schema:
          type: string
          enum:
          - Configuration_Change
          - Data_Access
          - Data_Modification
          - Security_Change
          - System_Event
          - Business_Process
      - name: actor
        in: query
        description: Filter by the account that performed the audited action
        schema:
          type: string
      - name: target
        in: query
        description: Filter by the target resource or object of the audited action
        schema:
          type: string
      responses:
        '200':
          description: Collection of audit log entries
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/AuditLogEntry'
                  total:
                    type: integer
                    description: Total number of audit log entries matching the criteria
        '400':
          description: Invalid request parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized - invalid or expired access token
        '403':
          description: Forbidden - insufficient permissions
  /auditLogs/{auditLogId}:
    get:
      operationId: getAuditLogEntry
      summary: Workday Security Get a specific audit log entry
      description: Retrieve detailed information about a specific audit log entry including the full event context, before and after values for configuration changes, and related audit entries.
      tags:
      - Audit Logs
      parameters:
      - name: auditLogId
        in: path
        required: true
        description: Unique identifier of the audit log entry
        schema:
          type: string
      responses:
        '200':
          description: Audit log entry details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogEntry'
        '401':
          description: Unauthorized - invalid or expired access token
        '403':
          description: Forbidden - insufficient permissions
        '404':
          description: Audit log entry not found
components:
  schemas:
    ActorRef:
      type: object
      description: Reference to the actor who performed an audited action, which can be a user account or system process.
      properties:
        id:
          type: string
          description: Unique identifier of the actor
        descriptor:
          type: string
          description: Display name of the actor
        accountType:
          type: string
          enum:
          - User
          - IntegrationSystemUser
          - System
          description: Type of account that performed the action
    TargetRef:
      type: object
      description: Reference to the target resource or object of an audited action.
      properties:
        id:
          type: string
          description: Unique identifier of the target resource
        descriptor:
          type: string
          description: Display name of the target resource
        href:
          type: string
          format: uri
          description: API URL for the target resource
        resourceType:
          type: string
          description: Type of the target resource
    AuditLogEntry:
      type: object
      description: An audit log entry recording a system event, configuration change, or administrative action within the Workday tenant. Provides a complete record of the action, its context, and the outcome for compliance and security monitoring.
      properties:
        id:
          type: string
          description: Unique identifier for the audit log entry
        eventType:
          type: string
          enum:
          - Configuration_Change
          - Data_Access
          - Data_Modification
          - Security_Change
          - System_Event
          - Business_Process
          description: Classification of the audit event
        eventDateTime:
          type: string
          format: date-time
          description: Timestamp when the event occurred
        actor:
          $ref: '#/components/schemas/ActorRef'
        action:
          type: string
          description: The specific action performed such as Create, Update, Delete, or View
        target:
          $ref: '#/components/schemas/TargetRef'
        description:
          type: string
          description: Human-readable description of the audited event
        previousValue:
          type: string
          description: The previous value before the change for configuration modification events
        newValue:
          type: string
          description: The new value after the change for configuration modification events
        ipAddress:
          type: string
          description: IP address from which the action was performed
        sessionId:
          type: string
          description: Session identifier of the actor performing the action
        outcome:
          type: string
          enum:
          - Success
          - Failure
          - Partial
          description: Outcome of the audited action
    Error:
      type: object
      description: Error response returned when an API request fails due to invalid parameters or business rule violations.
      properties:
        error:
          type: string
          description: Error code identifying the type of error
        message:
          type: string
          description: Human-readable description of the error
  parameters:
    limit:
      name: limit
      in: query
      description: Maximum number of results to return per page
      schema:
        type: integer
        default: 20
        minimum: 1
        maximum: 100
    offset:
      name: offset
      in: query
      description: Number of results to skip for pagination
      schema:
        type: integer
        default: 0
        minimum: 0
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 bearer token obtained from the Workday token endpoint.
externalDocs:
  description: Workday Audit and Compliance API Documentation
  url: https://community.workday.com/sites/default/files/file-hosting/productionapi/Security/v44.0/Audit.html