Workday Security Security Audit API

openapi: 3.1.0
info:
  title: Workday Security Workday Audit and Compliance Account Signons Security Audit API
  description: Access audit logs, security reports, and compliance data within the Workday platform. Provides programmatic access to audit trail information for security monitoring, regulatory compliance, and governance reporting. Supports retrieval of configuration change history, security policy modifications, and access control audit records for maintaining a complete compliance trail.
  version: v1
  contact:
    name: Workday Support
    url: https://community.workday.com
    email: support@workday.com
  termsOfService: https://www.workday.com/en-us/legal.html
servers:
- url: https://{host}/ccx/api/v1/{tenant}
  description: Workday REST API Server
  variables:
    host:
      description: Workday host for your tenant environment
      default: wd2-impl-services1.workday.com
    tenant:
      description: Workday tenant identifier
      default: your-tenant
security:
- bearerAuth: []
tags:
- name: Security Audit
  description: Access security-specific audit records including permission changes, security group modifications, and access control events.
paths:
  /securityAudit/permissionChanges:
    get:
      operationId: listPermissionChanges
      summary: Workday Security List security permission changes
      description: Retrieve a collection of security permission change records, including modifications to security group memberships, domain security policy changes, and access level modifications. Used for monitoring and auditing changes to the security posture of the tenant.
      tags:
      - Security Audit
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: fromDateTime
        in: query
        description: Start of the date range for filtering permission changes
        schema:
          type: string
          format: date-time
      - name: toDateTime
        in: query
        description: End of the date range for filtering permission changes
        schema:
          type: string
          format: date-time
      - name: changeType
        in: query
        description: Filter by the type of permission change
        schema:
          type: string
          enum:
          - SecurityGroup_Membership
          - Domain_Policy
          - Role_Assignment
          - Access_Level
      responses:
        '200':
          description: Collection of permission change records
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/PermissionChange'
                  total:
                    type: integer
                    description: Total number of permission changes
        '401':
          description: Unauthorized - invalid or expired access token
        '403':
          description: Forbidden - insufficient permissions
components:
  schemas:
    ActorRef:
      type: object
      description: Reference to the actor who performed an audited action, which can be a user account or system process.
      properties:
        id:
          type: string
          description: Unique identifier of the actor
        descriptor:
          type: string
          description: Display name of the actor
        accountType:
          type: string
          enum:
          - User
          - IntegrationSystemUser
          - System
          description: Type of account that performed the action
    PermissionChange:
      type: object
      description: A record of a change to security permissions within the Workday tenant, including security group membership changes, domain security policy modifications, and role assignment updates.
      properties:
        id:
          type: string
          description: Unique identifier for the permission change record
        changeType:
          type: string
          enum:
          - SecurityGroup_Membership
          - Domain_Policy
          - Role_Assignment
          - Access_Level
          description: Classification of the permission change
        changeDateTime:
          type: string
          format: date-time
          description: Timestamp when the permission change was made
        changedBy:
          $ref: '#/components/schemas/ActorRef'
        securityGroup:
          type: object
          properties:
            id:
              type: string
              description: Unique identifier of the affected security group
            descriptor:
              type: string
              description: Display name of the affected security group
        domain:
          type: string
          description: The Workday domain affected by the change if applicable
        previousPermission:
          type: string
          description: The permission level before the change
        newPermission:
          type: string
          description: The permission level after the change
        affectedAccount:
          type: string
          description: The user account affected by the permission change if applicable
        description:
          type: string
          description: Human-readable description of the permission change
  parameters:
    limit:
      name: limit
      in: query
      description: Maximum number of results to return per page
      schema:
        type: integer
        default: 20
        minimum: 1
        maximum: 100
    offset:
      name: offset
      in: query
      description: Number of results to skip for pagination
      schema:
        type: integer
        default: 0
        minimum: 0
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 bearer token obtained from the Workday token endpoint.
externalDocs:
  description: Workday Audit and Compliance API Documentation
  url: https://community.workday.com/sites/default/files/file-hosting/productionapi/Security/v44.0/Audit.html