API Award Unified.to Real-Time Unified API wins Best Business Software API at the 2026 API Awards
Unified.to
All articles

How to Get Started with a Workday MCP Server

·

If you're trying to give an AI agent access to Workday (to read worker data, retrieve PTO balances, submit time-off requests, or pull org structure), you need a Workday MCP server, and as of October 2026 there are four ways to get one.

Workday now offers its own: Agent-Ready Tools, which Workday describes as "a new class of Workday connector built on the Model Context Protocol (MCP)", with tools across Core HR, Financials and Workforce Management (Workday Agent-Ready Tools & MCP). The other three paths are building your own MCP server, using a hosted vendor MCP server, or using a unified MCP server that covers Workday plus the other integrations your agent will need. The right one depends on whose Workday tenant the agent works in (your own company's or your customers') and how many other systems it has to reach. This post walks through each path, the Workday setup the last three share, and how to choose.

Does Workday have its own MCP server?

Yes. Workday's Agent-Ready Tools connect agent platforms such as Claude, ChatGPT, Gemini and Copilot to Workday tools over MCP, with each action scoped to the user's identity, according to Workday's product page. Workday Adaptive Planning also has its own MCP server, in Preview since 15 August 2026 with production scheduled for 16 October 2026 (Workday 2026R2 release notes).

When this makes sense: your own employees' agents, working in your company's Workday tenant.

What to check first: Workday's product page doesn't state licensing, the authentication method, or whether a third-party SaaS product can use the tools to reach its customers' Workday tenants. If you're building a product for many customers, confirm that with Workday before choosing this path.

What Workday setup do the other three paths need?

Building your own server, a hosted vendor server and a unified MCP server all start the same way:

  • Create an Integration System User (ISU) in Workday with the security groups required for the data your agent needs (HR, time off, finance, etc.)
  • Register an API client under Workday REST: Authorization Code Grant, Bearer token type, redirect URI matching your MCP platform, refresh token timeout (commonly 30 days), and scopes matching your functional areas
  • Capture the endpoints (REST base URL, token endpoint, authorization endpoint) for the platform you'll plug them into

The ISU + API client setup is the bulk of the work. Whichever path you pick, this part doesn't go away. For OAuth 2.0 bearer tokens on Workday SOAP requests, see Workday's guide, Call Workday SOAP APIs Using the API Gateway.

Path 1: Build your own MCP server against Workday's APIs

Implement an MCP server (Node/TypeScript or Python) that maps tool calls to Workday REST endpoints. Handle OAuth2 token acquisition and refresh, store tokens encrypted, enforce row-level scoping, and serve it over stdio for local clients or Streamable HTTP for remote ones.

When this makes sense: Workday is your only integration, you need deep workflow control, and you have engineering capacity for ongoing maintenance.

What it costs: Workday integration is fundamentally different from modern SaaS APIs. It exposes three API surfaces (SOAP, REST, Reports-as-a-Service), each with different authentication and coverage. The data model is deeply nested and effective-dated. Every customer has a different schema in practice, and Workday ships biannual releases that introduce deprecations. Bi-directional integrations typically take 6–12+ weeks for a B2B SaaS team building directly. Maintenance is continuous, not one-time. For the full breakdown, see Workday API Integration: What Engineers Need to Know.

The MCP layer adds work on top of all that: protocol handling, tool definitions, schema mapping for each Workday object you want to expose.

Path 2: Hosted vendor MCP servers

Several platforms ship Workday MCP servers as a hosted product. The major options:

  • Workato: Workday End User MCP server, configured inside Workato's AI Hub. Focused on employee self-service workflows.
  • CData: Workday MCP Server with JDBC-style data access. Self-hosted, runs as a Java-based MCP server using CData's JDBC driver.
  • Knit: a hosted Workday MCP server, one of 106 per-app servers in its catalogue, each with its own URL and server token; the free Launchpad plan covers up to 5 servers and 100 API calls a month (as of 8 October 2026).
  • Merge Agent Handler: Workday Tool Pack registered as an MCP server in Claude Code or other MCP clients.
  • Composio, Arcade and StackOne also list Workday toolkits; Arcade's covers time off only (as of 8 October 2026).

These platforms hide most of the REST/OAuth plumbing. You configure Workday as an app connection in their UI, capture the MCP URL they generate, and register it in your AI client config.

When this makes sense: You want fast prototyping with minimal auth code, you're comfortable with vendor lock-in for the MCP layer, and Workday is the integration you care about most.

What it costs: You're committing to that vendor's MCP runtime. If you later need ServiceNow, Salesforce, or QuickBooks tools available to the same agent, you're either adding more vendor MCP servers or switching paths. Pricing varies by vendor. Merge Agent Handler, for example, is usage-based: one credit per tool call, with Pro at $1,000 a month for 25,000 credits as of 8 October 2026.

Path 3: A unified MCP server

Unified.to runs an MCP server that connects any Unified integration, Workday included, to MCP-compatible clients (Anthropic, OpenAI, Google Gemini, Cohere, and others). Workday is one of 1807 integrations on the same MCP host, and each connection-scoped URL shows the agent only that connection's tools.

The setup:

  1. Create a Unified.to workspace and get your API key
  2. Add the Workday integration and authorize against your Workday tenant
  3. Capture the connection ID for the Workday connection
  4. Construct the MCP server URL and send a token in the Authorization header:
    https://mcp-api.unified.to/mcp?connection=${CONNECTION_ID}
Authorization: Bearer ${UNIFIED_MCP_TOKEN}
  5. Register the URL and header in your MCP client config. For agents and third-party MCP clients, use a connection-scoped signed token generated with get_unified_connection_mcp_url (mode=user), which works for one connection only; keep your workspace API key on your server.

Pass the token in the Authorization: Bearer {token} header; the ?token= URL parameter is deprecated. Use your workspace's regional host: US https://mcp-api.unified.to/mcp, EU https://mcp-api-eu.unified.to/mcp, AU https://api-au.unified.to/mcp. A credential works only on its own region's host. To fetch the tool list in your LLM provider's format, call GET /tools with type (openai, gemini, cohere, grok or groq); for Anthropic, use openai and rename parameters to input_schema.

Tools available for Workday (as of 9 October 2026): two layers. The normalized tools cover HRIS Employee, Group and Time Off; ATS Activity, Candidate, Job, Interview, Document and Scorecard; LMS Content; and Accounting Invoice and Contact. With include_external_tools enabled, Workday's own REST endpoints are added as tools: absence (balances, eligible absence types, leaves of absence, time-off requests), person and contact data (names, addresses, phone numbers, email, contact-change events), recruiting (job postings, prospects, interview feedback), staffing and organizations (jobs, job profiles, supervisory organizations, job changes, organization assignment changes), and the user activity log. Several of these start a Workday business process, such as a time-off request or a job change, so give an agent write tools deliberately.

When this makes sense: You want one MCP connection that covers Workday plus other integrations, you want every tool call to hit the source API live (no caching, no sync jobs), and you don't want to maintain MCP infrastructure yourself.

What it costs: Each tool call counts as one API request on your plan (Grow from $750 a month, with a 30-day free trial on Grow and Pro). A Workday connection can carry more tools than many models accept (Unified's docs give Groq at 10, most OpenAI models at 20 and Cohere at about 50), so narrow the list with the tools or permissions URL parameters, or mark tools with defer_tools.

How to choose

A short decision frame:

  • Your own employees' agents, working in your company's Workday tenant → start with Workday's Agent-Ready Tools
  • Workday is your only integration and you have engineering capacity for ongoing maintenance → build your own
  • Workday is the integration you care about most and you want fast prototyping → hosted vendor MCP
  • Workday is one of several integrations your agent will need, and you want data read from Workday at request time with no infrastructure to maintain → unified MCP

The path that hurts the least at scale is usually the one that doesn't require rebuilding when the second integration shows up. Agents that start with Workday often end up needing ATS, accounting, or messaging integrations soon after.

Outside Workday's own tools, the Workday prerequisites (ISU, API client registration, OAuth2 setup) apply whichever path you choose. That's the work you can't skip.

To compare MCP servers for Workday and other HRIS systems across vendors, see Best MCP Servers for Connecting AI Agents to SaaS APIs.

→ Start your 30-day free trial

→ Book a demo

Written by Mallory Greene.

About the author: Mallory Greene is Head of Marketing at Unified.to_. She writes about integration infrastructure, unified APIs, and MCP for technical teams. Based in Toronto._

All articles