openapi: 3.1.0 info: title: Workday Security Workday Audit and Compliance Account Signons API description: Access audit logs, security reports, and compliance data within the Workday platform. Provides programmatic access to audit trail information for security monitoring, regulatory compliance, and governance reporting. Supports retrieval of configuration change history, security policy modifications, and access control audit records for maintaining a complete compliance trail. version: v1 contact: name: Workday Support url: https://community.workday.com email: support@workday.com termsOfService: https://www.workday.com/en-us/legal.html servers: - url: https://{host}/ccx/api/v1/{tenant} description: Workday REST API Server variables: host: description: Workday host for your tenant environment default: wd2-impl-services1.workday.com tenant: description: Workday tenant identifier default: your-tenant security: - bearerAuth: [] tags: - name: Account Signons description: Retrieve and monitor Workday account signon events where the username corresponds to a valid Workday account. Provides detailed signon history including timestamps, IP addresses, and authentication methods. paths: /accountSignons: get: operationId: listAccountSignons summary: Workday Security List Workday account signons description: Retrieve a collection of signon events for valid Workday accounts. Returns detailed records of authentication events including the signon timestamp, IP address, authentication type, and the associated Workday account. The time range specified in the request criteria must be less than 24 hours. This operation excludes signon attempts where an unidentified or invalid username was provided. tags: - Account Signons parameters: - $ref: '#/components/parameters/limit' - $ref: '#/components/parameters/offset' - name: fromDateTime in: query required: true description: Start of the time range for retrieving signons. The range between fromDateTime and toDateTime must be less than 24 hours. schema: type: string format: date-time - name: toDateTime in: query required: true description: End of the time range for retrieving signons. The range between fromDateTime and toDateTime must be less than 24 hours. schema: type: string format: date-time - name: systemAccount in: query description: Filter signons by the system account username schema: type: string - name: successful in: query description: Filter by signon success status. Set to true for successful signons only or false for failed signons only. schema: type: boolean responses: '200': description: Collection of account signon events content: application/json: schema: type: object properties: data: type: array items: $ref: '#/components/schemas/AccountSignon' total: type: integer description: Total number of signon events matching the criteria '400': description: Invalid request. The time range exceeds 24 hours or required parameters are missing. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Unauthorized - invalid or expired access token '403': description: Forbidden - insufficient permissions /accountSignons/{signonId}: get: operationId: getAccountSignon summary: Workday Security Get a specific account signon description: Retrieve detailed information about a specific signon event identified by its unique signon identifier. Returns the full signon record including timestamps, IP address, device information, and authentication method. tags: - Account Signons parameters: - name: signonId in: path required: true description: Unique identifier of the signon event schema: type: string responses: '200': description: Signon event details content: application/json: schema: $ref: '#/components/schemas/AccountSignon' '401': description: Unauthorized - invalid or expired access token '403': description: Forbidden - insufficient permissions '404': description: Signon event not found components: parameters: limit: name: limit in: query description: Maximum number of results to return per page schema: type: integer default: 20 minimum: 1 maximum: 100 offset: name: offset in: query description: Number of results to skip for pagination schema: type: integer default: 0 minimum: 0 schemas: AccountSignon: type: object description: A signon event recorded when a user authenticates with a valid Workday account. Contains details about the authentication including timestamps, IP address, device information, and the outcome of the signon attempt. properties: id: type: string description: Unique identifier for the signon event systemAccount: type: string description: The Workday system account username used for the signon signonDateTime: type: string format: date-time description: Timestamp when the signon occurred ipAddress: type: string description: IP address from which the signon attempt originated authenticationType: type: string description: Authentication method used such as SAML, password, or certificate browserType: type: string description: Browser type used for the signon operatingSystem: type: string description: Operating system of the device used for the signon deviceType: type: string description: Type of device used for the signon deviceIsTrusted: type: boolean description: Whether the device is registered as a trusted device isDeviceManaged: type: boolean description: Whether the device is managed by the organization sessionId: type: string description: Session identifier assigned to the signon sessionStart: type: string format: date-time description: Timestamp when the session started sessionEnd: type: string format: date-time description: Timestamp when the session ended successful: type: boolean description: Whether the signon attempt was successful failedSignonReason: type: string description: Reason for the signon failure if the attempt was unsuccessful passwordChanged: type: boolean description: Whether the password was changed during this signon forgottenPasswordResetRequest: type: boolean description: Whether a forgotten password reset was requested multiFactorType: type: string description: Multi-factor authentication type used if applicable samlIdentityProvider: type: string description: SAML identity provider used if the signon was via SSO uiClientType: type: string description: Workday UI client type used for the signon requestOriginator: type: string description: Originator of the signon request such as user-initiated or system-initiated Error: type: object description: Error response returned when an API request fails due to invalid parameters or business rule violations. properties: error: type: string description: Error code identifying the type of error message: type: string description: Human-readable description of the error details: type: array items: type: object properties: field: type: string description: Field that caused the error message: type: string description: Description of the field-level error securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: OAuth 2.0 bearer token obtained from the Workday token endpoint. externalDocs: description: Workday Audit and Compliance API Documentation url: https://community.workday.com/sites/default/files/file-hosting/productionapi/Security/v44.0/Audit.html