openapi: 3.1.0
info:
  title: Workday Security Workday Audit and Compliance Account Signons Unidentified Signons API
  description: Access audit logs, security reports, and compliance data within the Workday platform. Provides programmatic access to audit trail information for security monitoring, regulatory compliance, and governance reporting. Supports retrieval of configuration change history, security policy modifications, and access control audit records for maintaining a complete compliance trail.
  version: v1
  contact:
    name: Workday Support
    url: https://community.workday.com
    email: support@workday.com
  termsOfService: https://www.workday.com/en-us/legal.html
servers:
- url: https://{host}/ccx/api/v1/{tenant}
  description: Workday REST API Server
  variables:
    host:
      description: Workday host for your tenant environment
      default: wd2-impl-services1.workday.com
    tenant:
      description: Workday tenant identifier
      default: your-tenant
security:
- bearerAuth: []
tags:
- name: Unidentified Signons
  description: Retrieve and monitor unidentified signon attempts where the provided username does not correspond to a valid Workday account. Used for detecting potential unauthorized access attempts.
paths:
  /unidentifiedSignons:
    get:
      operationId: listUnidentifiedSignons
      summary: Workday Security List unidentified signon attempts
      description: Retrieve a collection of unidentified signon attempts where the provided username does not correspond to a valid Workday account. Used for detecting potential unauthorized access attempts and monitoring security threats. The time range specified in the request criteria must be less than 24 hours.
      tags:
      - Unidentified Signons
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: fromDateTime
        in: query
        required: true
        description: Start of the time range for retrieving unidentified signons. The range between fromDateTime and toDateTime must be less than 24 hours.
        schema:
          type: string
          format: date-time
      - name: toDateTime
        in: query
        required: true
        description: End of the time range for retrieving unidentified signons. The range between fromDateTime and toDateTime must be less than 24 hours.
        schema:
          type: string
          format: date-time
      responses:
        '200':
          description: Collection of unidentified signon attempts
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/UnidentifiedSignon'
                  total:
                    type: integer
                    description: Total number of unidentified signon attempts matching the criteria
        '400':
          description: Invalid request. The time range exceeds 24 hours or required parameters are missing.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized - invalid or expired access token
        '403':
          description: Forbidden - insufficient permissions
components:
  parameters:
    limit:
      name: limit
      in: query
      description: Maximum number of results to return per page
      schema:
        type: integer
        default: 20
        minimum: 1
        maximum: 100
    offset:
      name: offset
      in: query
      description: Number of results to skip for pagination
      schema:
        type: integer
        default: 0
        minimum: 0
  schemas:
    UnidentifiedSignon:
      type: object
      description: An unidentified signon attempt where the provided username does not correspond to any valid Workday account. These records are used for monitoring potential unauthorized access attempts.
      properties:
        id:
          type: string
          description: Unique identifier for the unidentified signon event
        attemptedUsername:
          type: string
          description: The username that was provided during the signon attempt but did not match any valid Workday account
        signonDateTime:
          type: string
          format: date-time
          description: Timestamp when the signon attempt occurred
        ipAddress:
          type: string
          description: IP address from which the signon attempt originated
        browserType:
          type: string
          description: Browser type used for the signon attempt
        operatingSystem:
          type: string
          description: Operating system of the device used for the signon attempt
        deviceType:
          type: string
          description: Type of device used for the signon attempt
    Error:
      type: object
      description: Error response returned when an API request fails due to invalid parameters or business rule violations.
      properties:
        error:
          type: string
          description: Error code identifying the type of error
        message:
          type: string
          description: Human-readable description of the error
        details:
          type: array
          items:
            type: object
            properties:
              field:
                type: string
                description: Field that caused the error
              message:
                type: string
                description: Description of the field-level error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 bearer token obtained from the Workday token endpoint.
externalDocs:
  description: Workday Audit and Compliance API Documentation
  url: https://community.workday.com/sites/default/files/file-hosting/productionapi/Security/v44.0/Audit.html