DATEV and Workday HCM integration

What moves between them

The financial flow runs from Workday HCM into DATEV. After each payroll cycle, ml-connector reads Workday accounting journals and labor cost lines through the SOAP Financial Management service and submits them to DATEV as EXTF CSV booking jobs, with debit and credit lines mapped to DATEV accounts and the cost center on each line mapped to a DATEV Kostenstelle. Worker hires, terminations, and rehires are read from the Workday staffing API and carried into DATEV so creditor, debtor, and cost center reference stays current. DATEV booking imports are write-only and cannot be read back, so ml-connector never pulls posted journals out of DATEV, and reference such as cost centers is aligned on the schedule you set.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Workday side it refreshes the OAuth access token when a REST call returns 401 and presents the Integration System User username token on every SOAP request, accepting the tenant host and tenant name per customer because Workday publishes no shared base URL. On the DATEV side it carries the PKCE-issued access token, refreshing it before the 15-minute expiry by sending only the client_id, and it sets the OAuth state value to at least 20 characters so DATEV does not reject the login. Workday cost centers and ledger accounts are mapped to DATEV accounts and Kostenstellen first, so every booking line references an account that already exists, which matters because DATEV cannot return its chart of accounts through the API. Journal lines are written as EXTF CSV in UTF-8 with precomposed characters, since non-precomposed text is silently rejected, and filenames use a stable whitelist so a retried submission is treated as the same file rather than a duplicate. Because neither system pushes events, the connector polls Workday for journals and worker changes on a cadence tied to your payroll calendar, then polls each DATEV EXTF job with exponential backoff until DATEV reports the job complete or failed. Workday returns HTTP 429 with a Retry-After header under load, so ml-connector backs off and retries, and every record carries an audit trail and can be replayed if a downstream call fails.

A real-world example

A German subsidiary of a multinational with about 900 employees runs Workday HCM for its global workforce, payroll, and cost center structure, while its local books are kept in DATEV by an outside tax advisor as German law expects. Before the integration, the finance team exported payroll and labor cost reports from Workday each month and a bookkeeper re-entered the totals into DATEV by hand, splitting them across cost centers and chasing differences during month-end close. With DATEV and Workday HCM connected, each cycle's accounting journals flow into DATEV as EXTF booking jobs allocated to the right Kostenstelle, and worker changes keep the cost center and creditor reference aligned. The manual re-keying step is gone and the tax advisor receives clean, structured bookings on a predictable schedule.

What you can do

• •Post Workday HCM payroll and labor cost journals into DATEV as EXTF CSV booking jobs after each cycle.
• •Map Workday cost centers and ledger accounts to DATEV accounts and Kostenstellen so every booking line is valid.
• •Carry Workday hires, terminations, and rehires into DATEV to keep creditor, debtor, and cost center reference current.
• •Bridge Workday OAuth refresh tokens and SOAP service accounts to the DATEV PKCE login, with automatic token refresh on both sides.
• •Poll Workday on your payroll schedule and poll each DATEV EXTF job to completion, with retries and a full audit trail.

Questions

Which direction does data move between DATEV and Workday HCM?

The financial flow runs from Workday HCM into DATEV. Accounting journals, labor cost lines, and worker records move from Workday into DATEV booking jobs, while cost center and account mappings are maintained so each line is valid. DATEV booking imports are write-only and cannot be read back, so ml-connector never pulls posted bookings out of DATEV.

How does the integration handle DATEV having no webhooks and no readable chart of accounts?

Because DATEV does not push events, ml-connector polls each submitted EXTF job status with exponential backoff until DATEV reports it complete or failed. Since DATEV cannot return its chart of accounts through the API, the SKR account numbers and cost centers are mapped in advance from Workday, so every booking line references an account that already exists in DATEV.

Does the connector need both Workday API surfaces?

Yes. Worker, position, and organization data is read through the Workday REST staffing API using an OAuth refresh token, while accounting journals, ledger accounts, and cost centers come from the SOAP Web Services API using an Integration System User. ml-connector stores both credential sets encrypted and uses each surface where Workday requires it, since financial data is not available over REST.