Which direction does data move between SAP S/4HANA and Workday HCM?

The primary flow is from SAP into Workday. Suppliers, GL accounts, and cost centers flow from SAP S/4HANA to Workday to keep procurement and accounting dimensions in sync. Workers and organizational data can flow from Workday back to SAP as business partners when an initial load or headcount alignment is needed.

Why does Workday HCM require both REST and SOAP authentication?

Workday exposes staffing and organizational data via REST with OAuth 2.0, but financial and procurement data including suppliers, invoices, and GL accounts are available only through the SOAP API, which uses WS-Security UsernameToken with an Integration System User credential. ml-connector maintains both credential sets and routes calls to the correct endpoint based on the data type.

How does ml-connector handle the different token lifespans in SAP and Workday?

SAP S/4HANA tokens are short-lived (typically 12 hours) and require refresh before expiry; ml-connector monitors and refreshes them at 11 hours. Workday REST access tokens expire in 60 minutes, so ml-connector refreshes every 50 minutes using the long-lived refresh token. Both systems are polled on a schedule you configure, independent of token expiry.

SAP S/4HANAWorkday HCM

SAP S/4HANA and Workday HCM integration

SAP S/4HANA runs enterprise procurement and finance. Workday HCM manages the workforce and handles payroll allocations to GL accounts. Connecting the two keeps your supplier master in agreement across both systems, aligns GL accounts and cost centers so labor costs post to the right places, and eliminates manual re-entry of organizational and financial dimensions. When SAP's supplier or cost center data changes, Workday sees the update automatically. When you hire or reorganize in Workday, the GL accounts and cost centers used for payroll allocations are already validated against SAP.

How SAP S/4HANA works

SAP S/4HANA exposes suppliers, purchase orders, GL accounts, cost centers, business partners, and journal entries through OData V2 and OData V4 REST APIs. Authentication uses OAuth 2.0 Client Credentials, with scopes configured per Communication Arrangement in the SAP system. The base URL is tenant-specific and obtained from the Communication Arrangement; do not construct it manually. Tokens are short-lived (typically 12 hours) and must be refreshed before expiry. SAP S/4HANA has no native webhooks, so data is read by polling on a schedule you set, using LastChangeDateTime filters or delta tokens. GL accounts and cost centers are read-only in the APIs; they are maintained in SAP only.

How Workday HCM works

Workday HCM surfaces workers, positions, organizations, suppliers, purchase orders, GL accounts, and accounting journals through both REST and SOAP APIs. REST endpoints authenticate with OAuth 2.0 using a refresh token grant with 60-minute access token expiry. Financial and procurement data including suppliers, invoices, and GL accounts require SOAP WS-Security with an Integration System User credential. Workday does not support native webhooks; integrations poll on a schedule (minimum 5 minutes recommended). HTTP 429 rate-limit responses include a Retry-After header. SOAP requests can return up to approximately 2000 records per page, and RaaS custom reports return all rows in one response up to approximately 50000 rows before timeout.

What moves between them

The main flow runs from SAP S/4HANA into Workday HCM. Supplier records (A_Supplier, A_SupplierCompany) flow from SAP to Workday SOAP endpoints via SOAP with WS-Security. GL accounts (A_GLAccountInChartOfAccounts, A_GLAccountText) and cost centers (A_CostCenter) sync from SAP OData to Workday GL_Accounts and Cost_Centers via REST, so payroll allocations in Workday always reference GL dimensions that exist in SAP. Workers (Workday primary resource) can be synchronized from Workday back to SAP as business partners and organizational assignments when initial load is needed. Reference data such as cost centers and organizations is aligned in both directions so compensation allocations land on valid SAP GL accounts.

How ml-connector handles it

ml-connector manages two separate OAuth credentials: OAuth 2.0 Client Credentials for SAP OData (with token refresh before 12-hour expiry) and OAuth 2.0 refresh-token grant for Workday REST (with token refresh every 50 minutes to stay ahead of 60-minute expiry). Financial data in Workday requires SOAP WS-Security, so ml-connector maintains a separate Integration System User credential for those calls. SAP S/4HANA uses a tenant-specific base URL obtained from the Communication Arrangement and does not support webhooks, so ml-connector polls GL accounts, cost centers, and suppliers on a schedule tied to your finance close calendar. Workday also does not support webhooks and must be polled; HTTP 429 responses are handled with exponential backoff using the Retry-After header. Suppliers are mapped by external ID and GL accounts by SAP account number to Workday accounting journal code so the dimensions align. Because GL accounts are read-only in SAP, ml-connector never writes financial entries back to S/4HANA. Worker data from Workday can be posted to SAP as new business partners with organization mappings when synchronizing back to the source system for headcount alignment.

A real-world example

A multinational manufacturer with SAP S/4HANA on-premise for procurement and accounting, and Workday HCM cloud for global workforce and payroll. The finance team manually maintains a mapping between SAP cost centers and Workday cost centers, and payroll postings to the GL frequently land on the wrong accounts when organizational changes happen in Workday. Procurement also struggles with stale supplier data in Workday, creating duplicate suppliers and blocking vendor onboarding. With SAP S/4HANA and Workday connected, supplier changes in SAP flow to Workday within the polling window, cost centers and GL accounts stay in sync across the platform, and finance can confidently post payroll GL entries to the accounts that match the current organizational structure. Month-end close time shrinks because GL reconciliation no longer requires manual account code lookups.

What you can do

Sync SAP S/4HANA suppliers to Workday SOAP endpoints with OAuth Client Credentials authentication and SOAP WS-Security for procurement data.
Keep GL accounts and cost centers aligned from SAP to Workday so payroll allocations and vendor postings land on valid accounts.
Bridge two different OAuth schemes: Client Credentials for SAP OData APIs and refresh-token grant for Workday REST, with automated token refresh before expiry.
Poll both systems on a schedule you define, with HTTP 429 rate-limit handling and exponential backoff.
Map supplier IDs and GL account numbers across systems and audit every record with a full replay trail.

Questions

Which direction does data move between SAP S/4HANA and Workday HCM?: The primary flow is from SAP into Workday. Suppliers, GL accounts, and cost centers flow from SAP S/4HANA to Workday to keep procurement and accounting dimensions in sync. Workers and organizational data can flow from Workday back to SAP as business partners when an initial load or headcount alignment is needed.
Why does Workday HCM require both REST and SOAP authentication?: Workday exposes staffing and organizational data via REST with OAuth 2.0, but financial and procurement data including suppliers, invoices, and GL accounts are available only through the SOAP API, which uses WS-Security UsernameToken with an Integration System User credential. ml-connector maintains both credential sets and routes calls to the correct endpoint based on the data type.
How does ml-connector handle the different token lifespans in SAP and Workday?: SAP S/4HANA tokens are short-lived (typically 12 hours) and require refresh before expiry; ml-connector monitors and refreshes them at 11 hours. Workday REST access tokens expire in 60 minutes, so ml-connector refreshes every 50 minutes using the long-lived refresh token. Both systems are polled on a schedule you configure, independent of token expiry.

Connect SAP S/4HANA and Workday HCM

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started