Workday Financial Management and Basware integration

What moves between them

Invoices, purchase orders, and vendor records flow from Workday into Basware. ml-connector reads Workday suppliers and creates or updates vendor records in Basware, fetches purchase orders and invoices from Workday using date-range filters on the recommended 15-60 minute schedule, maps each invoice to the matching Basware vendor and GL dimension, and posts the invoice with its PO reference into Basware's P2P pipeline. Basware can then trigger three-way matching and e-invoicing workflows. Changes to vendors in Workday are reflected in Basware; invoices already matched in Basware are tracked to prevent re-import.

How ml-connector handles it

ml-connector connects to Workday via either SOAP (WS-Security UsernameToken, full CRUD) or REST (OAuth2 refresh token, read operations), using the Integration System User account provided by the customer's Workday administrator. It polls Workday's supplier and transactional APIs on a 15-60 minute schedule using date-range filters to capture only new and modified records, avoiding rate throttling on Workday's tenant. On the Basware side, ml-connector connects via OAuth2 client credentials, determines the correct regional endpoint based on the Basware instance location, and validates HMAC-SHA256 signatures on incoming webhooks. It maps Workday GL accounts to Basware dimensions so invoices land on the correct cost code, de-duplicates vendor records by external ID to prevent duplicates, and tracks imported invoice IDs in its audit log so Workday invoices already posted to Basware are not re-imported. When Basware's webhook endpoints are enabled, ml-connector can also receive push notifications for invoice state changes (approval, rejection, payment) and replay those events back into Workday's journal system for real-time GL posting.

A real-world example

A mid-sized distribution company with multiple regional operations runs Workday Financial Management for AP, procurement, and GL consolidation across all locations. They also use Basware for invoice automation, three-way matching, and e-invoicing with suppliers. Before the integration, the accounts payable team manually created invoices in Basware from Workday PO receipts, checked GL codes by hand, and spent hours each week chasing invoice rejections caused by mismatched vendors or GL allocations. With Workday and Basware connected, suppliers and invoices flow automatically from Workday into Basware's P2P pipeline aligned to the correct GL accounts and cost codes, three-way matching runs without manual intervention, and invoice approval cycles drop from days to hours.

What you can do

• •Import supplier records from Workday and create or update vendor masters in Basware, ensuring vendor sync across both systems.
• •Push purchase orders and supplier invoices from Workday into Basware's P2P pipeline, mapped to the correct GL accounts and cost codes.
• •Authenticate Workday with ISU credentials and OAuth2 token refresh, and Basware with OAuth2 client credentials and regional endpoint routing.
• •Validate HMAC-SHA256 signatures on Basware webhook payloads and replay invoice state changes back into Workday for real-time GL posting.
• •Poll Workday on a 15-60 minute schedule using date-range filters, with de-duplication, audit trails, and replay on failure.

Questions

Which direction does data move between Workday Financial Management and Basware?

The primary flow is from Workday into Basware. Suppliers, purchase orders, and invoices move from Workday's AP and procurement modules into Basware's P2P pipeline for matching and e-invoicing. Invoice state changes (approval, rejection) can flow back to Workday via Basware webhooks to update the GL in real time.

How does ml-connector handle Workday's two API surfaces (SOAP and REST)?

ml-connector uses SOAP with WS-Security UsernameToken for full CRUD operations on suppliers and invoices, and can fall back to REST with OAuth2 for lighter-weight reads if the customer prefers. The choice is made at setup based on your Workday security policies and ISU account scope.

Does Basware's regional deployment affect the integration?

Yes. ml-connector detects the Basware region (EU, US, AU, CA) from the customer's configuration and routes all API calls to the correct regional endpoint (api.basware.com, api.us.basware.com, etc.). Webhooks and polling are both region-aware, so no manual routing is required.