Workday Financial Management and Brex integration

What moves between them

Spend data flows from Brex into Workday Financial Management. Card transactions and expenses are read from Brex on a polling schedule or received via Svix webhooks when configured. ml-connector maps each transaction to a Workday GL account and cost center, then posts a journal entry into Workday's general ledger. Reference data such as cost centers, vendors, and GL accounts is aligned so transactions land on valid dimensions. Workday general ledger and supplier master are read-only, so ml-connector does not write back to transaction records in Brex.

How ml-connector handles it

ml-connector stores both Workday and Brex credentials encrypted and uses Workday's OAuth2 refresh-token flow to maintain an access token for REST API calls. It handles Workday's SOAP/XML surface for journal submission, mapping Brex transactions to SOAP journal entry structures. On the Brex side, ml-connector presents the bearer token on every request and monitors token expiry to refresh before it expires. If Brex webhooks are configured, ml-connector receives ACCOUNTING_RECORD_READY_FOR_EXPORT events via Svix, validates signatures with HMAC-SHA256, and queues journal posts; without webhooks, it polls the Brex Accounting Records endpoint on your schedule. Brex requires an Idempotency-Key header on transfer writes, which ml-connector generates per request to ensure duplicates are rejected at the API layer. Every transaction carries a full audit trail and can be replayed if a Workday SOAP submission fails.

A real-world example

A mid-market SaaS company uses Workday Financial Management for enterprise accounting and Brex for corporate cards and spend management across ten departments and three office locations. Before the integration, the accounting team received weekly transaction exports from Brex, categorized them by cost center, and manually entered journal entries into Workday. Month-end close required several days of matching Brex spend reports against Workday journals to verify no transactions were missed or duplicated. With Workday and Brex connected, every Brex expense and card transaction flows into Workday as a journal entry within minutes, allocated to the correct cost center and GL account. The accounting team no longer re-enters spend data, and department heads can see real-time GL spend balances matched against Brex card limits.

What you can do

• •Post Brex card transactions and expenses into Workday Financial Management as journal entries, allocated to the correct GL accounts and cost centers.
• •Receive Brex spend events via Svix webhooks or poll the Accounting Records endpoint on a schedule you control.
• •Map Brex transactions to Workday GL dimensions using stored reference data so spend lands on valid accounts.
• •Authenticate Workday with OAuth2 and SOAP UsernameToken, and Brex with bearer tokens or multi-tenant OAuth2.
• •Maintain a full audit trail on every transaction and replay failed journal posts if a Workday SOAP call does not complete.

Questions

Does the integration require Brex webhooks to be configured?

No. If webhooks are not configured, ml-connector polls the Brex Accounting Records endpoint on your schedule, typically every 15 to 60 minutes. If webhooks are enabled and ACCOUNTING_RECORD_READY_FOR_EXPORT events are available (added Nov 2025), ml-connector subscribes to them and processes transactions as they occur, reducing latency. Both modes are supported.

What happens if a journal entry fails to post into Workday?

ml-connector logs the failure with the full transaction details and stores the attempted SOAP request. The transaction remains in queue and can be replayed either automatically (with exponential backoff) or manually through the audit trail. When the Workday issue is resolved, the journal can be resubmitted without creating duplicate entries.

How does the integration handle Brex's requirement for an idempotency key?

ml-connector generates a unique Idempotency-Key header for every transfer write to Brex. If a request is retried due to a timeout or network error, Brex rejects the duplicate and returns the original response, preventing duplicate transfers or payment records.