Workday Financial Management and Cleo integration

What moves between them

The main flow is Workday Financial Management into Cleo. ml-connector polls Workday Financial Management for supplier invoices, purchase orders, and GL postings on a cadence you define (typically every 30 minutes), then transforms them into EDI transactions (810 for invoices, 850 for orders) or API payloads and delivers them to Cleo via file upload or direct API call. Supplier master data flows the same direction so Cleo has current trading partner names and tax IDs. Payments and GL postings are reference data only and do not flow back into Workday.

How ml-connector handles it

ml-connector maintains both credential sets encrypted: Workday's ISU account (username and password) plus OAuth2 tenant refresh token, and Cleo's OAuth2 user credentials. For Workday, it exchanges the refresh token for a 1-hour access token on startup and handles Workday's tenant-specific hostname per customer. For Cleo, it obtains a short-lived Bearer token and stores the target folder ID for invoice and order drops. Polling intervals are configurable (default 30 minutes for invoices, 60 for suppliers) to fit your Workday batch windows. ml-connector respects Workday's 5-minute minimum polling interval and backs off on rate limits. Every invoice, order, and supplier record is logged with a timestamp, source ID, and Cleo upload status, so if a Cleo delivery fails, the record can be replayed without double-posting. Transformations from Workday GL account and cost center IDs into EDI 810 line-item codes are configured per customer.

A real-world example

A mid-sized manufacturer uses Workday Financial Management for AP, procurement, and GL, and operates a supplier portal via Cleo. When the procurement team creates a PO in Workday for a new supplier, it used to be exported as CSV, manually reformatted, and uploaded to Cleo by hand. Invoices from suppliers came into Cleo as files or EDI, were manually matched to Workday POs by a clerk, and then entered into Workday AP. With Workday and Cleo connected, new POs flow to Cleo automatically and are available to the supplier portal within minutes, while inbound supplier invoices are staged in Workday ready for matching and approval. The clerk's daily data entry work is reduced by 80 percent, and discrepancies between Workday and Cleo are caught immediately by the audit log.

What you can do

• •Poll Workday Financial Management for invoices, purchase orders, and supplier masters on a schedule you control, and deliver them to Cleo as EDI transactions or API payloads.
• •Handle Workday ISU authentication and OAuth2 token refresh, and Cleo OAuth2 credentials, so both sides stay authenticated without manual intervention.
• •Transform Workday GL accounts and cost centers into EDI 810 and 850 line-item codes based on your mapping rules.
• •Track every record from Workday through to Cleo with a full audit trail, so missed deliveries can be replayed without duplicating invoices or orders.
• •Respect Workday polling minimums and Cleo rate limits, with automatic retries and backoff so temporary network issues do not block the flow.

Questions

Which direction does data move between Workday Financial Management and Cleo?

The primary flow is Workday Financial Management to Cleo. Invoices, purchase orders, and supplier masters move from Workday into Cleo for distribution to trading partners or portal access. Cleo is the integration hub, not a source of truth for finance, so payment status and GL postings are read-only in this direction. If inbound invoices arrive in Cleo from external suppliers, they can be staged back to Workday AP for matching and approval.

How does ml-connector handle Workday's lack of webhooks?

Workday Financial Management has no native webhooks or change-data-capture streams. ml-connector polls Workday on a configurable schedule (typically every 30 minutes) using date-range filters on the Get operations for invoices and orders. It respects Workday's 5-minute minimum polling interval to avoid tenant-level rate throttling and automatically backs off if the tenant returns HTTP 429. Supplier master data is polled less frequently (daily or every 4 hours) since suppliers change less often than transactions.

What happens if Cleo is temporarily unavailable when ml-connector tries to deliver an invoice?

ml-connector logs the attempted delivery with a timestamp and source ID from Workday. If Cleo returns an error or is unreachable, the record is marked as pending in the audit trail and automatically retried on the next poll cycle with exponential backoff. Once Cleo confirms receipt, the record is marked delivered. You can query the audit log to see which invoices are pending and manually replay any that failed after the outage is resolved.