Workday Financial Management and Looker integration

What moves between them

Financial data flows from Workday Financial Management into Looker. ml-connector polls Workday's suppliers, invoices, purchase orders, GL accounts, payments, and journal entries on a schedule you define (typically 15 minutes to one hour apart, aligned with your close calendar). Each record is normalized and delivered to Looker's connected data warehouse, where Looker's semantic layer models it for dashboards and reports. The sync is unidirectional: Looker is read-only for analysis, not a source for write-back. Workday's ISU account provides full visibility into all entities the ISU is granted access to.

How ml-connector handles it

ml-connector stores the Workday ISU credentials encrypted and refreshes Looker's OAuth2 bearer token every 55 minutes to avoid expiration. On the Workday side, ml-connector accepts the tenant hostname and validates the ISU account has security group assignments for the financial entities you want to extract. It polls Workday's SOAP or REST endpoint using date-range filters to avoid duplicate fetches and to respect the minimum safe polling interval of 5 minutes (intervals shorter than 5 minutes may trigger Workday's rate throttling). Since Workday has no delta indicators, each poll window fetches all records modified since the last run. On the Looker side, ml-connector stages data in your connected warehouse (Snowflake, BigQuery, etc.) as staging tables, and Looker's semantic layer then models those tables for use in looks, dashboards, and scheduled exports. Every fetch and load carries a job ID and timestamp for replay if a downstream warehouse load fails. ml-connector also tracks Workday API rate limits and backs off when throttled.

A real-world example

A mid-market professional services firm runs Workday Financial Management for their AP, AR, and GL. Their finance team wants to analyze vendor spend, invoice aging, and budget-vs-actual by cost center and project. With Workday and Looker connected, the accounting team stops exporting invoices and GL balances from Workday to build spreadsheets for analysis. Instead, the data flows automatically into Looker each morning, where finance managers have live dashboards showing top vendors by spend, invoice aging by supplier, and a month-end close dashboard reconciling Workday GL accounts to budget. The CFO can now drill from spend trends down to individual invoices without leaving Looker.

What you can do

• •Poll Workday suppliers, invoices, purchase orders, GL accounts, and payments on a schedule you control, with date-range filters to avoid duplicates.
• •Authenticate Workday with ISU credentials and WS-Security, and Looker with OAuth2, refreshing tokens automatically before expiration.
• •Load normalized financial records into Looker's connected warehouse so the semantic layer can model them for dashboards and reports.
• •Track polling state and job IDs for every extract, with replay capability if a warehouse load fails.
• •Validate ISU account security group assignments and respect Workday's minimum polling interval and rate limits to avoid throttling.

Questions

Does ml-connector write data back into Workday from Looker?

No. The sync is one-way from Workday Financial Management into Looker. Looker is a read-only analytics layer; it does not write invoices, GL entries, or payments back into Workday. If you need to push corrections or new transactions into Workday, use Workday's native update APIs or a separate inbound integration.

How does ml-connector handle Workday's lack of webhooks and change-data-capture?

ml-connector polls Workday on a schedule you define (typically 15 minutes to one hour), using date-range filters to fetch only records modified since the last run. The minimum safe polling interval is 5 minutes. Because Workday has no delta indicator, each poll returns all modified records in the window. ml-connector tracks the last fetch time and job ID to avoid re-processing the same data.

What happens when Looker's OAuth2 token expires after one hour?

ml-connector refreshes Looker's bearer token every 55 minutes by calling POST /api/4.0/login again with the client credentials. This happens automatically before any query or load step, so your polling schedule is not interrupted. If Looker's token expires in-flight, ml-connector retries with a fresh token.