Workday Financial Management and Plaid integration

What moves between them

Bank account balances and transactions flow from Plaid into Workday. When a transaction appears in a connected bank account, Plaid sends a webhook notification (TRANSACTIONS SYNC_UPDATES_AVAILABLE). ml-connector receives the webhook, verifies the ES256 signature, fetches the new transactions and current balance from Plaid's REST API, and posts a journal entry in Workday's general ledger tied to the connected bank GL account. The cash GL account balance then reflects the bank, and each transaction is logged in Workday's audit trail with the Plaid transaction ID and timestamp so the entry can be traced back to the bank statement.

How ml-connector handles it

ml-connector stores the client_id, secret, and per-account Plaid access tokens encrypted, and refreshes tokens when calls return 401. It validates the ES256 JWT signature on every incoming webhook by fetching Plaid's public JWK and checking that the iat claim is within 5 minutes; this prevents webhook replay and spoofing. When a TRANSACTIONS webhook arrives, ml-connector queries the transactions/sync endpoint to fetch new and removed transactions, then calls accounts/get to read the current balance. It matches each transaction to a Workday GL account mapped during setup and posts journal entries with the Plaid transaction ID as the external key so duplicate posts are skipped. On the Workday side it uses SOAP for journal submission because REST does not support journal creation as of v46.1; ISU credentials authenticate the SOAP call. Because Plaid's transaction history extends only 24 months and supports cursor-based pagination, ml-connector tracks the last synced transaction date and cursor per account so new transactions are never missed. Transfer writes (ACH or wire out of a connected account) are acknowledged via Plaid webhooks (TRANSFER TRANSFER_EVENTS_UPDATE) and logged in Workday as cash disbursements.

A real-world example

A mid-sized professional services firm runs Workday Financial Management for billing, expense tracking, and general ledger operations. The finance team manages operations accounts and client trust accounts through a connected bank. Before the integration, the accounting team downloaded bank statements every morning and manually created reconciliation entries in Workday, a process that took 30 minutes daily and often had timing differences if transactions cleared overnight. With Workday and Plaid connected, each bank transaction triggers a Plaid webhook, ml-connector pulls the transaction and posts a journal entry into Workday's cash accounts in real time, and the bank rec reconciles automatically at month end with zero manual keying.

What you can do

• •Read bank account balances and transactions from Plaid via REST API and post them into Workday's general ledger as journal entries tied to the correct cash GL account.
• •Trigger reconciliation entries when Plaid sends transaction webhooks (TRANSACTIONS SYNC_UPDATES_AVAILABLE), with no polling lag between bank posting and Workday entry.
• •Verify Plaid webhook signatures using ES256 JWT and public JWK lookup to prevent spoofed or replayed webhooks.
• •Authenticate Workday's SOAP interface with ISU credentials and Plaid REST with client credentials plus per-account OAuth tokens, refreshing on 401.
• •Track transaction cursors and dates per bank account so new transactions are synced without gaps or duplication, with every entry logged in Workday's audit trail.

Questions

How does ml-connector handle the difference between Workday SOAP and REST APIs?

Workday's REST API does not support journal entry creation as of v46.1, so ml-connector uses SOAP for posting cash reconciliation entries via the Financial_Management service and WS-Security UsernameToken auth. It reads cash GL accounts and Worktags via REST where available to reduce overhead, then switches to SOAP only for the submit operation.

What happens if a Plaid webhook fails to be delivered or the signature is invalid?

ml-connector requires a 200 response from the webhook endpoint within 10 seconds per Plaid contract. If the webhook is not delivered, Plaid retries for up to 24 hours with exponential backoff. If the signature validation fails (ES256 JWT verification with public JWK, or iat claim older than 5 minutes), ml-connector rejects it as a 401 to prevent posting a spoofed transaction.

Can ml-connector sync outbound transfers initiated in Workday back to Plaid?

No. Plaid's transfer write operations (ACH, wire) must be initiated through Plaid's endpoints, not through Workday. ml-connector listens for Plaid TRANSFER webhooks so it can log outbound payments as disbursement entries in Workday, but the actual transfer initiation happens outside Workday via Plaid's application interface or partner systems.