Workday Financial Management and SFTP / Flat Files integration

What moves between them

The main flow runs from Workday Financial Management into SFTP. ml-connector polls Workday for new supplier invoices, purchase orders, GL transactions, and journal entries on a schedule you set (typically 15-60 minutes for invoices and transactions, daily for suppliers). It transforms each record into the flat-file format your downstream systems expect: CSV columns, X12 EDI segments, or fixed-width records. The formatted files are deposited into the SFTP server's inbound folder, and ml-connector monitors the acks folder for X12 997 or EDIFACT CONTRL acknowledgments to confirm receipt.

How ml-connector handles it

ml-connector stores the Workday Integration System User credentials (for SOAP) or OAuth2 refresh token (for REST) encrypted and uses REST by default for faster polling of invoices and GL accounts. It accepts the full Workday tenant hostname per customer and validates that every API call is within the ISU's security group permissions before processing. On the SFTP side, it stores the SSH private key encrypted and presents it at the SSH layer on every file transfer, with optional key passphrase and host key verification enabled to prevent MITM attacks. Because Workday has no webhooks, ml-connector polls on your cadence and buffers records in batches before writing to SFTP. For each trading partner, you configure the file format (CSV headers, X12 segment order, fixed-width column positions) and folder structure (inbound/, outbound/, acks/). ml-connector maps Workday GL account codes and cost center worktags to the correct file columns, applies date-range filters to avoid re-sending old records, and monitors the acks folder for X12 997 or EDIFACT CONTRL acknowledgments so you know which files were successfully processed downstream. If a file upload fails or an acknowledgment is missing, ml-connector retries and logs the event with full context so you can replay it.

A real-world example

A mid-market distribution company runs Workday Financial Management in the cloud for invoicing and GL, but their on-premise warehouse management system (WMS) and legacy AP system are file-based and do not have REST APIs. Before the integration, the finance team exported supplier invoices and GL transactions from Workday as CSV files once a day, manually reviewed them for accuracy, and then uploaded them to the WMS and AP systems via SFTP. With Workday Financial Management and SFTP / Flat Files connected, new invoices and journal entries flow automatically to both downstream systems every hour, formatted as CSV and placed in the right folders. The manual export and upload steps are gone, and the finance team can focus on exception handling rather than routine file shuffling.

What you can do

• •Export Workday Financial Management supplier invoices and purchase orders to SFTP as CSV or X12 EDI files on a schedule you control.
• •Map Workday GL accounts and cost center worktags to flat-file columns so downstream systems receive correctly coded transactions.
• •Present SSH keys with optional passphrases and host key verification to secure SFTP transfers against man-in-the-middle attacks.
• •Monitor SFTP acks folders for X12 997 or EDIFACT CONTRL acknowledgments and alert when files are not confirmed downstream.
• •Poll Workday on 15 to 60 minute intervals without re-sending old records, with full audit trails and replay for failed transfers.

Questions

Why poll Workday instead of waiting for webhooks?

Workday Financial Management has no native webhooks or change-data-capture for financial entities. It offers Outbound Messaging but requires admin setup per business process and is not suitable for high-volume transactional polling. ml-connector uses date-range filters on REST Get calls to poll at your chosen interval (15 to 60 minutes for invoices and GL) and avoids re-sending records already processed.

How does ml-connector secure the SSH key on SFTP?

ml-connector stores the SSH private key encrypted in the same Postgres vault as Workday credentials and presents it at the SSH layer on every SFTP file transfer. You can optionally configure a key passphrase and enable host key verification so the connector authenticates the SFTP server's identity, preventing an attacker from intercepting files in transit.

What happens if an X12 acknowledgment does not arrive?

ml-connector monitors the SFTP acks folder for X12 997 or EDIFACT CONTRL acknowledgments after each file upload. If no acknowledgment appears within a configurable timeout (typically 24 hours), ml-connector alerts you with the file name and the last known state, and you can inspect logs to see whether the downstream system received the file or encountered an error.