Workday Financial Management and ShipBob integration

What moves between them

Purchase orders and supplier invoices move from Workday to ShipBob for fulfillment planning and execution. ShipBob webhooks push shipment tracking, warehouse receiving events, and return notifications back into Workday's procurement ledger, where they are matched to the original purchase order and supplier. Goods receipt entries in Workday record when ShipBob's fulfillment centers receive inbound inventory from suppliers. The flow is bidirectional: master data like supplier lists and product catalogs are polled from Workday, and transactional records from ShipBob update Workday on a webhook-driven cadence with poll-based reconciliation as backup.

How ml-connector handles it

ml-connector stores Workday ISU credentials for SOAP calls and OAuth2 refresh tokens for REST reads, presenting them with the required security headers. On ShipBob, it stores the Personal Access Token and channel ID and validates webhook signatures with the HMAC-SHA256 v1 envelope before processing events. Inbound shipment and receiving webhooks from ShipBob trigger a lookup of the associated purchase order in Workday, then write goods receipt and shipment tracking journal entries into Workday's procurement ledger, keyed to the supplier and PO. Because Workday offers no webhooks, ml-connector polls the procurement API on a schedule (typically every 30 minutes for new POs) to seed ShipBob with upcoming orders for fulfillment. Rate limits on both sides are handled with exponential backoff: Workday's 5-minute minimum safe interval is respected, and ShipBob's OAuth token expiry at 1 hour is tracked so token refresh does not interrupt the flow. Every record in both systems is tagged with the source transaction ID and carries a full audit trail so failed writes can be replayed.

A real-world example

A mid-sized e-commerce brand runs Workday for procurement and payables and uses ShipBob to fulfill orders across three regional fulfillment centers. Before the integration, when a purchase order was created in Workday for new inventory, the procurement team manually fed the order details into ShipBob to start the picking process. When ShipBob received goods or shipped orders, the fulfillment team manually logged those receipts and shipments back into Workday so inventory counts would match. With Workday and ShipBob connected, each new Workday purchase order automatically feeds into ShipBob, ShipBob's warehouse receiving webhooks create goods receipt entries in Workday, and shipment tracking flows straight into Workday's procurement journal. The procurement team no longer re-keys orders, inventory visibility is real-time, and month-end reconciliation of POs to received goods is automated.

What you can do

• •Sync Workday purchase orders and supplier invoices to ShipBob for fulfillment planning and execution.
• •Receive ShipBob warehouse receiving (WRO) webhooks and write goods receipt entries into Workday's procurement ledger.
• •Update Workday with ShipBob shipment tracking and return notifications, linked to the originating purchase order and supplier.
• •Authenticate Workday with SOAP Integration System User credentials and OAuth2 refresh tokens, and ShipBob with Personal Access Token and channel ID.
• •Poll Workday procurement on a schedule, write to ShipBob on webhook events, and maintain a full audit trail for every record and transaction.

Questions

Which direction does data move between Workday Financial Management and ShipBob?

Purchase orders and supplier invoices move from Workday to ShipBob for fulfillment. ShipBob webhooks push shipment tracking, warehouse receiving events, and returns back into Workday's procurement ledger, where they are matched to the originating purchase order. Workday goods receipt entries record what arrived at ShipBob's fulfillment centers. The flow is bidirectional: master data like suppliers flows from Workday, and transactional events flow from ShipBob.

How does ml-connector handle Workday's lack of webhooks and ShipBob's webhook-only design?

Workday is polled on a schedule (typically every 30 minutes) to read new purchase orders and supplier invoices and detect changes. ShipBob is webhook-driven for real-time shipment and receiving events, with poll-based reconciliation as a backup to ensure no events are lost. ml-connector respects Workday's 5-minute minimum safe polling interval to avoid rate limits and manages ShipBob's 1-hour OAuth token lifetime so authentication does not lapse.

How does the integration authenticate each system?

Workday requires an Integration System User account with WS-Security UsernameToken credentials for SOAP calls and OAuth2 refresh tokens for REST reads; ml-connector stores both encrypted. ShipBob uses a Personal Access Token and channel ID; all calls carry the required Authorization Bearer header and shipbob_channel_id header. Webhook signatures from ShipBob are verified with HMAC-SHA256 before any data is written to Workday.