Authenticate to the Dayforce Web Services API using the password grant flow and retrieve employee HR data via the RESTful Employee HR Data endpoint.
domain: help.dayforce.com · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
In Dayforce, create a dedicated Web Services user account and note the CompanyId (client namespace) that identifies your tenant.
POST to the Dayforce Identity token endpoint (production: https://dfid.dayforcehcm.com/connect/token, test: https://dfidtst.np.dayforcehcm.com/connect/token) using the OAuth2 resource-owner password credentials grant, supplying the CompanyId, the Web Services username, and its corresponding secret, with the client scope fixed to Dayforce's HCM Anywhere client identifier.
Extract the returned JSON Web Token's access_token field and its expires_in value (typically 3600 seconds) from the response.
Call the RESTful Get Employee XRefCodes endpoint to identify which workers you can retrieve, then call RESTful Get Employee HR Details with the access token in the Authorization header to pull their HR data.
Use the documented paging mechanism on list responses to iterate through results for larger employee populations.
Request a new access token once the current one nears expiry, since Dayforce access tokens are not silently renewed.
Known gotchas
Access tokens cannot be revoked once issued, so treat the Web Services account's underlying secret as the actual security boundary and rotate it if a token may have leaked.
The token request must target the correct environment host (production vs test) — tokens minted against the test identity server will not authenticate against production APIs.
Dayforce documents both SOAP and RESTful web services for overlapping data (e.g., employee HR data); confirm which style your integration should use, since endpoint shapes and paging differ between the two.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?