Create or identify a Workday custom report and enable it as a web service in Workday: edit the report, check 'Enable as a Web Service', and note the report URL shown under the Web Services section.
The RaaS endpoint follows the pattern https://wd2-impl-services1.workday.com/ccx/service/customreport2/TENANT/OWNER/REPORT_NAME (the exact subdomain and path depend on your Workday environment and data center; retrieve the authoritative URL from the report's web service settings).
Authenticate using HTTP Basic auth with an Integration System User (ISU) that has been granted a security segment permitting access to the report's data sources; OAuth 2.0 is also supported on newer Workday tenants.
Append format=json or format=csv as a query parameter to control output format; the default XML format is also valid but less convenient for most integrations.
Parse the response: JSON output wraps records in a 'Report_Entry' array; handle paging if the report has a prompt for effective date or offset.
Known gotchas
RaaS reports run as the report owner's security context unless the ISU is explicitly granted access; reports that reference restricted data (e.g., compensation) require careful security group configuration to avoid empty result sets without an error.
Large reports can time out at the HTTP gateway; for high-volume extracts, add report filters or date range prompts to batch the extraction, or use Workday's REST API or PECI (payroll) extracts instead.
The report URL contains the report owner's Workday username; if the owner's account is deactivated or renamed, the URL breaks and must be updated to a new owner.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp