Workday Student

1Kosmos Achieves DoW IL4 Authorization to Secure Military Identities and Mission Access

Workday Student

Integration type

SIS (Student Info System)

What we solve

Workday Student institutions need a reliable way to verify student (and worker) identity during onboarding and before sensitive transactions (financial aid, payroll changes) because Workday processes are highly automated and high-risk actions can’t rely on email/password or manual checks. This integration inserts 1Kosmos identity verification into Workday’s Business Process Framework (BPF) as an integration step, uses Workday OAuth and SOAP/REST/RAAS interfaces to trigger proofing and write back IAL2 verification status to Workday custom objects, and can enforce step-up via OIDC ACR claims for high-assurance actions.

Integration architecture

Workday's Business Process Framework (BPF) is the primary integration hook. Every transactional action in Workday (hire a worker, enroll a student, approve a financial aid award) passes through a configurable business process with checkpoints where external integrations can be inserted.

OAuth 2.0 setup

Touchpoint 1 — Hire/Onboard business process integration 1Kosmos is configured as an Integration System within Workday. The institution inserts an "Identity Verification Required" step into the "Hire Employee" or "Admit Student" business process. When triggered:

SOAP: Initiate_Workday_Integration_Event_Request
  <integration_system_reference>1Kosmos_Verify</integration_system_reference>
  <worker_reference>{WORKER_ID}</worker_reference>
  <integration_event_data>
    <event_type>IDENTITY_VERIFICATION</event_type>
    <target_email>{email}</target_email>
  </integration_event_data>

SOAP: Initiate_Workday_Integration_Event_Request
  <integration_system_reference>1Kosmos_Verify</integration_system_reference>
  <worker_reference>{WORKER_ID}</worker_reference>
  <integration_event_data>
    <event_type>IDENTITY_VERIFICATION</event_type>
    <target_email>{email}</target_email>
  </integration_event_data>

SOAP: Initiate_Workday_Integration_Event_Request
  <integration_system_reference>1Kosmos_Verify</integration_system_reference>
  <worker_reference>{WORKER_ID}</worker_reference>
  <integration_event_data>
    <event_type>IDENTITY_VERIFICATION</event_type>
    <target_email>{email}</target_email>
  </integration_event_data>

1Kosmos receives this event, creates an IDV session, and sends the proofing link. On completion, 1Kosmos calls back to Workday:

SOAP: Put_Worker_Additional_Data_Request
  <worker_reference>{WORKER_ID}</worker_reference>
  <additional_data>
    <custom_object_data>
      <field_and_value>
        <field_reference>IDV_Status</field_reference>
        <value>IAL2_Verified</value>
      </field_and_value>
    </custom_object_data>
  </additional_data>

SOAP: Put_Worker_Additional_Data_Request
  <worker_reference>{WORKER_ID}</worker_reference>
  <additional_data>
    <custom_object_data>
      <field_and_value>
        <field_reference>IDV_Status</field_reference>
        <value>IAL2_Verified</value>
      </field_and_value>
    </custom_object_data>
  </additional_data>

SOAP: Put_Worker_Additional_Data_Request
  <worker_reference>{WORKER_ID}</worker_reference>
  <additional_data>
    <custom_object_data>
      <field_and_value>
        <field_reference>IDV_Status</field_reference>
        <value>IAL2_Verified</value>
      </field_and_value>
    </custom_object_data>
  </additional_data>

Touchpoint 2 — RAAS (Report as a Service) polling For simpler deployments, 1Kosmos uses Workday's RAAS endpoint to poll for new hires or students who lack a verified identity record:

Touchpoint 3 — Step-up for financial transactions Workday's REST API supports OAuth 2.0 OIDC. When a user initiates a high-value transaction (financial aid disbursement, payroll change), the Workday front-end can redirect to 1Kosmos with an OIDC ACR claim for IAL2 assertion before allowing the action to proceed.

Integration complexity: High

Workday's business process framework is powerful but requires certified Workday Studio or EIB expertise. Maintaining SOAP/REST dual-API integrations across Workday's bi-annual release cycles adds ongoing maintenance overhead. ISV partnership with Workday is recommended before pursuing this integration.

Transform how you verify and authenticate

Secure onboarding, eliminate passwords, and stop fraud on one platform. Schedule a demo and see it in action.

Request a demo

Talk to sales

Transform how you verify and authenticate

Secure onboarding, eliminate passwords, and stop fraud on one platform. Schedule a demo and see it in action.

Request a demo

Talk to sales

Transform how you verify and authenticate

Secure onboarding, eliminate passwords, and stop fraud on one platform. Schedule a demo and see it in action.

Request a demo

Talk to sales