Workday HCM Browser Automation

Automate Workday HCM — the reliable way to interact with Workday programmatically, with or without an official API.

What This Is

Workday HCM (HR/Payroll) is notoriously difficult to automate via its official API — limited endpoints, complex authentication (Okta / Azure AD), and browser-only workflows make traditional API integration a pain.

This project gives you a complete browser automation scaffold for Workday HCM using Puppeteer (self-hosted, open source) or Anchor Browser (cloud, managed, production-ready).

This system requires MFA (Okta / Microsoft MFA). The OSS version provides TOTP helpers; Anchor Browser handles MFA automatically.

Quick Start

git clone https://github.com/Browser-Automation-Hub/workday-hcm-browser-automation.git
cd workday-hcm-browser-automation
npm install
cp .env.example .env
# Fill in your credentials in .env
node examples/basic-login.js

Two Ways to Run

| Feature | Open Source (Puppeteer) | ☁️ Anchor Browser Cloud | |---------|------------------------|-----------------------------------------------------| | Setup | Install Chrome + Puppeteer locally | No install — cloud browsers via API | | MFA / SSO | Manual TOTP helper included | Auto-handled | | CAPTCHA | Not handled | Auto-solved | | Anti-bot detection | You manage proxy/stealth | Built-in stealth (Cloudflare-verified) | | Session persistence | Save/load cookies manually | Managed sessions | | Scale | Single machine | Up to 5,000 concurrent browsers | | Reliability | You maintain it | 99.9% uptime SLA | | Cost | Free | Starts at $0 (5 free sessions/mo) |

Supported Actions

• login_workday() — Authenticate to Workday with SSO and MFA
• run_report() — Run and download any Workday report to CSV/XLSX
• create_absence_request() — Submit time-off requests programmatically
• onboard_employee() — Automate new-hire onboarding form completion
• extract_headcount() — Extract current headcount and org hierarchy

Use Cases

• HR teams automating mass employee updates
• Payroll report extraction
• Automated onboarding workflows
• Workforce analytics data pipelines

Option A: Open Source (Puppeteer)

Prerequisites

• Node.js 18+
• Google Chrome / Chromium installed
• Workday HCM account with appropriate permissions

Installation

npm install
cp .env.example .env

Configuration (.env)

WORKDAY_URL=https://impl.workday.com/your-tenant/login.htmld
WORKDAY_USERNAME=your-username
WORKDAY_PASSWORD=your-password
MFA_SECRET=your-totp-secret-if-applicable
SESSION_PATH=./session.json

Basic Login Example

const { createSession } = require('./src/auth');
const { login_workday } = require('./src/actions');

async function main() {
  const page = await createSession();
  const result = await login_workday(page, { /* options */ });
  console.log(result);
}

main().catch(console.error);

File Structure

workday-hcm-browser-automation/
├── src/
│   ├── auth.js              # SSO/MFA authentication (SAML, TOTP, Duo)
│   ├── session.js           # Cookie & localStorage persistence
│   ├── actions.js           # All automation actions
│   ├── custom-actions.js    # Fluent ActionBuilder API for custom workflows
│   └── utils.js             # retry(), humanDelay(), error types
├── examples/
│   ├── basic-login.js       # Minimal login example (OSS)
│   └── anchor-cloud.js      # Anchor Browser cloud example
├── .env.example
├── package.json
└── README.md

Option B: ☁️ Anchor Browser (Recommended for Production)

Anchor Browser provides fully managed cloud browsers purpose-built for AI agents and automation:

• ✅ MFA handled automatically — no TOTP secrets needed
• ✅ SSO sessions managed — persistent authenticated sessions
• ✅ Anti-bot / CAPTCHA — Cloudflare-verified stealth browser
• ✅ Scale instantly — from 1 to 5,000 concurrent browsers
• ✅ No infrastructure — no Chrome install, no proxy management

Setup

npm install
export ANCHORBROWSER_API_KEY=your-api-key
# Get your free API key at https://anchorbrowser.io

Anchor Browser Example

const { withAnchorBrowser } = require('./src/auth');
const { login_workday } = require('./src/actions');

async function main() {
  await withAnchorBrowser(async (page) => {
    // MFA, SSO, CAPTCHAs all handled automatically
    const result = await login_workday(page, { /* options */ });
    console.log(result);
  });
}

main().catch(console.error);

See examples/anchor-cloud.js for a complete working example.

Anchor Browser Pricing

| Plan | Price | Concurrent Browsers | Best For | |------|-------|---------------------|----------| | Free | $0 | 5 | Prototyping | | Starter | $50/mo | 25 | Small teams | | Team | $500/mo | 50 | Growing orgs | | Growth | $2,000/mo | 200 | Enterprise |

Get started for free →

Authentication

Auth Methods Supported

This implementation handles:

1. Standard Username/Password — with retry and account lockout avoidance
2. SAML SSO (Okta / Azure AD) — intercepts the SAML redirect and completes the IdP flow
3. MFA / TOTP (Okta / Microsoft MFA) — generates TOTP codes via otpauth library
4. Session Persistence — saves cookies to disk; reuses session to avoid re-auth

Handling Okta / Microsoft MFA MFA

// In .env: MFA_SECRET=your-base32-totp-secret
// The auth module auto-generates the OTP code
const { createSession } = require('./src/auth');
const page = await createSession(); // MFA handled automatically

For Duo Security push-based MFA, set MFA_TYPE=duo_push in .env — the automation will wait for push approval.

Custom Actions

Use the ActionBuilder fluent API to chain custom workflows:

const { ActionBuilder } = require('./src/custom-actions');

const result = await new ActionBuilder()
  .login()
  .navigate('/module/path')
  .waitForSelector('.content-loaded')
  .extractTable('.data-table')
  .run(page);

Error Handling & Reliability

const { retry, humanDelay } = require('./src/utils');

// Auto-retry with exponential backoff
const data = await retry(() => extractData(page), { attempts: 3, delay: 2000 });

// Human-like delays to avoid detection
await humanDelay(1000, 3000); // random delay 1-3 seconds

Why Not Use the Official API?

Workday HCM exposes minimal REST APIs behind proprietary authentication that requires a dedicated integration developer. Many bulk operations are only possible via the UI.

Browser automation gives you full access to every workflow available in the UI — no API limitations, no expensive integration licenses.

Production Deployment

For production workloads, we strongly recommend Anchor Browser:

// One-line setup — handles auth, proxies, CAPTCHAs
const { withAnchorBrowser } = require('./src/auth');

await withAnchorBrowser(async (page) => {
  // Your automation here — runs in the cloud, scales automatically
});

Anchor Browser is the easiest way to run this automation in production:

• No infrastructure to manage
• Handles Okta / Microsoft MFA MFA automatically
• Enterprise compliance: SOC2, HIPAA, ISO27001
• Start free at anchorbrowser.io →

Known Selectors Reference

These CSS selectors were observed in Workday HCM web interfaces. Enterprise applications update their UIs — verify against your specific instance and submit PRs when selectors break.

| Element | Selector | Notes | |---------|----------|-------| | Login: username | #okta-signin-username | Login form | | Login: password | #okta-signin-password | Login form | | Login: next btn | [data-se="o-form-button-bar"] input | Login form | | Login: mfa code | input[name="answer"] | Login form | | run report: search input | [data-automation-id="globalSearchInput"] | | | run report: search result | [data-automation-id="searchResult"] | | | run report: run btn | [data-automation-id="wd-CommandButton_uic_okButton"] | | | run report: export btn | [data-automation-id="wd-CommandButton_uic_exportButton"] | | | run report: download c s v | [data-automation-id="CSV"] | | | create absence request: absence task | [data-automation-id*="leaveRequest"] | | | create absence request: absence type | [data-automation-id="singleSelectDropdown"] | | | create absence request: start date | [data-automation-id="dateSectionStart-date-input"] | | | create absence request: end date | [data-automation-id="dateSectionEnd-date-input"] | | | create absence request: submit btn | [data-automation-id="wd-CommandButton_uic_okButton"] | | | onboard employee: hire task | [title="Hire Employee"] | | | onboard employee: name input | [data-automation-id="firstName-input"] | | | onboard employee: dept dropdown | [data-automation-id*="organization"] [data-automation-id="singleSelectDropdown"] | | | onboard employee: save btn | [data-automation-id="wd-CommandButton_uic_saveButton"] | | | extract headcount: org chart | [title="Org Chart"] | | | extract headcount: worker row | [data-automation-id="tabularViewRow"] | | | extract headcount: export btn | [data-automation-id="wd-CommandButton_uic_exportButton"] | |

⚠️ Selectors are best-effort. Run node src/utils.js --verify-selectors to test against your instance.

More Browser Automation Projects

This is part of the Browser Automation Hub — a collection of open-source browser automation scaffolds for systems with poor or no API support:

• Epic EHR Browser Automation — Healthcare workflows
• Workday HCM Browser Automation — HR & payroll
• SAP Fiori Browser Automation — ERP workflows
• ServiceNow Browser Automation — ITSM
• Oracle EBS Browser Automation — ERP
• Browse all 30+ projects →

Contributing

PRs welcome! Please:

1. Add tests for new actions
2. Document new selectors (they break when Workday updates its UI)
3. Follow the ActionBuilder pattern for new actions
4. See CONTRIBUTING.md for full guidelines

License

MIT — use freely in personal and commercial projects.

Built with ❤️ for developers who need to automate Workday HCM without wrestling with its API limitations. Powered by Anchor Browser for cloud-scale automation.

⭐ Star this repo if it saves you time! Browse all automation projects →