Skip to main content
RickBabo
New Participant
September 2, 2026
Question

Workday Submit PTO plugin - Workday Connector

  • September 2, 2026
  • 2 replies
  • 50 views

We’ve been trying to implement the Submit PTO plugin for Moveworks, but we’re facing a few permission errors. When we start the conversation to submit the PTO Moveworks gathers all the information: PTO type, amount of time and so on but when trying to submit we’re getting the following errors:
 

and also:
 


I’m wondering if this issue is on the Workday side or could it be an issue with the Workday Connector’s Scopes?

Is there scopes missing from the Workday Connector or is it something related to Workday configuration itself?

    2 replies

    Kevin Mok
    Kevin Mok
    Community Manager
    September 2, 2026

    Hey ​@RickBabo Thanks for including the execution details. The screenshots narrows this down.

    The plugin is failing before it submits the PTO request. The current query is being denied:
     

    SELECT workdayID, fullName, businessTitle, email_PrimaryWork,
           employeeID, supervisoryOrganization
    FROM allWorkers
    WHERE email_PrimaryWork = "..."

    When Workday returns HTTP 403 with S22: permission deniedThat means the request reaches Workday, but the Workday account behind the connector cannot access the data source or one of the requested fields.

    I would check these areas:

    • Confirm the API client includes the System scope required for WQL.
    • Confirm the connected Workday account belongs to the expected security group.
    • Grant that group access to Workday Query Language, Worker Data: Workers, Worker Data: Worker ID, Worker Data: Public Worker Reports, and the required work-contact domains.
    • Run Activate Pending Security Policy Changes after updating the group.

    Can the same Workday account run this exact WQL query through Workday’s API Explorer? If it also fails there, this is a Workday security configuration issue. If it succeeds, we can compare the connector’s authentication context with the API Explorer request.

      RickBaboAuthor
      New Participant
      September 3, 2026

      Thanks for the reply, clarification, the System scope is to be added on the Workday’s side correct? Also should the Moveworks Workday Connector have any additional scopes added?

      Terms & ConditionsAccessibility statement