---
name: iblai-connect-workday-student
description: "Read and write Workday Student data through the Workday Web Services (SOAP), Workday REST API, Reports as a Service (RaaS) and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with Workday Student data, or to set up a Workday Student MCP connection on ibl.ai."
metadata:
  kind: guide
---

# Workday Student connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/workday-student — not part of the iblai/vibe repository. Checked against Workday's documentation on October 20, 2026; test it against your own Workday Student setup before you rely on it.

Workday Student is Workday's cloud student system for higher education. Its web services cover student records, admissions, student recruiting, academic advising, student finance, financial aid, transfer credit and campus engagement.

## Auth & conventions

- **API:** Workday Web Services (SOAP), Workday REST API, Reports as a Service (RaaS) (Mixed). Versioned SOAP services for Student (Student_Records, Admissions, Student_Recruiting, Student_Finance, Financial_Aid, Academic_Advising, Student_Core and more, v47.0), Workday REST endpoints with JSON, and custom reports exposed as web services (RaaS).
- **Access:** Issued by your administrator. Credentials come from the institution's Workday tenant: typically an Integration System User for SOAP and RaaS, or OAuth for REST. Every call is limited by Workday's configurable security groups.
- **Auth:** WS-Security UsernameToken (Integration System User); OAuth 2.0 (REST). SOAP requests carry a WS-Security username and password in the SOAP header, usually for an Integration System User. REST uses OAuth and acts as the signed-in user or integration system under Workday's security model.
- Keep Workday Student credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Course sections** — Student_Records Get_Course_Sections returns one section by reference, or all sections if none is given.
- **Student courses** — Student_Records Get_Student_Course returns student course definitions.
- **Registration schedules** — Get_Student_Schedules_for_Registration returns student schedules for enrollment.
- **Student accomplishments** — Get_Student_Accomplishments returns student achievement records.
- **Custom reports (RaaS)** — Any custom report the tenant enables as a web service can be called for its rows.

## Writes

- **Register a student** — Put_Student_Course_Registered_Registration creates a student course registration.
- **Drop a registration** — Put_Student_Course_Dropped_Registration unregisters students from courses. **Confirm with the user first.**
- **Course sections** — Put_Course_Sections creates or changes course section details.
- **Program completion** — Submit_Program_Completion submits a program for completion through its business process. **Confirm with the user first.**

## Expose it to an ibl.ai agent (MCP)

Workday publishes an official MCP server, Workday Agent-Ready Tools (MCP) (https://www.workday.com/en-us/ai-platform/agent-tools-mcp.html). Register it below as-is, or host your own server that wraps the calls in this skill.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - For an API key or service credential use `auth_type=token` with `auth_scope=platform` for one key across the organization, or scope it to a single agent for one key per agent.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "List all course sections offered in Spring 2027 for the Biology department"
- "Show this student's registered courses for the current term"
- "Run our 'Holds by Student' RaaS report and summarize holds by type"
- "Register this student in section BIO-101-02 after I confirm"

## Guardrails

- Student records are FERPA education records; financial aid and student finance services also carry family financial data. Give the Integration System User only the security groups a task needs.
- Request the narrowest Workday Student scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Page through large result sets and back off on rate-limit responses instead of retrying in a loop.

## References

- Workday Web Services directory (v47.0): https://community.workday.com/sites/default/files/file-hosting/productionapi/index.html
- Student_Records web service: https://community.workday.com/sites/default/files/file-hosting/productionapi/Student_Records/v47.0/Student_Records.html
- Agent-Ready Tools and MCP: https://www.workday.com/en-us/ai-platform/agent-tools-mcp.html
- Workday Agent-Ready Tools (MCP): https://www.workday.com/en-us/ai-platform/agent-tools-mcp.html
- This connector on ibl.ai: https://ibl.ai/developer/connectors/workday-student
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections