Orchestrate WCP Request API: "S5 Invalid ID" on onBehalfOf for Segmented Workers
What does "400 Bad Request - S5 (Invalid id for field): onBehalfOf" mean in Workday Orchestrate?
The REST API's onBehalfOf field only resolves against workers the calling Integration System User (ISU) can already see. If the target worker is protected by segment-based security, Workday validates onBehalfOf against the ISU's own worker-data visibility, not just its transaction ("Put") access to the Submit Request service domain, so a worker inside a segment the ISU can't see comes back as an invalid ID even though the WID itself is completely valid.
Quick fix
Add the specific Security Segment(s) the target workers belong to to the ISU's segment-based security group, then retry the request. Grant only the segments the integration actually needs, not the full set.
Permanent fix
Treat segment membership as part of the integration's security setup: record which segments onBehalfOf resolution depends on, and add newly created segments to the group as part of the change that creates them. Do not resolve this by granting the ISU unconstrained, tenant-wide View access to Worker Data. That defeats the segmentation the tenant deliberately configured, widens the integration's reach far beyond what it needs, and will not survive a security review. If segments change often, the durable answer is a documented review step when they are added, not a broader grant.
Troubleshooting
- Confirm the ISU's security group has access to the relevant Worker Data domain(s) for the affected Security Segment - not just "Put" access on the Submit Request (Web Service) domain, since those are two separate security checks.
- Check whether the domain security policy needs an explicit "Unconstrained" grant (vs. constrained-by-segment) for the ISU's security group - segment-based security domains often require this to bypass segment filtering for integration users.
- Reproduce the same onBehalfOf call for a worker outside any segment to confirm the failure is isolated to segment visibility rather than the endpoint, payload, or BP configuration.
- Check View access on the Security Segment object itself (the Segment-Based Security Group) for the ISU's security group - some tenants require this in addition to Worker Data domain access.