Orchestrate WCP Request API: "S5 Invalid ID" on onBehalfOf for Segmented Workers
What it means
The REST API's onBehalfOf field only resolves against workers the calling Integration System User (ISU) can already see. If the target worker is protected by segment-based security, Workday validates onBehalfOf against the ISU's own worker-data visibility, not just its transaction ("Put") access to the Submit Request service domain, so a worker inside a segment the ISU can't see comes back as an invalid ID even though the WID itself is completely valid.
Troubleshooting
- Confirm the ISU's security group has access to the relevant Worker Data domain(s) for the affected Security Segment - not just "Put" access on the Submit Request (Web Service) domain, since those are two separate security checks.
- Check whether the domain security policy needs an explicit "Unconstrained" grant (vs. constrained-by-segment) for the ISU's security group - segment-based security domains often require this to bypass segment filtering for integration users.
- Reproduce the same onBehalfOf call for a worker outside any segment to confirm the failure is isolated to segment visibility rather than the endpoint, payload, or BP configuration.
- Check View access on the Security Segment object itself (the Segment-Based Security Group) for the ISU's security group - some tenants require this in addition to Worker Data domain access.
Add the ISU's security group to the unconstrained "Who Can See" list of the specific Security Segment(s) the target workers belong to, then retry the request.
Grant the integration's ISU security group unconstrained View access to Worker Data at the tenant level rather than scoping it to today's known segments, so future segment additions don't silently break onBehalfOf resolution again; document the requirement in the integration's security setup runbook.