RaaS 400 Validation Error Naming A Disjunctive-Secured Organization Data Source
What does "400 : Validation error occurred. The entered information" mean in Workday RaaS?
Your Report-as-a-Service call comes back with a 400 that names a security setting instead of saying anything about your request. The report itself is fine. The data source behind it is secured by a domain your integration system user has not been granted, and Workday reports that as a field restriction rather than as a permission error.
Quick fix
Grant the ISU's integration system security group Get access to every domain that secures the report's data source, not only the obvious organization domain, then run Activate Pending Security Policy Changes and retry the URL.
Permanent fix
Treat sharing a report with an ISU and securing the report's data source as two separate jobs, because they are. When you build a RaaS report for an integration, look up the data source's full domain list at design time and grant all of them up front. Keep a short note against each integration recording which domains its ISU needs, so a later data source change does not turn into a fresh round of guesswork.
Troubleshooting
- Run the report in the Workday UI as yourself. If it returns rows there but fails over RaaS, the report definition is not the problem and this is purely an ISU permission gap.
- Read the text inside the parentheses carefully. Workday is naming the securing element it rejected, and that name is your best clue about which domain is missing.
- Run View Custom Report on the report and note its Data Source. Then run View Data Source on that data source and list every domain shown as securing it. A single data source is frequently secured by more than one domain.
- Run View Security Group on the Integration System Security Group that contains the ISU, and compare its domain security policies against the list from step 3.
- Grant the missing domain to that security group with both Get and Put access, then run Activate Pending Security Policy Changes. Nothing takes effect until you activate.
- Retry the RaaS URL. If the error now names a different securing element, go back to step 3 and repeat. It is normal to need two or three domains together before the call succeeds.
- If every domain looks granted and it still fails, confirm you edited the security group the ISU actually belongs to. An ISU can sit in several groups and it is easy to grant access to the wrong one.