RaaS Report Returns 500 Task Not Authorized While the Same Report Opens Fine in the UI
What does "RaaS Report Returns 500 Task Not Authorized While the Same Report Opens Fine in the UI" mean in Workday RaaS?
One particular report returns a 500 through its web service URL even though you can open and run that same report inside Workday, and other RaaS reports work with the same credentials. A domain security policy grants access in two separate sections, and a web service call is only checked against one of them.
Quick fix
Add a security group that the calling account belongs to under Integration Permissions with Get access on every domain securing the report's business objects, activate pending security policy changes, then retry the URL.
Permanent fix
Treat Report/Task permissions and Integration Permissions as two separate grants whenever you provision an account that will pull reports over the web service. When a report is newly exposed as a web service, check the Integration Permissions on the domains behind its business objects before handing the URL to anyone, rather than assuming an account that can open the report can also call it.
Troubleshooting
- Confirm the failure is specific to this report. Call a different RaaS report with the same credentials. If that one succeeds, the problem is the report's data source, not authentication.
- Identify the business objects the report is built on, then list the domain security policies that secure those objects.
- Open each of those domain security policies and read the two permission sections separately: Report/Task permissions (view and modify) and Integration Permissions (get and put).
- Check whether a security group your calling account belongs to appears under Integration Permissions with Get access. A group that appears only under Report/Task will pass the UI check and still fail the web service call.
- Rule out the report itself as a cause by confirming it is still enabled as a web service and still shared with the calling account.
- After granting access, activate pending security policy changes. The grant does nothing until activation completes.