RaaS Call From Browser JavaScript Blocked by CORS Policy
The error Access to XMLHttpRequest at <RaaS URL> from origin <company domain> has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
What it means
Calling a RaaS (Report-as-a-Service) URL directly from client-side JavaScript running in a browser fails because Workday's RaaS endpoints don't return an Access-Control-Allow-Origin header, so the browser's CORS policy blocks the response before the calling page ever sees it.
Troubleshooting
- Confirm the call is happening client-side (browser JavaScript) rather than server-side, CORS is a browser enforcement mechanism and doesn't apply to server-to-server calls.
- Check the browser dev tools Network tab: if the request actually reached Workday and got a response but the browser still blocked it, that confirms CORS rather than a Workday-side failure.
- Recognize that Workday RaaS does not support direct browser-to-RaaS calls with custom Access-Control-Allow-Origin headers, this isn't a per-tenant setting you can turn on.
- Redesign the integration to route the RaaS call through a server-side proxy or middle-tier service you control, then have the browser call that proxy instead.
⚡ Quick fix
Move the RaaS call behind a server-side endpoint (a small proxy service) instead of calling it directly from browser JavaScript.
✓ Permanent fix
Treat RaaS as a server-to-server integration point only; never architect a design that expects a browser to call a RaaS URL directly, since Workday does not expose the CORS headers that pattern requires.
Was this helpful?