SOAP-ENV:Client.validationError 'Invalid Request' When Testing Outside Studio/EIB
What it means
The SOAP body itself is well-formed, but the request is missing the WS-Security header Workday requires on every call (a username/password token wrapped inside soapenv:Header). Tools like Postman or Bruno don't add this automatically just because you filled in Basic Auth on the Authorization tab - you have to build the header by hand, and its absence surfaces as a generic 'Invalid request' fault rather than a clear authentication error.
Troubleshooting
- Confirm the raw request body actually contains a soapenv:Header element with a WS-Security UsernameToken, not just an Authorization header set by your HTTP client's UI.
- If testing from Postman/Bruno/curl, do not rely on the client's built-in Basic Auth tab for Workday SOAP calls - it does not inject the WS-Security XML block Workday expects.
- Compare against a known-good request generated by Studio or an EIB (both auto-build the header correctly) to see the exact header structure expected for your WSDL version.
- If the header is present and it still fails, check for namespace mismatches (soapenv vs bsvc prefixes) before assuming it is a permissions issue.
Add the full WS-Security soapenv:Header block with the ISU's username/password UsernameToken directly into the request body, rather than using the HTTP client's auth tab.
Keep a verified SOAP request template (with the header wrapper already built) in your team's integration toolkit or API collection so nobody rebuilds it from scratch and re-hits this.