Sync users from Workday over SFTP

Last updated: September 4, 2026

Rhythms can import users and their profile attributes from your HR system by picking up a CSV file that the HR system drops on an SFTP server that Rhythms hosts. This guide uses Workday, but any HRIS that can deliver a file over SFTP works the same way. You authenticate with an SSH key, Rhythms provisions the SFTP account and shares the connection details with you, and every file you upload is processed automatically on arrival. There is no settings screen for this in Rhythms; set it up with your Rhythms contact.

How the integration works

You generate an SSH key pair (in Workday or with ssh-keygen) and send Rhythms the public key.
Rhythms creates an SFTP account for your workspace and shares the username, hostname, an optional PGP public key for encrypting files, and a sample users.csv through a secure channel.
You build a Workday report that produces users.csv and an Enterprise Interface Builder (EIB) that delivers it to the SFTP server on your schedule.
Each time a file lands, Rhythms processes it immediately: it updates existing users, creates records for new people, and sets managers.
If any rows fail, Rhythms writes a <filename>.error.log back to the SFTP share next to the processed copy of your file.

Step 1: Generate an SSH key pair

You can generate the key pair in Workday or with any SSH tool. Rhythms only needs the public key.

In Workday

Search for the task Create x509 Private Key Pair, give the key pair a name and click OK. Workday generates the pair and shows the public key in "RSA-SSH" format.
Copy the RSA-SSH key into a text file named rsa.pub on your computer.
Convert it to OpenSSH format: ssh-keygen -i -f rsa.pub. The output is the public key to send to Rhythms.

With ssh-keygen

Run ssh-keygen -t rsa -b 4096 -f rhythms_sftp -N "" and send the contents of rhythms_sftp.pub. Keep the private key for the system that will upload files.

The public key must be a single line in the form <key type> <base64 key> <optional comment>, for example ssh-rsa AAAAB3... workday-export. Supported key types are ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384 and ecdsa-sha2-nistp521.

Step 2: Send the public key to Rhythms

Send the public key to your Rhythms contact. Rhythms creates the SFTP account against that key; only a client holding the matching private key can connect.

Step 3: Receive your connection details

Rhythms shares the following through a secure, password-protected link, with the password sent separately:

SFTP username, in the form <storage account>.<workspace id>, for example rhythmssftpusprod.0196ea4d9a1e7c55aa0c4f4943aab697.
SFTP hostname, for example sftp.rhythms.ai, on port 22.
PGP public key (optional) for encrypting files before upload.
Sample users.csv showing the expected columns.

Download the files, store them securely and delete them from your Downloads folder. If your upload tool verifies host keys, the server presents the standard Azure Storage SFTP host keys.

Step 4: Build the Workday custom report

Create a custom report that outputs one row per person with the columns below. Only email is required; include the others you want to appear on Rhythms profiles. Column names are case-sensitive and must match exactly.

Column	Required	What Rhythms does with it
`email`	Yes	Identifies the user. Must be the primary work email.
`first_name`, `last_name`	No	Name fields; also set the display name unless an Admin set it manually.
`job_title`	No	Job Title.
`department_name`	No	Department.
`division_name`	No	Division.
`cost_center_name`	No	Cost Center.
`employee_type`	No	Employee Type, for example Employee or Contractor.
`manager_email`	No	Sets the user's manager to the Rhythms user with that email. Blank clears the manager.
`custom_field_1` to `custom_field_5`	No	Five free-text fields, labelled Custom 1 to Custom 5 until you rename them.

Any other column, such as user_id, username, work address fields or employment_start_date, is ignored. When creating the report, select Advanced as the report type, tick Enable as Web Service, and add an XSLT transformation so the output is CSV with a header row.

Step 5: Create the Enterprise Interface Builder (EIB)

In Workday, search for Create EIB, enter a name and select Outbound EIB.
On Get Data, select the custom report from Step 4.
On the Transformation tab, set the file name to users.csv.
On Deliver, choose SFTP as the delivery method, enter the username and server address Rhythms gave you, and select the key pair from Step 1.
Click OK, then launch the integration and schedule it (daily is typical).

Step 6: Test and verify

Run the EIB once and confirm in Workday that the delivery succeeded.
In Rhythms, open Settings › Users and spot-check a few people: job title, department and manager should match the file. Attributes only show once they are enabled under User Profile Attributes in Settings › Security.
Connect to the SFTP share and look for a users.csv.error.log next to the processed copy of your file. If it exists, it lists each row that failed and why.
Ask your Rhythms contact to confirm the file was received and processed.

File rules

One file type. Rhythms treats every file uploaded to the share as a users file. Upload only users.csv (or its encrypted form).
Encryption is optional. To encrypt, use the PGP public key Rhythms gave you and upload the result as users.csv.gpg or users.csv.pgp. Rhythms decrypts it on arrival.
Header row required. Values are trimmed of surrounding whitespace.
One row per email. If the same email appears twice, the whole file is rejected and the error log says which emails were duplicated. An empty file is also rejected.
Blank cells leave existing values alone, except manager_email: a blank manager email clears the user's manager.
Managers are resolved after all rows are loaded, so a manager can appear later in the same file. A manager email that matches no Rhythms user leaves the manager empty; a row whose manager is itself is ignored.
Latest file wins. If you upload several files in quick succession, only the most recent is processed; earlier ones are skipped.
Each upload is archived. Rhythms copies the file into a folder named with the upload time (UTC) and processes the copy; the error log, if any, is written beside that copy.

What the import changes in Rhythms

Existing users (matched by email) get the profile attributes and manager from their row.
People who are not yet Rhythms users get an HRIS-only record that holds their profile data and manager link. They cannot sign in and do not appear in Settings › Users until Directory Sync (SCIM) provisions them; their attributes are already in place when they arrive.
Nobody is deactivated or removed. Dropping a row from the file changes nothing for that user. Deactivate people through Directory Sync or manually in Settings › Users.
Roles and licences are untouched. The import never changes who is an Admin, Member or Guest.

Troubleshooting

Connection failed. Check the hostname and the full username (including the storage-account prefix before the dot), confirm the EIB is using the key pair whose public key you sent, and make sure your network allows outbound SFTP on port 22.
File delivered but nothing changed. Look for an .error.log on the share. Common causes: the header row is missing or misspelt, the file has duplicate emails, or the emails do not match the addresses users have in Rhythms.
Manager not set. The manager's email must belong to a Rhythms user or appear as a row in the same file.
Attributes not visible. Enable them under User Profile Attributes in Settings › Security, and rename the custom fields there.

FAQ

How often does Rhythms sync? Whenever a file arrives. The schedule is whatever you set on the Workday EIB; a daily run is typical.

Can I use this with an HRIS other than Workday? Yes. Any system that can deliver a CSV with these columns over SFTP with key authentication works the same way.

Does the import deactivate people who leave? No. It only creates and updates. Use Directory Sync (SCIM) or deactivate users manually.

Can I use SFTP together with Directory Sync? Yes. Many customers provision and deactivate users through SCIM and use the SFTP file to fill in HR attributes the IdP does not hold. Both write to the same profile fields; whichever runs last sets the value.

Where do I rename Custom 1 to Custom 5? In Settings › Security under User Profile Attributes. See Enterprise User Management in Rhythms.