> For the complete documentation index, see [llms.txt](https://help.rhythms.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.rhythms.ai/workspace-settings-and-administration/team-users-and-access/sync-users-from-workday-over-sftp.md).

# Sync users from Workday over SFTP

Rhythms can import users and their profile attributes from your HR system by picking up a CSV file that the HR system drops on an SFTP server that Rhythms hosts. This guide uses Workday, but any HRIS that can deliver a file over SFTP works the same way. You authenticate with an SSH key, Rhythms provisions the SFTP account and shares the connection details with you, and every file you upload is processed automatically on arrival. There is no settings screen for this in Rhythms; set it up with your Rhythms contact.

## How the integration works

1. You generate an SSH key pair (in Workday or with `ssh-keygen`) and send Rhythms the public key.
2. Rhythms creates an SFTP account for your workspace and shares the username, hostname, an optional PGP public key for encrypting files, and a sample `users.csv` through a secure channel.
3. You build a Workday report that produces `users.csv` and an Enterprise Interface Builder (EIB) that delivers it to the SFTP server on your schedule.
4. Each time a file lands, Rhythms processes it immediately: it updates existing users, creates records for new people, and sets managers.
5. If any rows fail, Rhythms writes a `‹filename›.error.log` back to the SFTP share next to the processed copy of your file.

## Step 1: Generate an SSH key pair

You can generate the key pair in Workday or with any SSH tool. Rhythms only needs the public key.

### In Workday

1. Search for the task **Create x509 Private Key Pair**, give the key pair a name and click **OK**. Workday generates the pair and shows the public key in "RSA-SSH" format.
2. Copy the RSA-SSH key into a text file named `rsa.pub` on your computer.
3. Convert it to OpenSSH format: `ssh-keygen -i -f rsa.pub`. The output is the public key to send to Rhythms.

### With ssh-keygen

Run `ssh-keygen -t rsa -b 4096 -f rhythms_sftp -N ""` and send the contents of `rhythms_sftp.pub`. Keep the private key for the system that will upload files.

The public key must be a single line in the form `‹key type› ‹base64 key› ‹optional comment›`, for example `ssh-rsa AAAAB3... workday-export`. Supported key types are `ssh-rsa`, `ssh-ed25519`, `ecdsa-sha2-nistp256`, `ecdsa-sha2-nistp384` and `ecdsa-sha2-nistp521`.

## Step 2: Send the public key to Rhythms

Send the public key to your Rhythms contact. Rhythms creates the SFTP account against that key; only a client holding the matching private key can connect.

## Step 3: Receive your connection details

Rhythms shares the following through a secure, password-protected link, with the password sent separately:

* **SFTP username**, in the form `‹storage account›.‹workspace id›`, for example `rhythmssftpusprod.0196ea4d9a1e7c55aa0c4f4943aab697`.
* **SFTP hostname**, for example `sftp.rhythms.ai`, on port 22.
* **PGP public key** (optional) for encrypting files before upload.
* **Sample `users.csv`** showing the expected columns.

Download the files, store them securely and delete them from your Downloads folder. If your upload tool verifies host keys, the server presents the standard Azure Storage SFTP host keys.

## Step 4: Build the Workday custom report

Create a custom report that outputs one row per person with the columns below. Only `email` is required; include the others you want to appear on Rhythms profiles. Column names are case-sensitive and must match exactly.

| Column                               | Required | What Rhythms does with it                                                              |
| ------------------------------------ | -------- | -------------------------------------------------------------------------------------- |
| `email`                              | Yes      | Identifies the user. Must be the primary work email.                                   |
| `first_name`, `last_name`            | No       | Name fields; also set the display name unless an Admin set it manually.                |
| `job_title`                          | No       | Job Title.                                                                             |
| `department_name`                    | No       | Department.                                                                            |
| `division_name`                      | No       | Division.                                                                              |
| `cost_center_name`                   | No       | Cost Center.                                                                           |
| `employee_type`                      | No       | Employee Type, for example Employee or Contractor.                                     |
| `manager_email`                      | No       | Sets the user's manager to the Rhythms user with that email. Blank clears the manager. |
| `custom_field_1` to `custom_field_5` | No       | Five free-text fields, labelled Custom 1 to Custom 5 until you rename them.            |

Any other column, such as `user_id`, `username`, work address fields or `employment_start_date`, is ignored. When creating the report, select **Advanced** as the report type, tick **Enable as Web Service**, and add an XSLT transformation so the output is CSV with a header row.

## Step 5: Create the Enterprise Interface Builder (EIB)

1. In Workday, search for **Create EIB**, enter a name and select **Outbound EIB**.
2. On **Get Data**, select the custom report from Step 4.
3. On the **Transformation** tab, set the file name to `users.csv`.
4. On **Deliver**, choose **SFTP** as the delivery method, enter the username and server address Rhythms gave you, and select the key pair from Step 1.
5. Click **OK**, then launch the integration and schedule it (daily is typical).

## Step 6: Test and verify

1. Run the EIB once and confirm in Workday that the delivery succeeded.
2. In Rhythms, open **Settings › Users** and spot-check a few people: job title, department and manager should match the file. Attributes only show once they are enabled under **User Profile Attributes** in **Settings › Security**.
3. Connect to the SFTP share and look for a `users.csv.error.log` next to the processed copy of your file. If it exists, it lists each row that failed and why.
4. Ask your Rhythms contact to confirm the file was received and processed.

## File rules

* **One file type.** Rhythms treats every file uploaded to the share as a users file. Upload only `users.csv` (or its encrypted form).
* **Encryption is optional.** To encrypt, use the PGP public key Rhythms gave you and upload the result as `users.csv.gpg` or `users.csv.pgp`. Rhythms decrypts it on arrival.
* **Header row required.** Values are trimmed of surrounding whitespace.
* **One row per email.** If the same email appears twice, the whole file is rejected and the error log says which emails were duplicated. An empty file is also rejected.
* **Blank cells leave existing values alone**, except `manager_email`: a blank manager email clears the user's manager.
* **Managers are resolved after all rows are loaded**, so a manager can appear later in the same file. A manager email that matches no Rhythms user leaves the manager empty; a row whose manager is itself is ignored.
* **Latest file wins.** If you upload several files in quick succession, only the most recent is processed; earlier ones are skipped.
* **Each upload is archived.** Rhythms copies the file into a folder named with the upload time (UTC) and processes the copy; the error log, if any, is written beside that copy.

## What the import changes in Rhythms

* **Existing users** (matched by email) get the profile attributes and manager from their row.
* **People who are not yet Rhythms users** get an HRIS-only record that holds their profile data and manager link. They cannot sign in and do not appear in **Settings › Users** until Directory Sync (SCIM) provisions them; their attributes are already in place when they arrive.
* **Nobody is deactivated or removed.** Dropping a row from the file changes nothing for that user. Deactivate people through Directory Sync or manually in Settings › Users.
* **Roles and licences are untouched.** The import never changes who is an Admin, Member or Guest.

## Troubleshooting

* **Connection failed.** Check the hostname and the full username (including the storage-account prefix before the dot), confirm the EIB is using the key pair whose public key you sent, and make sure your network allows outbound SFTP on port 22.
* **File delivered but nothing changed.** Look for an `.error.log` on the share. Common causes: the header row is missing or misspelt, the file has duplicate emails, or the emails do not match the addresses users have in Rhythms.
* **Manager not set.** The manager's email must belong to a Rhythms user or appear as a row in the same file.
* **Attributes not visible.** Enable them under **User Profile Attributes** in Settings › Security, and rename the custom fields there.

## FAQ

**How often does Rhythms sync?** Whenever a file arrives. The schedule is whatever you set on the Workday EIB; a daily run is typical.

**Can I use this with an HRIS other than Workday?** Yes. Any system that can deliver a CSV with these columns over SFTP with key authentication works the same way.

**Does the import deactivate people who leave?** No. It only creates and updates. Use Directory Sync (SCIM) or deactivate users manually.

**Can I use SFTP together with Directory Sync?** Yes. Many customers provision and deactivate users through SCIM and use the SFTP file to fill in HR attributes the IdP does not hold. Both write to the same profile fields; whichever runs last sets the value.

**Where do I rename Custom 1 to Custom 5?** In **Settings › Security** under **User Profile Attributes**. See [Enterprise User Management in Rhythms](/workspace-settings-and-administration/team-users-and-access/users-teams-and-access-overview.md).

## Related articles

* [Set up SCIM user provisioning](/workspace-settings-and-administration/team-users-and-access/set-up-scim-user-provisioning.md)
* [Set up single sign-on (SSO)](/workspace-settings-and-administration/team-users-and-access/set-up-single-sign-on-sso.md)
* [Enterprise User Management in Rhythms](/workspace-settings-and-administration/team-users-and-access/users-teams-and-access-overview.md)
* [User Management in Rhythms](/workspace-settings-and-administration/team-users-and-access/add-and-manage-users.md)
* [Filtering and Grouping OKRs in Views](/goals-and-okrs/monitoring-and-reports/filtering-and-grouping-okrs-in-views.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.rhythms.ai/workspace-settings-and-administration/team-users-and-access/sync-users-from-workday-over-sftp.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.