[Workday][Sign-on] Report prompts (From_Moment/To_Moment) are never injected, so RaaS returns 400 and there is no collection cursor #20568

Error message

GET https://HOST/ccx/service/customreport2/<tenant>/<owner>/<report>?format=json: 400: Validation error occurred. Report parameter From Moment is required.

What did you do?

Configured the Sign-on data stream against a Workday Custom Report built on a sign-on data source, following the report-building steps in the integration README (an Advanced report on Signons and Attempted Signons, exposed as a web service), and set Report URL to the RaaS JSON URL as documented:

https://HOST/ccx/service/customreport2/TENANT/REPORT_OWNER/REPORT_NAME?format=json

What did you see?

Every collection attempt fails with the 400 above. Workday rejects the call because the report's From Moment prompt is Required and no value is supplied.

Adding a moment range to the URL by hand makes the request succeed:

?format=json&From_Moment=2026-08-01T00%3A00%3A00&To_Moment=2026-08-04T23%3A59%3A59

But that range is then static for the lifetime of the policy: once wall-clock time passes To_Moment, the integration ingests nothing new while continuing to re-download the same rows every interval.

What did you expect to see?

The integration should supply the report's moment-range prompts itself on each polling cycle, advancing the window as time passes — the way the activity data stream already does with its from/to parameters and cursor.last_timestamp.

Anything else?

Root cause. The sign-on CEL program performs a bare get(state.url) and adds nothing to the request. The template has no state: block, and data_stream/sign_on/manifest.yml has no initial_interval or lookback variable, so there is no cursor to derive a window from:

https://github.com/elastic/integrations/blob/main/packages/workday/data_stream/sign_on/agent/stream/cel.yml.hbs#L22-L24

Contrast data_stream/activity/agent/stream/cel.yml.hbs, which derives start_time/end_time, passes them as from/to via format_query(), and persists cursor.last_timestamp.

This is Workday-expected behaviour, not a tenant quirk. RaaS reports built on moment-range data sources take their window from report prompts, and the conventional setup marks From_Moment/To_Moment as Required with the values passed in the URL. Workday's reporting docs confirm a Required prompt cannot be blank at runtime (Building Custom Reports).

Second, related problem: no cursor at all. Independently of the 400, this stream re-downloads the whole report on every interval. The only thing preventing duplicate documents is the event.original fingerprint written to _id:

https://github.com/elastic/integrations/blob/main/packages/workday/data_stream/sign_on/elasticsearch/ingest_pipeline/default.yml#L40-L45

_id uniqueness is per-index, so that dedup stops holding after the data stream rolls over — the same rows then land in a new backing index as fresh documents. RaaS has no pagination either, so a large tenant re-fetches its entire sign-on history in a single response every interval against the 5m default client timeout.

Contributing gaps.

• There is no system test for the sign-on stream. packages/workday/_dev/deploy/docker/files/config.yml only mocks /ccx/oauth2/.../token and /ccx/api/privacy/v1/.../activityLogging; nothing under /ccx/service/customreport2/. The CEL program has only ever been exercised through pipeline tests, which bypass the request entirely.
• The README's "Build the Sign-on custom report" steps never mention the Prompts tab, so users have no way to know a moment range is expected or how to configure prompt defaults as a stopgap.