Ceridian Dayforce

Connect Ceridian Dayforce to collect hris evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Ceridian Dayforce:

   1. Sign in to Dayforce as an administrator with access to the web services features.
   2. Create a password policy with non-expiring, complex passwords that is not marked as the default password policy.
   3. Create a dedicated primary role for this consumer (one role only, not allowed to access the Dayforce UIs) and apply that password policy to it.
   4. Go to System Admin › Roles, open the role and select the Features tab. Expand HCM Anywhere, then Web Services, and select HCM Anywhere, Web Services and only the sub-features needed (for reading data, Read Data). Click Save, then Refresh.
   5. Create a dedicated user account for this consumer, assign it only the role above, and set its password. Attach the org locations whose employees it may read, since a consumer's access to employee information is controlled by the org locations on its user account.
   6. Optionally, restrict the account by IP address under System Admin › IP Network Filtering.
   7. For the consumer's role, select Read access for the access authorizations used by the employee data elements you need (status, contacts, managers).
   8. In System Admin › Roles, click the Web Services Field-Level Access tab, find the Employee item, and select the checkbox next to each data element that should be returned (for example employment status, contacts and managers). Changes can take up to one minute to apply.

   Where to find the other values:

   • Client namespace: Your organization's Dayforce client namespace, the same value used to connect to the Dayforce UI or APIs (the CompanyId in a token request and the {clientName} in REST URLs).
   • Host: Requests start at https://www.dayforcehcm.com/api/\{clientName\}/V1/ClientMetadata; its ServiceUri response value (for example https://www.dayforcehcm.com/58/api) is the client- and version-specific host to call. Dayforce says to call it at least once a day if you store the URL.
   • Username: The name of the dedicated web services user account created above.
   • Password: That user account's password.
   • Access token (optional): Obtained by a POST to the Dayforce identity service (production https://dfid.dayforcehcm.com/connect/token, test https://dfidtst.np.dayforcehcm.com/connect/token) with grant_type=password, CompanyId (client namespace), Username, Password and Client_Id=Dayforce.HCMAnywhere.Client. Tokens normally expire after 3,600 seconds.

   Ceridian Dayforce's public documentation does not cover every step.

   Sourced from the public Dayforce Help Portal (Web Services Configuration Guide R2026.2.0, Introduction Guide and RESTful Developer Guide). Not found on a readable page: the menu path and field names on the screen that creates the user account and the password policy, and where the Dayforce UI displays the client namespace. The Dayforce Developer Network (developers.dayforce.com) needs sign-in. Access tokens last about one hour, so a stored token must be renewed.

   Source: help.dayforce.com, help.dayforce.com, help.dayforce.com, help.dayforce.com, checked 2026-10-07.

   The permissions Safeguard needs: read employee status, contacts and managers.

2. On Compliance › Connectors, open Ceridian Dayforce, click Connect, choose API token and fill in:

   Field	What to enter
   Host	Optional. An address under dayforcehcm.com.
   Client namespace	Optional.
   Username	Optional.
   Password	Optional. Stored encrypted and never shown again.

   Or, instead: Access token (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Ceridian Dayforce and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• HRIS connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks