Calling Claude or OpenAI from a Workday Extend app or orchestration

Connector or Send HTTP Request: which one to use

An Extend app reaches Claude or OpenAI from an orchestration, in one of two ways that Workday documents. With Extend AI, the Anthropic (Claude) and OpenAI (ChatGPT) connectors work only in orchestrations built from the Custom Agent Action template. Without Extend AI, or in any other template, Send HTTP Request with an API Key credential calls the provider's API directly.

A page reaches a provider through a synchronous orchestration that it starts. If all you need is generated text in one field, Workday's own aiPrompt on a richText widget is lighter (details at the end). For Workday-hosted models, see AI Gateway and Document Intelligence in Workday Extend apps.

Route 1: the connectors, and what they cost you in control

The Artificial Intelligence connector list has an Anthropic (Claude) connector with a Chat action. The OpenAI (ChatGPT) connector has many more, including Chat, Chat With Responses API, Chat using Functions, Chat using File Search, Summarize Text, Classify Items into Categories and Create Embeddings. Azure OpenAI and Google Gemini connectors exist for clients whose AI contract is with those vendors.

To use one, associate the connector with the Extend app, then connect at least two accounts at the provider: one for the Production tenant and one as the Default, which Orchestrate uses in non-Production tenants where you haven't named another. All the connector's actions then appear in every Custom Agent Action orchestration of that app. Connector Explorer, opened from an action's properties panel, lets you enter properties and see the JSON the step would return.

Three consequences to settle before choosing it:

1. The identity is the connected account. A connector runs as that account, not as the person who started the orchestration, and the provider's audit logs show the connected account. Workday advises a dedicated service account with the least privilege the use case needs.
2. Data is processed in AWS us-east-1. Connectors run through Pipedream, which processes connector data there whatever region the tenant is in; regional processing isn't available. Pipedream doesn't store request payloads or response bodies and keeps limited usage logs for at most 30 days. Put that in front of the client's data-protection reviewer before you connect Production credentials.
3. Limits. An action must finish within 5 minutes, and files passed into one total at most 128 MB.

Route 2: Send HTTP Request with an API Key credential

Send HTTP Request is available in the Synchronous, Asynchronous, Business Process, Home Card, Integration System and Custom Agent Action templates, so it covers an app without Extend AI and any orchestration a page launches. Workday says not to use it for Workday's own APIs; use Send Workday API Request for those.

Create the credential first. In Orchestration Builder open the orchestration's Settings, select the Credentials tab, enter a Credential Name and choose the type API Key. Enter a Key and Value pair and append it to the Header.

The header names and values below are the providers' requirements, taken from their public API documentation on 4 November 2026, not Workday's:

Anthropic also requires an anthropic-version header. Add it on the step's Headers tab. Anthropic's documentation now gives 2026-10-21, the latest version, and recommends the latest. That version rejects the temperature, top_p and top_k parameters with a 400, so leave them out. Anthropic also accepts Authorization with Bearer and the key in place of x-api-key, and lists x-api-key as the legacy fallback.

Configure the step this way:

1. Method POST and the URL.
2. Auth tab: the credential you created.
3. Body tab: Create Text Template with content type application/json, or Reference Existing Data pointing at an object built by a Create JSON step.
4. Settings tab: set Overall Timeout and Response Timeout for a model's response time, and choose a retry policy defined on the orchestration's HTTP Retries tab (see HTTP retries and polling patterns in Orchestrate).

An Anthropic body for an Equipment Request summary:

{
  "model": "claude-sonnet-5-5",
  "max_tokens": 1024,
  "messages": [
    {
      "role": "user",
      "content": "Summarise this Equipment Request for the approving manager in three sentences: <request details>"
    }
  ]
}

model, max_tokens and messages are required. claude-sonnet-5-5 is the Sonnet entry in Anthropic's current model table; Haiku, Opus and Fable have their own IDs there (claude-haiku-5-5, claude-opus-5-5, claude-fable-5-1). Current Claude models think adaptively, and thinking tokens count against max_tokens, so a very small value can leave no room for the answer.

The OpenAI equivalent, using the Responses API that OpenAI now recommends for new projects over Chat Completions:

{
  "model": "gpt-6.1-sol",
  "input": "Summarise this Equipment Request for the approving manager in three sentences: <request details>",
  "max_output_tokens": 1000
}

max_output_tokens is a ceiling on visible output plus reasoning tokens, with a minimum of 16. OpenAI's model page lists gpt-6.1-sol as the balance of intelligence and cost, gpt-6-luna for cheap high-volume work and gpt-6-astra as the flagship. Check the page again when you build; these IDs change.

For OAuth-based providers, Workday recommends the Cred Store Reference credential type in Production rather than a pasted token.

The 25-second limit for page-triggered calls

A synchronous orchestration launched by a presentation page is capped at 25 seconds in total, and that cap overrides any timeout you set. Workday recommends an asynchronous orchestration for work expected to run longer.

Keep a page-triggered call to one short request. Move document-length generation to an asynchronous orchestration that writes its result to a business object, and have the page read that object.

What goes in the prompt

Both routes send whatever the step's body contains to a third party. Build the prompt from the few fields the model needs, not a whole worker or report row. Workday's guidance for its own AI widgets is to keep personally identifiable and sensitive data out of prompts, and that applies at least as much to an outside provider. Use the client's enterprise account at the provider, not a developer's personal key.

Prove the call works

Use Debug Step on the Send HTTP Request step, connect to a tenant where the app is deployed, and read the Debug Outputs. Debugging doesn't work on a Send HTTP Request step that uses polling. Then read the response body:

• Anthropic: content is an array of blocks. Take the block whose type is text; a thinking block can come first.
• OpenAI: output is an array of items. Take the item whose type is message, then the entry in its content with type output_text. A reasoning item may come before it. The SDKs' output_text shortcut is not a field of the raw JSON.
• A 401 means the provider rejected the key. Anthropic reports it as authentication_error. Check the credential's Key spelling and, for OpenAI, the Bearer prefix.

Add a Log step after the call that writes the HTTP status and the first part of the text. It appears in Run Logs in Orchestration Builder, so a failed run shows the provider's error without the whole prompt in the log. Finally, run the orchestration the way users will, from the page or the agent: the 25-second cap and the connector's account identity only appear there.

A text-only alternative: aiPrompt on a richText widget

Extend AI customers can add an aiPrompt attribute to a richText widget on an edit page. The user clicks a prompt button and the widget generates content from the prompt you wrote. The limits are 2 buttons per aiPrompt, 3 richText tags with aiPrompt per app and 1,000 characters per prompt including referenced values. It does not work inside a grid, panelList, loop or pod.