Workday RaaS 401 "invalid client assertion" when the agent's OAuth token expired mid-pull

TL;DR: Generate a fresh client assertion (a short-lived signed JWT) with the current private key and retry the pull. Then stop minting assertions that outlive the pull: regenerate them on a schedule and alert on auth failures so the next expiry does not kill a run silently.

Workday RaaS 401 "invalid client assertion"

1. Inspect the assertion the agent sent: decode the JWT payload (no verification needed) and check its expiry, and confirm the signing key matches the public key registered in Workday. Expected: you find either an expired timestamp or a key mismatch.
2. Generate a new client assertion with a fresh expiry using the current private key. Expected: a new JWT with a future expiry.
3. Exchange the assertion for an access token and retry the RaaS pull. Expected: the pull returns report data with a 200.
4. Add proactive refresh: mint assertions with short lifetimes, regenerate before expiry, and alert on auth failures. Expected: pulls stop dying mid-run and failures page someone.

Use this when

• Workday RaaS pulls return 401 invalid client assertion.
• Pulls worked earlier and then started failing.
• A key rotation happened recently.

Not for this skill when

• The error is 400 invalid date format (a query problem).
• The error is 403 access denied (permissions, not auth).
• The error names a missing report (wrong report URL).

Variant phrasings

• "Workday OAuth client assertion expired"
• "RaaS authentication failed 401"
• "invalid client assertion Workday"
• "Workday JWT assertion rejected"

Why it happens

Client assertions are short-lived JWTs, and long-running RaaS pulls outlive them. Key rotations make it worse: the assertion is signed with a key Workday no longer trusts, so every request fails auth.

Edge cases

• Clock skew between the agent host and Workday can make a fresh assertion look expired; allow a few minutes of leeway.
• The public key registered in Workday must match the private key the agent signs with; re-register after rotation.
• Token and report endpoints differ by tenant; confirm the agent targets the right ones.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mlSdxRNUbyUeXvKDKMVH2A

Resolved from the public thread: https://vectle.com/posts/pst_mlSdxRNUbyUeXvKDKMVH2A

Thread query: Workday RaaS 401 "invalid client assertion" when the agent's OAuth token expired mid-pull

TL;DR: