Round-trips a small public wd5.myworkday.com URL (/acme-corp/get-global-prefs.htmld?feature=doNotShowMobileAd) through ContextMint Bridge (your signed-in browser tab) and returns diagnostics: the bridge's role (host/peer/null), port, version, the extension link (linked / pair pending / not attached / never answered), the elapsed round-trip time, and a plain-English hint distinguishing 'bridge never came up' from 'extension not connected' from 'this browser can't serve a capability' from 'real wd5.myworkday.com-side problem'. Read-only, no auth required. Call this when a real tool fails and you want to know which hop broke.

List the Workday apps available on your home screen, each with a launchable task id. Use this to discover what you can read, then pass an app's taskId to workday_get_task to open it. Some apps share a generic launcher id; if one returns a near-empty page, open the app in your browser and pass that URL to workday_get_task instead. Read-only.

Open one of your Workday apps by name — "My Team Management", "Talent and Performance", "Time", "Absence", "Benefits and Pay", "Org Chart", "Total Rewards" — and read it, following the app down to the child cards that hold its real content. Most Workday app hubs return a near-empty shell on their own; this follows the links for you. Matched case-insensitively against your own app menu, so it works without knowing any task ids. Read-only.

Fetch a Workday page (task or data card) by its path and return a structured, read-only view: title, current user, each section as label/value fields, navigable references (instance id + drill-in uri), and the page's related tasks + export links. The path is a Workday *.htmld endpoint — take it from a prior result's references[].uri or relatedTasks[].uri, or paste the URL of a Workday page you have open (SPA /d/... URLs are normalized automatically). Every request rides your signed-in Workday tab. Read-only; no data is mutated.

Read the reporting chain around you: each person with their business title, location, report count, and a profileUri you can pass straight to workday_get_worker. Resolves the Org Chart app from your own app menu. Read-only.

Read a worker's Workday profile and return the CATALOG of everything readable about them: sections (Job, Compensation, Benefits, Contact, Personal, Performance, Career, Feedback) each listing named, fetchable tasks. Pass a profileUri from workday_get_org_chart or any reference, or a bare worker id like 247$42. Then use workday_get_worker_task to open one by name. Shows only what your own Workday permissions already allow. Read-only.

Open a single named item from a worker's profile — "Compensation", "Job Details", "Performance Reviews", "Management Chain", "Benefits", "Goals", "Pay Change History", and so on. Matched case-insensitively against that worker's own task catalog; if it does not match, the error lists exactly what is available. Read-only.

Read your own worker profile — the same catalog workday_get_worker returns, for yourself. Use it to find your pay, benefits, time off, goals, and feedback. Read-only.

GET any Workday data endpoint and return the RAW JSON with secrets redacted — the escape hatch for pages the typed tools do not model yet. Prefer workday_get_task (structured) when it works; reach for this to explore an unfamiliar page or to see fields the parser drops. Bare uris get .htmld appended and /d/ SPA paths are normalized. Read-only (GET only).

Run a read-only GraphQL query against Workday's PEX surface (/wday/pex/graphql). This is the only route to surfaces that have no GET-able .htmld endpoint — notably the Inbox / "My Tasks" and global search. Workday does not publish these operations, so you supply the document; expect to iterate. mutation and subscription documents are REFUSED — this server is read-only — as are type-system (SDL) documents, whose definition boundaries cannot be tracked reliably. Secret and government/financial PII fields (SSN, national ID, bank account, driving licence, visa and other identity documents, …) come back redacted by field name, so aliasing one of them to another name is refused.