Workday Student to Canvas LMS LTI Roster Sync

# Canvas NRPS endpoint for a specific course (course_id = 84720000000001234)
GET https://university.instructure.com/api/lti/courses/84720000000001234/names_and_roles
Authorization: Bearer oauth2_access_token

# Response (JSON-LD per LTI 1.3 NRPS spec)
{
  "@context": "http://purl.imsglobal.org/ctx/lti/v2/namesandroleservice/v1",
  "@type": "Page",
  "id": "https://university.instructure.com/api/lti/courses/84720000000001234/names_and_roles",
  "context": {
    "@type": "CourseSection",
    "id": "84720000000001234",
    "label": "BIO-201-01",
    "title": "Molecular Biology"
  },
  "members": [
    {
      "status": "Active",
      "name": "Priya Mehta",
      "given_name": "Priya",
      "family_name": "Mehta",
      "email": "[email protected]",
      "user_id": "ab6f3e9f-8c2d-4e1a-b9f0-1d2e3f4a5b6c",
      "roles": ["http://purl.imsglobal.org/vocab/lis/v2/membership#Instructor"]
    },
    {
      "status": "Active",
      "name": "Tyler Okonkwo",
      "given_name": "Tyler",
      "family_name": "Okonkwo",
      "email": "[email protected]",
      "user_id": "c7d8e9f0-1a2b-3c4d-5e6f-7a8b9c0d1e2f",
      "roles": ["http://purl.imsglobal.org/vocab/lis/v2/membership#Learner"]
    }
  ]
}

How we'd take this from discovery to a production-safe cutover — the phases, the canonical mapping, and the edge cases that bite.

This integration syncs student enrollments and grade passback between Workday Student (the system of record) and Canvas LMS using LTI 1.3 Advantage, specifically the Assignment and Grade Services (AGS) and Names and Role Provisioning Service (NRPS). The architecture treats Workday as the authoritative source; Canvas grades flow back via LTI AGS for学籍 reconciliation.

Implementation Phases

1. Discovery & API Scoping — Enumerate Workday Student web services (REST or SOAP), identify relevant business events (enrollment, drop/add, section changes), and confirm Canvas instance LTI registration endpoints. Map Workday student identifiers to Canvas user_id format (typically sis_user_id or lms_id).
2. LTI 1.3 Platform Registration — Register Canvas as an LTI 1.3 platform in Workday (or vice versa). Configure OAuth 2.0 public/private keyset, deployment_id, and JWKS endpoint. Validate the LTI 1.3 launch handshake in a sandbox environment.
3. Names and Role Provisioning Service (NRPS) Setup — Enable NRPS on the Canvas tool registration. Configure Workday to expose the /learning/courses/{courseId}/roster equivalent endpoint. Implement the OAuth bearer token retrieval flow for NRPS calls from Canvas to Workday.
4. Grade Passback (AGS) Configuration — Configure Assignment and Grade Services so Canvas can POST grades back to Workday. Register the AGS lineitem endpoint. Map Canvas lineitem identifiers to Workday grade categories (assignments, exams, participation).
5. Data Transformation Layer — Build a middleware or integration user (Workday EIB, Studio, or MuleSoft) that transforms Workday enrollment events into LTI-compatible JSON. Handle enrollment status codes (active, inactive, dropped) mapping to Canvas enrollment types.
6. Testing & Parallel Run — Execute unit tests on field mappings, then integrate with Canvas test environment. Run a 30-day parallel sync comparing Workday roster counts against Canvas enrollment reports. Validate grade passback accuracy for a pilot course section.
7. Cutover & Validation — Switch the production LTI registration, disable legacy SIS import methods, and run a full reconciliation comparing Workday enrollment counts, section rosters, and grade totals against Canvas output reports.

Field Mapping

Edge Cases

• Cross-listed sections — A single Workday section maps to multiple Canvas courses; duplicate enrollment pushes must de-duplicate on the Workday side to avoid grade conflicts.
• Retroactive drops — A drop processed after the term ends may not trigger a real-time webhook; schedule a nightly delta compare against Canvas enrollments.
• Incomplete grade passback — Canvas may POST a grade before the Workday assignment record exists; queue these with a status: pending flag and retry after Workday assignment creation.
• Mid-term role changes — A student promoted to TA mid-semester must update both role and grade visibility permissions in Canvas.
• Identifier mismatches — Workday Student_ID formats (numeric vs. alphanumeric) must normalize to the sis_user_id pattern configured in Canvas or the sync fails silently.

Cutover

Cutover requires a reversible, reconciled handoff. First, run a full export of current Canvas enrollment data as a rollback snapshot. Enable the LTI production registration and point Workday to the live AGS/NRPS endpoints, but retain the legacy SIS import as a shadow fallback for 48 hours. Execute a three-way reconciliation: compare Workday enrollments, Canvas live roster, and the pre-cutover snapshot. Any discrepancies exceeding a 0.1% threshold trigger an alert and hold on grade passback until resolved. Document the rollback procedure — disabling LTI registration and re-enabling manual SIS import — and require a sign-off from the registrar before closing the cutover window.