docs(workday): document the team API client and required TOKEN_ENDPOINT

[djiang-jq]

Updates the Workday plugin docs to match the backend change that makes each team supply its own Workday API client, with TOKEN_ENDPOINT as a required field.

Merge after the everysphere changes land: 1119548 (team API client) and 1126105 (required TOKEN_ENDPOINT). Until then, the current README describes production behavior.

Changes

• README: replaces "Cursor owns the OAuth client, nothing to prepare" with team setup:
  • registering the API client in Workday, with redirection URI https://www.cursor.com/agents/mcp/oauth/callback
  • the six required admin fields: CLIENT_ID, CLIENT_SECRET, TENANT, AUTHORIZATION_BASE_URL, TOKEN_ENDPOINT, REST_API_BASE_URL
  • the rule that every URL must be https on a Workday domain
  • members signing in individually, with each connection tied to the team that issued it
• CHANGELOG: adds a 1.1.0 entry.
• plugin.json: bumps the version to 1.1.0.

Why plugin.json has no variables block

The backend renders its built-in Workday form (WORKDAY_PLUGIN_VARIABLES_SCHEMA) only when the published plugin declares no variables. A declared block would replace that form and would have to match the backend's key names exactly. Leaving it out keeps the field list defined in one place, in the backend.

Validation

• node scripts/validate-plugins.mjs passes

---

Note

Low Risk
Documentation and version metadata only; no runtime or data-handling code changes in this repo.

Overview
Bumps the Workday plugin to 1.1.0 and rewrites install/auth docs to match upcoming backend behavior: teams bring their own Workday API client instead of Cursor-managed OAuth.

The README replaces “nothing to prepare” with a Team setup flow—register an authorization-code client in Workday (redirect https://www.cursor.com/agents/mcp/oauth/callback), have a team admin save six required fields (CLIENT_ID, CLIENT_SECRET, TENANT, AUTHORIZATION_BASE_URL, TOKEN_ENDPOINT, REST_API_BASE_URL), then have members sign in individually with sessions scoped to that team. It documents that TOKEN_ENDPOINT must be supplied explicitly (services host, not derived from the authorize URL), that all URLs must be https on allowed Workday domains, and updates notes on scopes, troubleshooting, and disconnecting. CHANGELOG records the same for 1.1.0.

^{Reviewed by Cursor Bugbot for commit e64b0e2. Bugbot is set up for automated code reviews on this repo. Configure here.}