Getting Started
Before connecting Workia to Workday, you must create a dedicated Integration System User (ISU). An ISU ensures all integration activity is recorded under a designated system account rather than a regular employee account, helping separate integration activity from day-to-day workflow processes. For security best practices, each integration should use its own dedicated ISU.
In the sections below, we’ll walk through how to:
Create an Integration System User (ISU)
Create and configure a security group
Grant the required domain permissions
Activate security policy changes
Register an API client for OAuth authentication
Generate a refresh token and locate your OAuth endpoints
Once these steps are complete, you’ll be ready to configure your Workday connection in Workia.
Create an Integration System User (ISU)
Follow the steps below to create an ISU in Workday:
In Workday, search for Create Integration System User and select the task from the results.
Enter a username and password for the ISU. We recommend using a username that clearly identifies the integration, such as
workia_integration, so it is easily recognizable in Workday.
Set Session Timeout Minutes to
0to prevent the session from timing out.Ensure Do Not Allow UI Sessions is unchecked.
Search for and open the Maintain Password Rules task.
Add the ISU to the list of users exempt from password expiration.
Save your changes.
Create a Security Group
Follow the steps below to create a security group and assign your ISU:
In Workday, search for Create Security Group.
Select one of the following security group types:
Integration System Security Group (Unconstrained) — Provides access to all secured data.
Integration System Security Group (Constrained) — Provides access to a limited set of data based on organizational scope.
Enter a name for the security group.
Add the ISU you created as a member of the security group.
If using a constrained security group, define the organization scope.
Select Done to save your changes.
Grant Domain Permissions
Follow the steps below to grant your security group access to the domains required for the Workia integration:
In Workday, search for Maintain Permissions for Security Group and select the task from the results.
From the Source Security Group field, select the security group you created for the Workia integration.
Select OK to confirm your selection.
Open the Domain Security Policy Permissions tab.
Assign the required permissions for each domain used by the integration. Workia requires the following domain security policy permissions:
Permission | Domain Security Policy |
Get Only | Integration Event |
Get Only | Integration Build |
Get Only | Integration Process |
Get Only | Integration Debug |
Get Only | Worker Data: Current Staffing Information |
Get Only | Worker Data: Public Worker Reports |
Get Only | Worker Data: Historical Staffing Information |
Get Only | Person Data: Gender |
Get Only | Person Data: Date of Birth |
Get Only | Person Data: Marital Status |
Get Only | Worker Data: Compensation |
Get Only | Worker Data: Compensation by Organization |
Get Only | Worker Data: Staffing |
Get Only | Worker Position: View |
Get Only | Worker Data: All Positions |
Select OK to apply the permissions.
Select Done to save your changes.
Activate Security Policy Changes
After assigning domain permissions, you must activate the pending security policy changes before the integration can access Workday data.
In Workday, search for Activate Pending Security Policy Changes and select the task from the results.
Enter a comment in the Comment field for audit purposes, then select OK.
Select the Confirm checkbox to confirm the changes.
Select OK to complete the activation process.
Register an API Client for Integrations
Follow the steps below to register an API client in Workday:
In Workday, search for Register API Client for Integrations and select the task from the results.
Enter a name for the API client in the Client Name field. We recommend using a recognizable name such as
Workia API Client.Enable the Non-Expiring Refresh Tokens option.
Configure the API client scopes to include:
Contact Information
Core Compensation
Core Payroll
Integration
Personal Data
Public Data
Staffing
Select OK to generate the:
Client ID
Client Secret
Copy and securely save the Client ID and Client Secret. You’ll need these values when configuring the connection in Workia.
Select Done to complete the setup.
Generate a Non-Expiring Refresh Token
Follow the steps below to generate a non-expiring refresh token for your API client:
In Workday, search for View API Clients and open the report from the search results.
Open the API Clients for Integrations tab.
Select the API client you created for the Workia integration.
Select the actions menu (...) next to the client name, then navigate to:
API Client > Manage Refresh Tokens for Integrations
In the Workday Account field, enter the account of a user authorized to access the integration.
Select OK.
On the Delete or Regenerate Refresh Token page, select Generate New Refresh Token.
Select OK to generate the token.
Copy and securely save the refresh token from the confirmation page. You’ll need this value when configuring the connection in Workia.
Select Done to complete the process.
Locate Your OAuth Endpoint URLs
Follow the steps below to locate the OAuth endpoint URLs required for the Workia connection:
In Workday, search for View API Clients and open the report from the search results.
Select the API client you created for the Workia integration.
Locate and copy the following values:
Token Endpoint
Authorization Endpoint
Securely save these URLs. You’ll need them when configuring the OAuth 2.0 connection in Workia.
💡Note: Refer to this article to learn more about Workia's Workday Integration.