Skip to main content

Workday: How do I link my account?

Written by Poppy Wooddissee

Prerequisites

  • Ensure you are an admin of your Workday account before starting.

    1. After logging into Workday, search for "View API Clients"

    2. If you can not see this menu item, you are not an admin of the Workday account.
      ​

      Workday_find_Service_URL.png

    3. If you do not see this menu item, figure out who your Workday Admin is and ask them to give your account sufficient permissions or to take over the integration process.

Find your Workday Service URL

  1. Click on the "Search" field at the top and enter "View API Clients"

  2. Click on the task "View API Clients" that just appeared

    Workday_find_Service_URL.png

  3. At the top of the page that just appeared find and copy the "Workday REST API Endpoint"

    Workday_see_Service_URL.png

Add an integration system user (ISU)

  1. Click on the "Search" field at the top and enter "Create Integration System User"

  2. Click on the task "Create Integration System User" that just appeared

    Workday_create_ISU.png

  3. In the dialog that just opened, enter a username and generate a secure password.
    You can leave the other fields untouched

  4. At the bottom of the dialog, click "OK"

    Workday_configure_ISU.png

Add the ISU to your list of system users

While the newly created ISU will work for linking your Workday account its password will expire after some time unless you add it to your list of system users.

Create a security group and assign the ISU to it

  1. Click on the "Search" field at the top and enter "Create Security Group"

  2. Click the task "Create Security Group" that just appeared

    Workday_create_security_group.png

  3. On the page that just appeared locate the dropdown "Type of Tenanted Security Group" and select "Integration System Security Group (Unconstrained)"

  4. For the "Name" enter the value of the "User Name" when creating the ISU earlier (in this case it would be test_isu, but yours will be different)

  5. At the bottom of the page, click "OK"

    Workday_configure_security_group.png

  6. On the next page, the only thing you have to do is go to the field "Integration System Users" and add the user you created earlier. You can do this by clicking on the field and typing in the name of the ISU (in this case test_isu)

  7. After that, go ahead and click "OK"

    Workday_edit_security_group.png

Add the required permissions to the security group

  1. Click on the "Search" field at the top and enter "Maintain Permission for Security Group"

  2. Click on the task "Maintain Permission for Security Group" that just appeared

    Workday_maintain_permissions_of_security_gruop.png

  3. In the window that just appeared, make sure you have the option "Maintain" selected

  4. Click the field "Source Security Group", enter the name of the group (in this case test_isu) and hit enter. Then click on the security group to select it.

  5. Click "OK"

    Workday_select_security_group_to_maintain.png

  6. In the window that just appeared, you can add the permissions you want for the ISU. You can find the list of permissions needed in the connection flow.
    ​

    Screenshot 2024-01-12 at 14.48.42.png


    ​
    ​
    ​    If you want to know why each permission is needed, see below under "Documentation of possible permissions"
    ​
    ​
    ​    For each permission, repeat the following process:
    ​

    1. Make sure the tab "Domain Security Policy Permissions" is selected

    2. Click on the icon with the "+" on it

      Workday_add_new_domain_security_permission.png

    3. Click on the cell in the column "View/Modify Access"

      Workday


      If the permission says "Get:", select "Get Only". Otherwise select "Get and Put"
      ​

      Workday

    4. Click on the cell in the column "Domain Security Policy",
      ​

      Workday


      type in the name of the policy (i.e. "Integration: Build"), hit enter and click on the item that just appeared in a list

      Workday

Activate your changes

After making any changes to your Workday security policy settings, make sure to apply those changes by executing the "Activate Pending Security Policy Changes" task. Without that, none of your changes with take effect.

  1. Click on the "Search" field at the top and enter "Activate Pending Security Policy Changes"

  2. Click on the task "Activate Pending Security Policy Changes" that just appeared

    Workday_activate_pending_security_changes_task.png

  3. In the window that just appeared, add any comment for applying the changes (i.e. "Grant ISU test_isu necesssary permissions for integratons"

  4. Click "OK"

    Workday_activate_pending_security_task_comment.png

  5. In the new window, check the box "Confirm"

  6. Click "OK"

    Workday_activate_pending_security_policy_changes_confirm.png

Create an API client

Please note that this step is only necessary if you want to read/write absences data from your Workday instance. In all other cases you can skip the steps below

  1. Click on the "Search" field at the top and enter "Register API Client for Integrations"

  2. Click on the task "Register API Client for Integrations" that just appeared

    Workday_create_API_client_task.png

  3. In the window that just appeared, enter a "Client Name", i.e. "test_isu API client"

  4. Make sure the option "Non-Expiring Refresh Tokens" is turned on

  5. For the field "Scope (Functional Areas)", enter the values
    ​Tenant Non-Configurable
    Staffing
    ​Time Off and Leave
    System

  6. Click "OK"

  7. In the new window, copy the Client ID and Client Secret for later use, then do not click "Done"

    Workday_create_API_client_show_token.png

  8. Still on the same page, click the three dots at the top, then "API Client" > "Manage Refresh Tokens for Integrations"

    Workday_create_API_client_find_manage_refresh_token.png

  9. In the new window, enter the name of the ISU that you created earlier

  10. Click "OK"

    Workday_create_API_client_refresh_token_for_ISU.png

  11. In the new window, check the box for "Generate New Refresh Token"

  12. Click "OK"

    Workday_create_API_client_confirm_regenerate_refresh_token.png

  13. In the new window, copy the refresh token and store it for later use

    Workday_create_API_client_show_refresh_token.png

Documentation of possible permissions

View/Modify Access

Security

Explanation

Get Only

Worker Data: Public Worker Reports

Reading public information about a worker. Public means any worker within the organisation can view this information about another worker (for example first name, last name etc.)
Always needed when reading any worker data

Get Only

Worker Data: All Positions

Reading position related information of a worker. For example manager, location, job title etc. Also allows us to read status data about the worker.
Always needed when reading any worker data

Get Only

Worker Data: Workers

Retrieving any worker data from Workday's webservices
Always needed when reading any worker data

Get Only

Person Data: Mobile Phone

Needed if reading worker's mobile phone number

Get Only

Person Data: Home Address

Needed if reading worker's personal home address

Get Only

Person Data: Date of Birth

Needed if reading worker's date of birth

Get Only

Person Data: Ethnicity

Needed if reading worker's ethnicity

Get Only

Person Data: Marital Status

Needed if reading worker's marital Status

Get Only

Person Data: Home Email

Needed if reading worker's personal Email

Get Only

Person Data: Work Email

Needed if reading worker's work Email

Get Only

Person Data: Gender

Needed if reading worker's gender

Get Only

Person Data: ID Information

Needed if reading identifiers such as SSN and National ID. Used exclusively to read the SSN.

Get Only

Worker Data: Current Staffing Information

Needed if reading information about the status of a worker. Used for termination_date, employment_status

Get Only

Worker Data: Employment Data

Needed if reading employment related data. Used for termination_date, employment_status

Get Only

Worker Data: Compensation by Organization

Needed if reading compensation data for workers. Used for pay_currency, pay_period and pay_rate in employments.

Get Only

Worker Data: Current Staffing Information

Needed if reading information about the status of a worker. Used to determine termination_date

Get Only

Worker Data: Employment Data

Needed if reading employment related data.

Get Only

Manage: Organization Integration

Needed if reading group information (cost centers and companies)

Get Only

Worker Data: Organization Information

Needed if reading which worker is in which group (cost centers, departments, and companies)

Get Only

Manage: Location

Needed if reading job locations

Custom Reports

Instead of granting the ISU access to the API, it is possible to create Custom Reports in Workday and to share access to the reports with the ISU. This allows minimal authorization, as the ISU can then strictly access only its shared reports, and the fields specified in those reports.
​
​

  1. Search for "Create Custom Report" in Workday and click on the item:
    ​

  2. Fill in the information as follows:
    ​Report Name: INTEGRATION_REPORT_WORKER
    ​Report Type: Advanced
    ​Enable As Web Service: Checked
    ​Data Source: Indexed All Workers
    ​

  3. Once you've filled in the necessary information, click on OK to save the new report:
    ​

  4. On the next page, remove the previously selected data source, then search for "All workers" and select this menu item (if you want the report to access only a subset of users, you can select your filtered data source instead):
    ​

  5. Next, return to the connection instructions. Based on the fields required, you'll find instructions to set up all the necessary fields that will be required for the report.
    ​
    ​

  6. Following the instructions, add each necessary field under the "Columns" and "Group Column Headings" section found in the report below.

    1. Please find the documentation for all the necessary fields here.

    2. Ensure that you enter the following data as instructed for each field:

      • Business Object

      • Field

      • Column Heading Override

      • Column Heading Override XML Alias
        ​

  7. Once you have finished setting up the fields, go to the "Share" tab and grant access to the group and ISU you have previously created for the integration:
    ​

Documentation of Custom Report fields

Business Object
​

Field

Column Heading Override / Column Heading Override XML Alias

Worker

Workday ID

remote_id

Worker

Employee ID

employee_number

Worker

Business Title

job_title

Worker

Employee Type

employment_type

Worker

Termination Date

termination_date

Worker

Date Of Birth

date_of_birth

Worker

Gender

gender

Worker

Active Status

job_status

Worker

Manager ID

manager_id

Worker

Total Pay - Frequency

pay_frequency

Worker

Total Base Pay - Amount

pay_rate

Worker Primary Position

Effective Date for Position

start_date

Worker Primary Position

Workday ID

prim_pos_wid

All Locations

Reference ID

location_id

All Locations

Workday ID

remote_id

All Locations

Primary Address

address_primary

All Locations

Primary Address - Line 1

address_line_1

All Locations

Primary Address - Line 2

address_line_2

All Locations

Primary Address - City

address_city

Location - Primary Position

Workday ID

primary_loc_wid

Job Family

Workday ID

job_family_id

Job Family

Group Name

group_name

Job Family

Job Family Name

job_family_name

All Positions / Jobs

Workday ID

position_wid

All Positions / Jobs

Effective Date for Position

start_date

All Positions / Jobs

Business Title

job_title

All Positions / Jobs

Time Type

employment_type

Cost Centers

Workday ID

remote_id

Cost Centers

Name

name

Group Column Headings

Business Object

Group Column Heading

Group Column Heading XML Alias

All Locations

locations

locations

All Positions / Jobs

positions

positions

Job Family

groups

groups

Location - Primary Position

primary_location

primary_location

Worker Primary Position

primary_position

primary_position

Related Articles
How do I begin the Yoti process through RefNow?
Did this answer your question?