Overview

All of the data requests we make to Workday are in the form of SOAP requests, except for Time Off data. Workday only supports the full breadth of Time Off data through their REST API, which requires a different set of credentials (OAuth). This guide provides the details about the additional configurations that you'd need to perform on Workday to connect your Workday data along with Time Off details.

Prerequisites

• You have Administrator permissions in your company's Workday instance.

• You have already set up the Integration System User (ISU) following Steps 1 and 2 of the main Workday guide.

Instructions

Step 1: Choose the correct option in the linking flow

You'll need to choose the Use my Workday credentials and also provide OAuth credentials option in the linking flow to connect Workday along with Time Off data.

Step 2: Follow our main Workday guide and add Time Off specific permissions

Step 3 of the main guide explains configuring permissions to enable GET access to the list of domains. To access Time Off data, you will need both GET and View access to the Time Off domains.

Here is the minimum set of domains you will need enabled:

Add these domains within the security group and complete the rest of the steps on the main guide. The steps below will guide you in creating an API Client that we can use to access the Time Off data.

Step 3: (Conditionally required) Create a segment-based security group for Request Time Off (REST Service)

The steps below are only required if you want Time Off data sent to (POSTed to) Workday. If you just want Time Off data retrieved from Workday, the steps below are not required and you may skip to Step 4.

1. In the Search field, search Edit Business Process Security Policy.

2. Select the Request Time Off security policy and select OK.

   

3. Scroll down and find the Request Time Off (REST Service) Initiating Action.

4. Click into the Security Groups field and select Create > Create Segment-Based Security Group.

   

5. Populate the popup that appears with the below information:

   1. Name: Any name will suffice (e.g., Time Off Integration Segmented Security Group)

   2. Security Group: The security group you are using for the integration (created in Step 2 of the main Workday guide)

   3. Access to Segments: Time Off Type Security Segment - All Time Offs

   

6. Once you've populated the information above, click OK.

7. You'll be taken back to the Edit Business Process Security Policy wizard. Click OK again on that wizard to finish editing the security policy.

8. To finish, Activate the pending authentication policy changes by following step 6 in the main Workday guide.

Step 4: Create a new API client for integrations

1. In the Search field, type Register API Client for Integrations.

2. Select the Register API Client for integrations task.

3. On the Register API Client for Integrations page, in the Client Name field, enter any name for your API client.

4. Select the Non-Expiring Refresh Tokens option.

5. In the Scope (Functional Areas) field, select:

   1. Tenant Non-Configurable

   2. Staffing

   3. Time Off and Leave

   

6. Click OK.

   The client ID and client secret are displayed.

7. Save the Client Secret and Client ID.

8. Click Done.

9. Enter the Client Secret and Client ID in the linking flow.

Step 5: Generate a non-expiring refresh token

1. In the Search field, type View API client.

2. Select the View API Clients task.

3. On the View API Clients page, click the API Clients for Integrations tab.

4. Click the client you created in Step 4.

5. Click API Client > Manage Refresh Tokens for Integrations.

6. On the Manage Refresh Tokens for Integrations page, in the Workday Account field, enter the Workday account of the Integration System User you created in Step 1 of the main Workday guide.

7. Click OK.

8. Return to the Workday home page.

9. In the Search field, type Register api client for integration.

10. On the Delete or Regenerate Refresh Token page, select the Generate New Refresh Token option.

11. Click OK.

12. On the Successfully Regenerated Refresh Token Page, copy the refresh token.

13. Click Done.

14. Add the Refresh Token to the linking flow.

Step 6: Find your token endpoint URL

1. Log in to the Workday tenant.

2. In the Search field, type View API Client.

3. Select the View API Clients task.

4. On the View API Clients page, save the URL in the Token Endpoint field.

   

5. Add the Workday OAuth Token URL to the linking flow.

Questions

If you have questions, reach out to your CSM or [email protected].