/
Workday API

Workday API

This guide explains how to configure a Workday connection in OnLink by creating or selecting an Integration System User (ISU), assigning security group access, granting domain security policy permissions, and activating the changes.

Prerequisites

  • Administrator access to the Workday tenant.

  • Permission to create or manage Integration System Users and security groups in Workday.

  • The Workday tenant name, API URL, API version, username, and password for the integration.

  • An Integration System User (recommended) for third-party integrations such as OnLink.

Overview

  1. Collect the Workday connection details required by OnLink.

  2. Create or identify an Integration System User in Workday.

  3. Add the Integration System User to an Unconstrained Integration System Security Group.

  4. Configure the required Domain Security Policy permissions for that security group.

  5. Activate the pending security policy changes.

  6. Use the security analysis report to verify access if needed.

Configure Workday Connection in OnLink

The Workday connector lets you connect to a Workday instance and access Workday resources using the published APIs.

The following details are required to establish the Workday connection:

Field

Description

Example

Field

Description

Example

Workday API URL

The base URI for every API request. To find it:

  1. In your Workday tenant, search for Public Web Services and select the report.

  2. Hover over Human Resources, click the three dots to open the menu, select Web Services, and then select View WSDL.

  3. Navigate to the bottom of the page that opens, find the host, and copy the URL.

https://wd5-services1.myworkday.com/ccx/service

Workday API version

The API version to use. Prefix the version with the letter v.

v40.1

Workday Tenant Name

The tenant for the account. The tenant name is found in the URL when you are signed in to Workday.

If the tenant URL is https://impl.workday.com/sample_company/d/home.html, the tenant name is sample_company.

Workday Username

The username used to connect to the tenant. Workday recommends using an Integration System User (ISU) for third-party integrations such as OnLink. This ensures all integration operations are logged under this user and can be audited. It also avoids issues caused by worker terminations or account deactivation.

Use the ISU created for this integration.

Workday Password

The password associated with the Workday user.

The ISU password.

image-20240410-192928.png

Creating a Workday Integration System User

For Workday provisioning, Onward’s apps require an Integration System User in Workday with the relevant permissions. This user account is used to consume data from Workday through the Workday APIs.

You might already have a suitable Integration System User. If not, use the following procedure to add one.

The Integration System User must be part of an Unconstrained Integration System Security Group with a series of Domain Security Policies granted to it to access the appropriate data.

Create the ISU

Warning: Use an Integration System User (ISU) for the OnLink integration. Do not use an individual worker account, because access can break if the worker is terminated or the account is deactivated.

  1. Go to your Workday tenant and enter “create integration system user” in the search field.

  2. Under Tasks & Reports, click Create Integration System User.

  3. Enter a username and password for the new user.

  4. Leave the Require New Password at Next Sign In option clear.

  5. For Session Timeout Minutes, enter 0. This option helps avoid any issues related to timeouts.

  6. Select Do Not Allow UI Sessions to prevent this user from signing into Workday.

  7. Click OK.

Tip: Set Session Timeout Minutes to 0 to help prevent integration failures caused by session timeouts.

Warning: Select Do Not Allow UI Sessions so this integration user cannot sign in to the Workday UI.

Adding the Integration System User to a Security Group

To ensure that the Integration System User can access the appropriate worker data, add it to an Unconstrained Integration System Security Group.

You might already have a suitable Security Group. If not, use the following procedure to add one.

  1. Go to your Workday tenant and enter “create security group” in the search field.

  2. Under Tasks & Reports, click Create Security Group.

  3. For Type of Tenanted Security Group, select Integration System Security Group (Unconstrained).

  4. Enter a name for the security group.

  5. Click OK.

  6. On the Edit Integration Security Group (Unconstrained) screen, add the appropriate user to the group under Integration System Users. You can search or browse for the appropriate user.

  7. Click OK.

Configuring the Domain Security Policy Permissions for the Security Group

Edit the security group to ensure that it has the appropriate permissions.

  1. Go to your Workday tenant and enter “maintain permissions for the security group” in the search field.

  2. Under Tasks & Reports, click Maintain Permissions for Security Group.

  3. For Operation, click Maintain.

  4. For Source Security Group, enter the name of the security group you created earlier.

  5. Click OK.

  6. On the next screen, under Domain Security Policy Permissions, add a separate row for each required Domain Security Policy. To add a new row click the + icon, enter the correct access level and the Domain Security Policy. 

  7. Below are the web services we call. Depending on your use case, add the relevant security policies to the group.

    1. Get Workers 

    2. Put Applicant 

    3. Terminate Employee

    4. Change Worker Contact Information

Activating the Security Policy Changes

After you have reviewed the permissions for the group, activate the security policy changes. If you don’t activate the security policy changes, the Integration System User will not have the necessary permissions.

  1. Go to your Workday tenant and enter “activate pending security policy changes” in the search field.

  2. Under Tasks & Reports, click Activate Pending Security Policy Changes.

  3. Add a comment to describe the security changes and then click OK.

  4. Review the pending security policy changes, then select the Confirm checkbox.

  5. Click OK.

Tip: Use the “Security Analysis for Securable Item and Account” report to figure out if your user has access to the relevant data.