Connect Applaud to Workday

This article explains how to establish a secure connection between Applaud and Workday using Workday REST APIs.

It describes how to:

• Create and configure the Integration System User (ISU)
• Assign required security permissions
• Validate API connectivity for the integration

These steps allow Applaud and Workday to exchange data securely and in a controlled manner.

Prerequisites for Creating an ISU:

• Security Permissions:
  • Integration Security domain in the Integration functional area.
  • WCP Integration System User Security domain in the System functional area for assigning ISUs to an app.
     
• Access Requirements:
  • Company Administrator, Developer, or Specialist access on the Developer Site.

Prerequisites for Registering an API Client:

• Security Domains:
  • Security Administration domain in the System functional area.
     
• OAuth 2.0 Settings:
  • Enable OAuth 2.0 clients in the tenant setup.
     
• Client Registration:
  • Enter the Client Name and select the Client Grant Type (e.g., Authorization Code Grant).
     
• Scope Selection:
  Choose the functional areas that the OAuth 2.0 client requires access to.

These prerequisites ensure you have the required permissions and configuration to successfully create an ISU and register an API client.

Types of connections:

• Integration System User (ISU) 
• OAuth API client setup

Integration System User (ISU): 

A dedicated account that defines the identity and permissions used by an integration.

• Required for all integrations (SOAP, REST, WQL)
• Primarily used with Basic Authentication for SOAP APIs, but also serves as the identity backbone for REST and WQL connections via OAuth
• Determines data access through assigned security groups and domain permissions

OAuth API client: 

The recommended authentication method for accessing Workday REST APIs and Workday Query Language (WQL).

• Used for REST APIs and WQL queries
• Provides secure, token-based authentication
• OAuth client is linked to an ISU
• Access is controlled by ISU security permissions

Configure an Integration System User (ISU) in Workday

Step 1: Create Integration System User

1. In Workday, search for Create Integration System User.
2. Select the Create Integration System User task and fill in the corresponding details:

Step 2: Create ISSG (Integration System Security Group)

After you successfully create the ISU, create a security group and assign it to the ISU.

1. In Workday, search for the Create Security Group task.
2. Select Integration System Security Group (Unconstrained) as the Type of Tenanted Security Group, and enter a unique Name.

Step 3: Assign Integration System Security Groups (ISSG) to ISU

1. Search for All Workday Accounts, and then filter User Name by the newly created Workday account.
2. Assign the Integration System Security Group for Integration User, and then select OK.
3. Validate the details, and then select Done.

Step 4: Add Domain Security Policies to ISSG

1. In Workday, search for the View Security Group task.
2. Search for the newly created Security Group, and then select OK.
3. Select the Related Actions menu to Add/Remove Domain Permissions for Security Groups.
4. Select Security Group and then select Maintain Domain Permissions for Security Group.
5. Add the Report/Task Permissions:

• Domain Security Policies permitting Modify access
• Domain Security Policies permitting View access

6. Add the Integration Permissions:

• Domain Security Policies permitting Put access
• Domain Security Policies permitting Get access

7. After you add all required tasks, select OK.
8. Review the details, and then select Done.

Step 5: Add Security Groups to Business Process

1. In Workday, search for each business process, and then add the appropriate security groups to each web service that sends API requests.

2. Select the Related Actions icon, go to Business Process Type, and then select Edit.

   

3. In Edit Business Process Security Policy, add your security group under Create Job Requisition (Web Service), and then select OK.

Step 6: Activate Pending Security Policy Changes

1. In Workday, search for Activate Pending Security Policy Changes and open the task.
2. Add comments and select OK to apply pending security policy changes.

Step 7: Search for newly created ISU or existing ISUs in Workday

1. In Workday, search for View Security Groups for User and open the task.
2. Type the name of the ISU in the Person field. and select OK.

Configure an OAuth 2.0 API client in Workday for Integrations

Step 1: Register API Client

In Workday, search for the Register API Client for Integrations task.

Enter Client Details, including Scope (Functional Areas), and select OK.

Below is a full list of Scope (Functional Areas) to add for the solution to work:

Copy client credentials: Client ID and Client Secret, and select Done.

Step 2: Generate a Refresh Token

1. In Workday, search for the View API Clients task.
2. Open the task and copy the following details:

• Workday REST API Endpoint
• Token Endpoint

3. In View API Clients, select the API Clients for Integration tab, and select the API Client that has recently been created.
4. Select the Related Actions Menu, then select the Manage Refresh Token for Integrations action to add an ISU account.
5. Add the ISU account created earlier for the API client and select OK.
6. Select the Generate New Refresh Token checkbox and then select OK.

7. Copy the Refresh Token and select Done.