Skip to main content

​
Prerequisites

  • A Workday tenant with the Workday Query Language (WQL) feature enabled.
  • Security administrator access in Workday.
  • An active TechWolf contract with SkillEngine API credentials.

​
Workday configuration

The setup consists of creating an Integration System User, granting the appropriate security permissions, and registering an API client. Follow each step in order.
1

Create an Integration System User (ISU)

  1. Search for Create Integration System User in the Workday search bar.
  2. Create a new user (e.g. TechWolf_Source_ISU).
  3. Set a password — it will not be used directly but is required by Workday.
  4. Check Do Not Allow UI Sessions to restrict this user to API-only access.
Store the ISU credentials securely. You will need the username when generating a refresh token.
2

Create an Integration Security Group

  1. Search for Create Security Group.
  2. Choose Integration System Security Group (Unconstrained).
  3. Name it (e.g. ISSG_TechWolf_Source).
  4. Add the ISU created in the previous step.
If you want to limit the connector to a specific subset of workers (e.g. a particular country or business unit), create two security groups for the same ISU:
  • an Integration System Security Group (Unconstrained) for the Workday Query Language permission
  • an Integration System Security Group (Constrained) for the worker data permissions
On the constrained group, add the ISU, add the relevant organisation, and choose whether access applies only to that organisation or also to subordinate organisations.
3

Grant domain security permissions

  1. Search for Maintain Permissions for Security Group and select the security group created in the previous step.
  2. Under Integration Permissions, add View access for the Workday Query Language domain. This is required for all data types.
  3. Add the required permissions listed in the permissions table below. The table separates Get and View domain access.
  4. If the permissions table lists Business Process Security Policies for your selected data types, give View All access on those Business Processes.
  5. Search for Activate Pending Security Policy Changes and activate the changes.
For a constrained setup, grant Workday Query Language on the unconstrained security group and grant the worker data domains on the constrained security group. Workday may not allow the Workday Query Language domain to be added directly to an Integration System Security Group (Constrained).
You only need to grant permissions and API client scopes for the data types you plan to use. For example, if you only need Workers and Jobs, you do not need to grant access to Learning or Person Data domains.
4

Register an API Client for Integrations

  1. Search for Register API Client for Integrations.
  2. Set a client name (e.g. TechWolf Datasource Integration).
  3. Under Scope (Functional Areas), add System and Tenant Non-Configurable. If you plan to use Feedback, also add Performance Enablement.
  4. Check the following boxes:
    • Non-Expiring Refresh Tokens
    • Include Workday Owned Scope
  5. After creation, securely store the Client ID and Client Secret.
5

Generate a refresh token

  1. Search for View API Clients.
  2. Click the API Clients for Integrations tab.
  3. Find the API client created in the previous step.
  4. Select API Client > Manage Refresh Tokens for Integrations.
  5. Under Workday Account, enter the ISU created in Step 1.
  6. Check Generate New Refresh Token and confirm.
  7. Securely store the refresh token.
The refresh token is displayed only once. If you lose it, you must generate a new one.
6

Find base URL and tenant name

  1. Search for View API Clients in the Workday search bar.
  2. Locate the Workday REST API Endpoint field. It will look like:
  3. The base URL is the host portion: https://wd2-impl-services1.workday.com
  4. The tenant is the last path segment after /v1/: mycompany
The API URL can differ between implementation tenants and production tenants. Repeat this step for each tenant you want to connect.

​
Share credentials with TechWolf

Once the Workday configuration is complete, securely share the following credentials with TechWolf: TechWolf will validate that the ISU has the required permissions and that the credentials are correct. If any permissions are missing, the connector will report exactly which security domains need to be added.

​
Permissions per data type

Grant the domains below for every data type you plan to use. Entries marked “incremental only” are only needed when TechWolf configures incremental change detection for that data type.

​
API client scopes

Every API client must include System and Tenant Non-Configurable. Keep Include Workday Owned Scope selected. Add these additional scopes based on the data types enabled for the connector:
Workday tenant configuration can hide scopes for products that are not enabled. If Performance Enablement is unavailable in your tenant but you want to use Feedback, share that during setup so TechWolf can validate the exact access against your Workday environment.
Business Process Administration is a domain permission, not a Business Process Security Policy. It is only needed for incremental change detection on data types that resolve named Business Process identifiers.
Feedback requires View permissions on the Feedback domains. Granting only Get on those domains will result in empty data with no error message.

​
TechWolf configuration

After receiving the credentials, TechWolf will:
  1. Validate the credentials and security permissions.
  2. Configure the connector for the agreed-upon data types.
  3. Set up the connector on a daily schedule.
  4. Run an initial data extraction.
  5. Confirm the integration is operational.
No further action is required from your side unless permission issues are reported.