Skip to main content

​
System Requirements

The Job Description Sync makes use of existing Workday functionality. The customer will need a TechWolf contract with a live TechWolf tenant, populated with (a subset of) the Job entities in Workday, and job descriptions authored in the TechWolf Console. This integration authenticates with OAuth only.

​
Workday Configuration

A Workday integration user must be configured in the Workday tenant with an implementation security group.
If you already have a Job Skill Sync integration configured, the same ISU, security group, and API Client can be reused: steps 1–3 and 5–7 are already in place, and the Job Information domain policy from that setup is already sufficient for this integration’s read access. The only new step is the business process permission in step 4 — after granting it, run Activate Pending Security Policy Changes and continue to the Console Configuration section.

​
1. Create Integration System User (ISU)

  • Create Integration System User business process.
  • Do not allow UI sessions as this user will only be used for automations.
  • Please securely store the username and password of this user.

​
2. Update password expiration rules for ISU

  • In the Maintain Password Rules business process under “System Users exempt from password expiration” add the newly created ISU to the list.
  • Note: This ensures the integrations will keep running without interruptions due to password expiration. Maintain Password Rules

​
3. Set up security permissions for the ISU through security policies

  • Go to Create Security Group, choose “Integration System Security Group (Unconstrained)”.
  • Note on acceptance testing: Consider using two different security groups, one Unconstrained and one Constrained. This way, the test-set is scoped while the correct permissions are applied for other Web Services. Create Security Group Create Security Group Detail
  • The next screen presents you with an Edit form to add additional information. Add your ISU to the list. This can be changed later too. Do not check “Inactive”. Edit Security Group

​
4. Set up the Security Group’s permissions

Job descriptions live on the Workday Job Profile, and Workday manages changes to job profiles through the Manage Job Profile business process — the same process that runs when an admin edits a job profile in the Workday UI. The integration therefore needs two kinds of permissions: domain access to read job profiles, and permission to start the business process that updates them.

​
Domain security policies (read access)

  • Search for “View Security Group” and select your created security group.
  • Select the option menu next to the Security Group’s name, go to “Security Group” and select “Maintain Domain Permissions for Security Group”.
  • Under Integration Permissions add the following Domain Security Policy:

​
Business process permission (update access)

  • Search for “Edit Business Process Security Policy” and select the Manage Job Profile business process. Edit Business Process Security Policy for Manage Job Profile
  • Under “Who Can Start the Business Process”, find the Initiating Action Submit Job Profile (Web Service) and add your security group to its Security Groups. Add the security group to the Submit Job Profile (Web Service) initiating action
  • Run the Activate Pending Security Policy Changes task to apply both changes. Activate Pending Security Policy Changes
This business process permission is the entire update-side key: with it, the integration’s updates complete automatically and are recorded as regular, auditable Manage Job Profile events in your tenant’s history. The integration only ever submits the job description field — skills and all other profile fields are never part of its payload. If your security team wants Workday itself to enforce description-only updates as well, an opt-in server-side restriction is available — ask your TechWolf contact.

​
5. Find out the correct Workday API URL

  • Search for Public Web Services in the search bar at the top of the Workday home page.
  • In the list, click the three dots next to the Human Resources (public) entry. Select View WSDL under Web Service. View wsdl
  • The resulting page will take some time to load. Once it is loaded, look for “soapbind:address location” near the bottom of the page. You will see a section like this:
  • Copy the base tenant URL up to and including your tenant name. The service name and version should be excluded from the URL.
  • Note that the API URL can differ between implementation tenants and production tenants, so the steps described above need to be repeated for each tenant individually.
If you are using OAuth Authentication (recommended), continue with the OAuth setup steps below before connecting the integration.If you have arranged Basic Authentication, this is the final Workday configuration step. Proceed to the TechWolf Configuration section.

​
6. Create API Client for Integrations

  • Search for “Register API Client for Integrations” business process
  • Enable non-expiring refresh tokens to ensure continuity of service
  • Add the appropriate scopes: API Client Setup
  • Optionally, restrict the client to TechWolf’s IP ranges by filling in the “Restricted to IP Ranges” field with the values from the IP Addresses page
  • Securely store the client ID and client secret API Client Credentials

​
7. Generate Refresh Token

  • Search for “View API Clients” report
  • Click “API Clients for Integrations” tab
  • Note down the token endpoint. You will need to share this later. API Client Refresh Token
  • Find your API client and select “Manage Refresh Tokens for Integrations”
  • Under “Workday Account”, type in your ISU
  • Press OK
  • Check the box “Generate new refresh token”
  • Press OK
  • Securely store the refresh token.
Keep your OAuth credentials secure and share them only with TechWolf through secure channels.

​
Console Configuration

This integration is configured self-service in the TechWolf Console:
  1. Enter the Workday API URL and the ISU’s OAuth credentials (client ID, client secret, refresh token). Further explanation specified in section beneath Linking Workday & TechWolf
  2. Run the connection validation. It verifies each layer separately: the credentials (token fetch), read access (profile fetch), and update access — a reversible test write that appends a marker to one job profile’s description, confirms it, and restores the original.
  3. Enable the integration.
Choosing the validation job profile. The validation asks for the ID of a job profile to test against, and remembers it for later validations. Pick a low-traffic or seperate test profile — each validation shows up as a Manage Job Profile event in that profile’s history.

​
Linking Workday & TechWolf

Jobs are matched on the same identifier configuration as the Job Skill Sync: either Workday Job Codes (Job Profile IDs) or Workday IDs (WIDs), matching the Job external_id in TechWolf. If you run both integrations, they share this setting.

​
Deployment Tasks & Responsibilities

  1. Customer: Create the Integration System User and grant the permissions described above (for existing Job Skill Sync tenants: only the business process permission).
  2. Customer: Enter the Workday API URL, OAuth credentials and ID of Job Profile we use during validation in the TechWolf Console and run the validation.
  3. TechWolf: Potentially follow the first synchronization and confirm go-live with the customer.
  4. Customer: Check end-user test scenarios — publish a job description in the Console and verify it appears on the Workday Job Profile.