Installation - Employees

​

System Requirements

​

Workday Configuration

​

Authentication

• Client ID, client secret, and refresh token
• Workday API URL

​

Basic Authentication Setup

1. Create Integration System User (ISU)
   • Create Integration System User business process.
   • Do not allow UI sessions as this user will only be used for automations.
   • Please securely store the username and password of this user.
2. Update password expiration rules for ISU
   • In the Maintain Password Rules business process under “System Users exempt from password expiration” add the newly created ISU to the list.
   • Note: This ensures the integrations will keep running without interruptions due to password expiration.
   
3. Set up security permissions for the ISU through security policies
   • Go to Create Security Group, choose “Integration System Security Group (Unconstrained)”.
   • Note on acceptance testing: Consider using two different security groups, one Unconstrained and one Constrained. This way, the test-set is scoped while the correct permissions are applied for other Web Services.
   
   • The next screen presents you with an Edit form to add additional information. Add your ISU to the list. This can be changed later too. Do not check “Inactive”.
   

4. Edit the Security Group’s domain security policies
   • Search for “View Security Group” and select your created security group.
   • Select the option menu next to the Security Group’s name, go to “Security Group” and select “Maintain Domain Permissions for Security Group”.
   
   • Under Integration Permissions add the following Domain Security Policies, and run the Activate Pending Security Policy Changes task to apply the changes.

   Domain Security Policy	Access
   Manage: External Skills	Put
   Person Data: Skills	Put
   Set up: Skills and Experience	Put
   Worker Data: Public Worker Reports	Get

5. Find out the correct Workday API URL
   • Search for Public Web Services in the search bar at the top of the Workday home page.
   • In the list, click the three dots next to the Human Resources (public) entry. select View WSDL under Web Service.
   • The resulting page will take some time to load. Once it is loaded, look for “soapbind:address location” near the bottom of the page and copy the URL you find next to it.
   • Note that the API URL can differ between implementation tenants and production tenants, so the steps described above need to be repeated for each tenant individually.

​

OAuth Authentication Setup

6. Create API Client for Integrations
   • Search for “Register API Client for Integrations” business process
   • Enable non-expiring refresh tokens to ensure continuity of service
   • Add the appropriate scopes:
   
   • Securely store the client ID and client secret
   
7. Generate Refresh Token
   • Search for “View API Clients” report
   • Click “API Clients for Integrations” tab
   • Note down the token endpoint. You will need to share this later.
   
   • Find your API client and select “Manage Refresh Tokens for Integrations”
   • Under “Workday Account”, type in your ISU
   • Press OK
   • Check the box “Generate new refresh token”
   • Press OK
   • Securely store the refresh token.

​

TechWolf Configuration

1. In the integration service on the TechWolf side, TechWolf adds the credentials of the customer-created ISU.
2. TechWolf adds TechWolf API credentials with correct scopes to have access to the TechWolf API and links that TechWolf tenant to a Workday tenant.
3. In communication with the customer, TechWolf or the customer inserts Employees into the TechWolf API, corresponding to the Workday Workers to which the integration is scoped.

​

Linking Workday & TechWolf

​

Seamless Matching of Employee IDs

1. Using Employee IDs: If you want to use Workday Employee IDs as the identifier field in Workday, then this same ID must also be used as the Employee external_id in TechWolf.
2. Using Workday IDs (WIDs): If you want to use Workday IDs as the identifier field in Workday, then this same ID must also be used as the Employee external_id in TechWolf.

​

Creating Custom Properties

• For each Employee in the TechWolf system, introduce a new custom property such as employee_workday_id. This property will store the corresponding Workday ID of the Employee.
• Detailed instructions for creating new custom property definitions can be found here .

​

Setting Custom Property Values

• Once the custom property is defined, assign the Workday ID to each Employee’s TechWolf profile.
• Steps for setting these values are outlined here .

​

Deployment Methodology

1. The customer has the appropriate TechWolf API license(s).
2. The TechWolf API contains all Employee information corresponding to Workday workers and data from other external systems.
3. A Skill Profile validation tool (e.g., MS Teams bot) is set up and configured (see separate deployment guide).

​

Deployment Tasks & Responsibilities

1. Customer: Create Integration System User (ISU) based on workflow described above.
2. Customer: Choose and configure authentication method (Basic or OAuth).
3. Customer: Share authentication credentials with TechWolf:
   • For Basic Authentication: ISU username and password
   • For OAuth Authentication: client ID, client secret, and refresh token
4. Customer: Share Workday API URL with TechWolf.
5. TechWolf: Run initial sync of worker profiles with TechWolf API.
6. TechWolf: Setup tenant configuration and start bidirectional sync process.
7. Customer: Check end-user test scenarios.

​

Customer / User Acceptance Testing