Workday HR

Workday provides applications for enterprise resource planning (ERP) and human capital management (HCM). DataBee integrates with Workday for the purpose of building an organization's hierarchy, which is used in other views.  For detailed information, refer to the Workday’s official documentation. 

Integration Method: API

Tables: User Inventory (5003)

This integration supports the following events.

This integration supports the following versions.

Note:

Workday is a continuously updated cloud service. As for this document preparation, the latest release was in March 2025.

Prerequisites

1. The user should have access to the Workday portal with an account that has the Global Administrator privileges.  

2. The user should have access to the DataBee console. 

Configuration Overview 

1. Workday 

   1. Create an Integration System User (ISU) in Workday.

   2. Register an API Client for Integrations associated with the ISU an get the Client ID, Client Secret and Refresh Tokens.

   3. Create a Security Group, add ISU as member and assign permissions.

2. Create Workday HR Data Feed in the DataBee console with the required Client credentials.

   DataBee Parameter	Workday Parameter
   Client Key	Client ID
   Client Secret	Client Secret
   Refresh Token	Refresh token
   API Base URL	REST API endpoint
   Token URL and <tenant>	Token endpoint

Workday Configuration

Create Integration System User 

1. Login to Workday as an admin and search for Create Integration System User. 

   

    

2. In the dialog box, fill in the required fields of the form and click OK. 

   

Registering API Client for Integrations 

1. Search for Register API Client for Integrations.

   

    

2. In the dialog box, enter the required fields of the form.

   • Client Name: enter a unique client name.

   • Non-Expiring Refresh Tokens: SELECT

   • Disabled: UNSELECT

   • Scope: Add the following

     • Implementation

     • Integration

     • System

     • Tenant non-configurable

   • Include Workday Owned Scope: SELECT

   

3. Click OK and save the Workday API Client ID and Client Secret.

   

4. Search for View API Clients in Workday at the above. 
     

5. Capture datacenter and tenant name for Workday API URLs as shown below.

   

   

6. Under the API Clients for Integrations tab, select the newly registered API client above.

   

    

7. From Related Actions, select API Client > Manage Refresh Tokens for Integrations.

   

    

8. In the Workday Account field, select the newly created integration user click OK.

   

    

9. Check Generate New Refresh Token for Integrations and click OK.

   

    

10. Copy and save the generated Refresh Token. 

11. At this point, you will have the Refresh Token, Client ID and Client Secret.  

Editing Security Policy 

1. Search for Create Security Group.

   

    

2. Fill in the fields: 

   • Type of Tenanted Security Group: Integration System Security Group (Unconstrained)

   • Name: assign a name.

     

      

3. Select the newly created Integration System User.

   

4. From Related Actions, select Security Group > Maintain Domain Permissions for Security Group.

   

5. Add the following permissions to the group:

   Operations
   Domain Security Policy	Functional Area	VIEW	GET
   Manage: Organization Roles	Organization and Roles	P	P
   Reports: Organization	Organization and Roles	P	P
   Reports: Manager	Staffing	P	P
   Worker Data: Public Worker Reports	Staffing	P	P
   Worker Data: Workers	Staffing	P	P

   

6. Search for Security Policy Changes and activate the Security Policy Changes.

   

    

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for the Workday HR and click it as shown below.
    

3. Click on the API Ingest option for collection method.
    

4. Enter feed contact information and click Next.

   
   

5. In the configuration page, confirm the following:

   • Select the event type and enter the tenant's name. 

   • Refresh Token: Paste the Workday Refresh Token.

   • Client Key: Paste Workday Client ID.

   • Client Secret: Paste Workday Client Secret.

   • Token URL: Replace the <tenant> placeholder.

   • API URL: Ensure the datacenter in the API Base URL matches Workday REST endpoint.

   • Event Types: Preselected for all the event types that integration pulls.
      

6. Click Submit.

Troubleshooting Tips

• If you encounter an Invalid client or Unauthorized client error, it may be due to incorrect credentials. Please double-check that the client key, client secret, and Tenant are entered correctly. To avoid any issues, consider pasting it into a text editor to ensure there are no extra spaces or unexpected characters before reconfiguring the DataBee feed. 

• If you receive an Unauthorized error, it may be because the client ID and client secret belong to different applications. Verify that you are using credentials from the same tenant to resolve the issue.