Skip to main content

Integrating with Workday in Pequity (via API)

  • Updated

Overview

To authenticate your Workday account, you will need to provide the following information:

  • WSDL
  • ISU Username
  • ISU Password
  • Workday Tenant Name

​

Prerequisites

Please ensure you fulfill all the requirements to set up the integration:

  • You have Administrator permissions in your company's Workday instance

 

Instructions

Step 1: Create an Integration System User (ISU)

  • In your Workday portal, log into the Workday tenant
  • In the Search field, type Create Integration System User
  • Select the Create Integration System User task

​

 

  • On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password
    ​
    ​Important: "&", "<", or ">" characters cannot be included in the password
    ​
  • Click OK
    ​

 

  1. To ensure the password doesn't expire, you'll want to add this new user to the list of System Users. To do this, search for the Maintain Password Rules task.
    ​


    Add the ISU to the System Users exempt from password expiration field
    ​

     

  2. Enter the Integration System User name in the linking flow

  3. Enter the Integration System User password in the linking flow
    ​

     

Step 2: Create a Security Group and assign an Integration System User

  1. In the Search field, type Create Security Group
    ​


    Select the Create Security Group task.
    ​

  2. On the Create Security Group page, select Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group pull-down menu.
    ​


    If you would like to create a Constrained Security Group instead of an Unconstrained Security Group, please see the section in Notes below
    ​

  3. In the Name field, enter a name

  4. Click OK

  5. On the Edit Integration System Security Group (Unconstrained) page, in the Integration System Users field, enter the same name you entered when creating the ISU in the first section
    ​

     

  6. Click OK

     

Step 3: Configure domain security policy permissions

  1. In the Search field, type Maintain Permissions for Security Group
    ​

     

  2. Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2
    ​

     

  3. On the next screen, add the corresponding Domain Security Policies depending on your use case:
    ​

     

     
     

Step 4: Activate security policy changes

  1. In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved
    ​

     

  2. Add any relevant comments on the window that pops up

  3. Confirm the changes in order to accept the changes that are being made and hit OK
    ​

 

Step 5: Validate the authentication policy is sufficient

  1. Search for Manage Authentication Policies
    ​

     

  2. Click Edit on the authentication policy row
    ​

     

  3. Create an Authentication Rule
    ​

     

  4. Enter a name, add the Security Group, and ensure Allowed Authentication Types is set to Specific User Name Password or Any
    ​

     

Note: You don't have to create a new Authentication Rule if you already have an existing one set to User Name Password or Any. You can add the ISU you created to that rule instead.
​
You will need to create a new rule if SAML is the only Authentication Rule you see for "Allowed Authentication Types."

 

Step 6: Activate all pending authentication policy changes

  1. In the search bar type, activate all pending authentication policy changes
    ​

     

  2. Proceed to the next screen and confirm the changes. This will save the Authentication Policy that was just created or edited

     

Step 7: Obtain the web services endpoint

  1. Search in Workday for Public Web Services
    ​

     

  2. Find Human Resources (Public) if you are connecting Workday HRIS.
    ​
    Click the three dots to access the menu. Click Web Services > View WSDL
    ​

     

  3. Navigate to the bottom of the page that opens (it may take a few seconds to load)

  4. Copy everything until you see /service. This should look something like https://wd2-impl-services1.workday.com/ccx


    Example for Human Resources / Workday HRIS​



  5. Enter the Web Services Endpoint into the linking flow
    ​

 

Step 8: Enter your Tenant Name in the linking flow

Enter your Workday tenant name into the linking flow.

Example: If you sign in at "https://wd5-services1.workday.com/acme", enter "acme"
​

 

Important Notes

  • Implementation/sandbox tenant Workday accounts will result in slower syncs, as fewer resources are dedicated to the tenant
    ​

(Optional) Create a Constrained Security Group instead of Unconstrained

The following steps would replace Step 2 above.

  1. In the Search field, type Create Security Group.

     

     

  2. On the Create Security Group page, select Integration System Security Group (Constrained) from the Type of Tenanted Security Group pull-down menu.
    ​

     

  3. In the Name field, enter a name.

  4. Click OK

  5. On the Edit Integration System Security Group (Constrained) page, in the Integration System Users field, enter the ISU you created in Step 1

  6. Now under Organizations, you will need to select the appropriate way you'd like to limit access from your Workday instance. You have several options in regards to how you'd like to limit the data accessible to the ISU:
    ​
    We recommend selecting a specific organizational structure within your larger Company to segment by
    ​


    After clicking on "All Organizations by Type", you can further narrow down by selecting which Type you'd like to segment by.
    The recommended types are:

    • Company

    • Cost Center

    • Division

    • Region


    From there, you can select the specific Instances within your Workday Organization that you'd like to be synced over from this security Group (specific Regions, divisions, etc.)
    ​

  7. After you have configured the Organization Structures you'd like to be accessible from the ISU, please navigate to "Access Rights to Organization". Depending on how you'd like to configure access, it can either be to the specific criteria you've applied on the Organizations section or the criteria you applied as well as all organizations that fall under. If you have only selected a top level organization, you should click "Applies to Current Organization And All Subordinates"
    ​

     

  8. Once this is all completed, click OK to save the Constrained Security Group

  9. Now continue to Step 3

Related articles