Skip to main content

Workday Employee Sync with timeOff Data

Updated over 4 months ago

Endpoints we access

/service/{tenant_name}/Human_Resources
/api/absenceManagement/v1/{tenant_name}/workers/{employee_id}/timeOffDetails
/api/absenceManagement/v1/{tenant_name}/workers

Prerequisites

Please ensure you fulfill all the requirements to set up the integration:

  • You have Administrator permissions in your company's Workday instance

Step 0: Find the Workday Integration in Adaptive

Navigate to Employees > Sources to view our integrations. For Workday to be your source of truth for provisioning and de-provisioning records, find it in the drop down of the Primary Identity Source section

Once you click Install > Connect, select the below option to continue configuration.

From there you will be taken through the setup flow. The following steps will guide you through the steps you need to take it Workday to then enter information in our setup flow.

Step 1: Create an Integration System User (ISU)

  1. In your Workday portal, log into the Workday tenant

  2. In the Search field, type Create Integration System User

  3. Select the Create Integration System User task
    ​

  4. On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password
    ​
    ​Important: "&", "<", or ">" characters cannot be included in the password
    ​

  5. Click OK
    ​

  6. To ensure the password doesn't expire, you'll want to add this new user to the list of System Users. To do this, search for the Maintain Password Rules task.
    ​


    Add the ISU to the System Users exempt from password expiration field
    ​

  7. Enter the Integration System User name in the linking flow

  8. Enter the Integration System User password in the linking flow
    ​

Step 2: Create a Security Group and assign an Integration System User

  1. In the Search field, type Create Security Group
    ​


    Select the Create Security Group task.
    ​

  2. On the Create Security Group page, select Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group pull-down menu.
    ​

  3. In the Name field, enter a name

  4. Click OK

  5. On the Edit Integration System Security Group (Unconstrained) page, in the Integration System Users field, enter the same name you entered when creating the ISU in the first section
    ​

  6. Click OK

Step 3: Configure domain security policy permissions

  1. In the Search field, type Maintain Permissions for Security Group
    ​

  2. Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2
    ​

  3. On the next screen, add the corresponding Domain Security Policies depending on your use case:
    ​

Step 4: Configure domain security policies based on your use case

All of the data requests we make to Workday are in the form of SOAP requests, EXCEPT for Time Off data. Workday only supports the full breadth of Time Off data through their REST API, which requires a different set of credentials and domain permissions you can find in the section below.

If you are not interested in time off data

Overview

You will need to configure different permission domains in your Workday ISU for HRIS versus ATS data. This guide will walk you through the permissions you need for HRIS data.

Permissions

Please note that the permissions listed below are the required permissions for the full HRIS integration. Required permissions can differ based on the use case.

Operation

Domain Security Policy

Get Only

Worker Data: Public Worker Reports
This is the minimum required permission

Get Only

Person Data: Name

Get Only

Person Data: Personal Data

Get Only

Person Data: Home Contact Information

Get Only

Person Data: Work Contact Information

Get Only

Worker Data: Compensation

Get Only

Worker Data: Workers

Get Only

Worker Data: All Positions

Get Only

Worker Data: Current Staffing Information

This is required to surface Employment Status of Employees

Get Only

Worker Data: Employment Data

Get Only

Worker Data: Compensation - All Worker’s Positions Past and Present

This is required to pull Historical Employments

Get Only

Worker Data: Organization Information

Get Only

Reports: Pay Calculation Results for Worker (Results)

Get Only

Worker Data: Payroll

Get Only

Process: Export Time Blocks

This is required to retrieve Timesheet Entries

Get Only

Worker Data: Time Off*
*Specific instructions to allow access to Time Off data can be found here.

How to Get Timeoff Data from Workday:

Overview

To access Time Off data, you will need both GET and View Access to the Time Off domains.

Here are the minimum set of domains you will need enabled:

Operation

Domain Security Policy

Get Only

Worker Data: Current Staffing Information

Get Only

Worker Data: Public Worker Reports

View Only

Worker Data: Public Worker Reports

Get Only

Worker Data: Time Off

View Only

Worker Data: Time Off

Get Only

Worker Data: Time Off (Time Off)

View Only

Worker Data: Time Off (Time Off)

Get Only

Worker Data: Time Off (Time Off Balances Manager View)

View Only

Worker Data: Time Off (Time Off Balances Manager View)

Get Only

Worker Data: Time Off (Time Off Balances)

View Only

Worker Data: Time Off (Time Off Balances)

Get Only

Worker Data: Time Off (Time Off Manager View)

View Only

Worker Data: Time Off (Time Off Manager View)

Once you have finished the main guide, the steps below will guide you in creating an API Client that we can use to access the Time Off data.

Step 5: Create a new API Client for Integrations

  1. In the Search field, type Register api client for integrations.

  2. Select the Register API Client for integrations task.

  3. On the Register API client for Integrations page, in the Client Name field, any name for your API client.

  4. Select the Non-Expiring Refresh Tokens option.

  5. In the Scope (Functional Areas) field, select:

    1. Tenant Non-Configurable

    2. Staffing

    3. Time Off and Leave

  6. Click OK.

    The client ID and client secret are displayed.

  7. Save the Client Secret and Client ID.

  8. Click Done

  9. Enter the Client Secret and Client ID to the linking flow

Step 6: Generate a non-expiring Refresh Token

  1. In the Search field, type View API client.

  2. Select the View API Clients task.

  3. On the View API Clients page, click the API Clients for Integrations tab.

  4. Click the client you created in Create a new API Client for Integrations.

  5. Click API Client > Manage Refresh Tokens for Integrations.

  6. On the Manage Refresh Tokens for Integrations page, in the Workday Account field, enter the Workday account of a user who has access to the custom report.

    Set up the user as a service account instead of an actual Workday user to prevent permissions being removed from the account due to a job change.

  7. Click OK.

  8. Return to the Workday home page.

  9. In the Search field, type Register api client for integration.

  10. On the Delete or Regenerate Refresh Token page, select the Generate New Refresh Token option.

  11. Click OK.

  12. On the Successfully Regenerated Refresh Token Page, copy the refresh token.

  13. Click Done.

  14. Add the Refresh Token to the linking flow.

Step 7: Find your Token Endpoint URL

  1. Log in to the Workday tenant.

  2. In the Search field, type View API Client.

  3. Select the View API Clients task.

  4. On the View API Clients page, save the URL in the Token Endpoint field.

  5. Add the Workday OAuth Token URL to the linking flow

FAQ

If you are running into issues, see our article around Common Workday Problems.

Did this answer your question?