Skip to main content
Workday Configuration Workday Configuration Requirements Workday Security: Tenant Security Policies. 9 Workday APIs. 9

​
Workday Configuration

Workday Configuration Requirements (tenant) OLOID requires an API client and integration user to be created in the Workday tenant to allow OLOID’s Workday Connector to read/write data from/to Workday. This API user must have the appropriate field-level access to the Workday fields which OLOID Workflow will be reading from and writing to. Workday Security: Tenant Security Policies 1. Setup: Integration User Group(s) for Securable items in Workday
  1. Create Integration System User.
  2. Log in to Workday with an administrator account.
  3. Run C****reate Integration System User task.
  4. Enter the integration system user details, and save the configuration.
  5. Select Do not Allow UI Sessions option.
  6. Create a security group.
  7. NOTE - You will add the integration system user to this security group. Also, in a later step, you will add the domains that you want to sync with OLOID.
  8. the C****reate Security Group task.
  9. In the Type of Tenanted Security Group field, select Integration System Security Group (Unconstrained).
  10. Add the Integration System User you created above to the group and save the configuration.
NOTE - Users are normally named like ISU_Oloid_TimeEntry and Security groups like ISSG_Oloid_TimeEntry 2. Setup: API Client for user account
  1. Find endpoints.
  2. Navigate to the View API Clients page by typing it into the search bar.
  3. Here, you will see the endpoints required for the connection. Take note of REST API endpoint, Token endpoint and Authorization endpoint.
  4. Register API Client
  5. Run Register API Client task in your Workday instance.
  6. Enter a meaningful name to indicate that this API client is used for OLOID Workflow (for example – oloid-workflow-integration-api-client).
  7. Select Authorization Code Grant for Client Grant Type
  8. Select Bearer for Access Token Type
  9. Select all the OAuth2 scopes and Functional Area scope that you need for the flows you intend to create.
  10. Remember to save the Client ID and Client Secret before clicking Done. This will be required to create a Workday REST connection.
  11. Navigate to Action > API Client > Manage Refresh Tokens for Integrations.
  12. Select the Integration user to perform all recipe actions.
  13. If there are no existing refresh tokens, select Generate new refresh token and copy the new Refresh token. This will be required to create a Workday REST connection.
  14. Setup: Integration System Users for Inbound and Outbound and Integration User Group(s) for Securable items in Workday
  15. Add the domains that you want to sync with OLOID to the security group. All domains are listed in a Configurable Security Matrix. You need to add all domains directly –
i. Search for Maintain Permission for Security Group and select it. ii. Search for correct Source Security Group. iii. Edit View/Modify access wherever applicable.
  1. Activate your security policy changes.
i. Search for security changes and open A****ctivate Pending Security Policy Changes. ii. Enter a comment, click OK, and confirm the changes. Workday APIs OLOID requires following rest apis to fetch employee data and to perform time punches.
  1. API Token
a. GET https://wd2-impl-services1.workday.com/ccx/oauth2/<tenant>/token
  1. Basic Worker Data (filter via employee ID)
a. Retrieves a collection of workers and current staffing information. b. Secured by: Self-Service: Current Staffing Information, Worker Data: Public Worker Reports c. Scope: Staffing d. Sample API: GET https://wd2-impl-services1.workday.com/ccx/api/timeTracking/v3/<tenant>/workers?search=<employee-id>
  1. Advanced Worker Data APIs (WQL query can be created from Advanced report from WORKDAY)
a. Oloid fetches advanced worker attributes (eg. timeEntryCode, Location, CostCenter etc.) using WQL. WQL are typically derived from Workday advanced reports. b. This API returns the data from a WQL query. You can only view data you have security access to. c. Secured by: Development, Set Up: Plan Publishing, WQL for Workday Extend, Workday Query Language+TG d. Scope: Adaptive Planning for Financial Plans, Adaptive Planning for the Workforce, System e. Sample API: GET https://wd2-impl-services1.workday.com/ccx/api/wql/v1/&lt;tenant>/data?query=*SELECT worker, employeeID as employeeID, cf_OloidPIN as OloidPIN, legalName_FirstName as firstName, lastName as lastName, cf_CF_EEB_WorkerStatus as status, cf_CF_LRV_Location_ID as location, location_Name as locationName, primaryWorkPhone as phoneNumber, email_PrimaryWork as email, employeeType as employeeType, payRateType as payRateType, position as position, managerID as managerID, managerPreferredNameInReportingDisplayFormat as managerName, cf_CFLRVSupervisoryOrganizationRefID as supervisoryOrganizationId, supervisoryOrganization as supervisoryOrganization, primaryHomeAddress_State as homeState, workAddress_StateProvince as workState, terminationDate1 as terminationDate, timeZoneOfLocationOfWorkersPrimaryPosition as timeZone, isManager FROM allActiveAndTerminatedWorkers WHERE terminationDate1 >= ‘2025-06-03’)* 4) Time Punch APIs a. Add Punch i. Adds a time clock event for the specified worker. ii. Secured by: Process: Time Clock Event REST API’s iii. Scope: Time Tracking iv. Sample API: POST https://wd2-impl-services1.workday.com/ccx/api/timeTracking/v3/&lt;tenant>/timeClockEvents b. Get Punch i. Get time clock events for the specified worker. ii. Secured by: Process: Time Clock Event REST API’s iii. Scope: Time Tracking iv. Sample API: GET https://wd2-impl-services1.workday.com/ccx/api/timeTracking/v3/&lt;tenant>/timeClockEvents?fromDate=2025-04-09&toDate=2025-04-11&worker=&lt;worker-id> c. Review Punch i. Submit time clock events (current workweek) for the specified worker for review. ii. Secured by: Manager: Time Tracking Manager Approval, Manager: Time Tracking Manager Edit and Approve, Submit Time (REST Service) iii. Scope: Time Tracking Sample API: POSThttps://wd2-impl-services1.workday.com/ccx/api/timeTracking/v3/<tenant>/workers/<worker-id>/timeReviewEvents