Workday connector integration

Integrate Workday as a connector in Axiad Mesh to bring in the user data needed to fill out your environment and let Axiad find correlations, risks, and gaps in your population.

To set up Workday as a connector, first configure Workday for API access, then add it as a connector in the Mesh administrative portal.

Workday configuration steps

Important

These steps reflect Axiad's current understanding of the configuration. Because Workday is a third-party product, there may be slight variations between your experience and what this guide describes. We work hard to keep things as up to date as possible, but depending on the versions in use and the latest updates, there may be some mismatches.

If you find any significant differences or anything that doesn't make sense, let us know through Axiad support.

To configure Workday for API access, complete the following steps. You can then add Workday as a connector in Axiad Mesh.

Create an Integration Systems User and security group

1. In Workday, create an Integration Systems User (ISU) and set up its credentials.

2. Create an Integration Systems Security Group (Unconstrained).

3. Bind the newly created ISU to the new security group.

   

4. Add Domain Security Policies to the Integration Systems Security Group as follows:

   • Under Domain Security Policies permitting View access, add View: Supervisory Organization.
   • Under Domain Security Policies permitting Get access, add:
     • Manage: Location
     • Manage: Organization Integration
     • Worker Data: Current Staffing Information
     • Worker Data: Public Worker Reports

   

Create an API client

1. In Workday, locate the Register API Client for Integration task.

   Important

   Be sure to select Register API Client for Integration rather than just Register API Client. Axiad Mesh requires the former because it uses the OAuth 2.0 Client Credentials grant flow.

2. Set the Client Name to a friendly name that's meaningful to the integration.

3. Set the Client Grant Type to Authorization Code Grant.

4. Check the Support Proof Key for Code Exchange (PKCE) option.

5. Set the Access Token Type to Bearer.

6. Set the Redirect URI to a syntactically valid URL. The integration doesn't use this value, but the client configuration requires one.

7. Set the Refresh Token Timeout to your preferred number of days.

8. Check the Grant Administrative Consent option.

   

9. Select the scopes that this API client can access. The required scopes are:

   • Organization and Roles
   • System

10. Check the Include Workday Owned Scope option.

11. Complete the creation, then copy the Client ID and Client Secret values. You need them for the Axiad Mesh configuration steps.

Generate a refresh token for the API client

1. In Workday, locate the View API Clients report.

2. In the API Clients for Integrations tab, locate your newly created API client.

3. Click the three-dot menu button next to the client's name, hover over API Client, and then click Manage Refresh Tokens for Integrations.

4. In the Workday Account field, add the ISU account that you created in Create an Integration Systems User and security group.

   

5. Click OK to generate the refresh token.

6. Copy the refresh token to use in the Axiad Mesh configuration steps.

Axiad Mesh configuration steps

You can add Workday as a connector easily from the Mesh administrative portal.

1. From the homepage, click the gear icon menu button to open the Settings page.

   

2. On the Connectors page, click the Add connector button — either in the middle of the page if this is your first connector, or in the top-right side of the screen.

   

3. In the pop-up window, set the Name to a friendly name that appears on the Connectors page.

4. Select Workday from the Provider dropdown.

5. Set the Workday tenant to the Workday Organization ID.

   Retrieve your Workday Organization ID

   You can find the Organization ID in the URL of your Workday console, or by clicking the user icon in the top right, selecting My Account, and then selecting Organization ID. Copy that value and paste it into the Workday tenant field.

6. Set the Workday API client_id and Workday API client_secret fields to the values that you copied in the final step of Create an API client.

7. Set the Workday API refresh_token to the value that you copied at the end of Generate a refresh token for the API client.

   

8. After you provide all the values, click the Test connection button.

9. Following a successful test, click Add & connect to complete the configuration.

Your Workday connector now appears on the Connectors page.