# Workday connector integration

Integrate Workday as a connector in Axiad Mesh to bring in the user data needed
to fill out your environment and let Axiad find correlations, risks, and gaps in
your population.

To set up Workday as a connector, first configure Workday for API access, then
add it as a connector in the Mesh administrative portal.

## Workday configuration steps

> **warning**

These steps reflect Axiad's current understanding of the configuration. Because
Workday is a third-party product, there may be slight variations between your
experience and what this guide describes. We work hard to keep things as up to
date as possible, but depending on the versions in use and the latest updates,
there may be some mismatches.

If you find any significant differences or anything that doesn't make sense,
let us know through Axiad support.

To configure Workday for API access, complete the following steps. You can then
add Workday as a connector in Axiad Mesh.

### Create an Integration Systems User and security group

1. In Workday, create an **Integration Systems User (ISU)** and set up its
   credentials.
2. Create an **Integration Systems Security Group (Unconstrained)**.
3. Bind the newly created ISU to the new security group.

   ![Workday Integration Systems Security Group configuration](/img/imported/workday-connector-integration/workday-security-group.png)

4. Add **Domain Security Policies** to the **Integration Systems Security
   Group** as follows:
   - Under **Domain Security Policies permitting View access**, add
     **View: Supervisory Organization**.
   - Under **Domain Security Policies permitting Get access**, add:
     - **Manage: Location**
     - **Manage: Organization Integration**
     - **Worker Data: Current Staffing Information**
     - **Worker Data: Public Worker Reports**

   ![Workday domain security policy permissions for the security group](/img/imported/workday-connector-integration/workday-domain-permissions.png)

### Create an API client

1. In Workday, locate the **Register API Client for Integration** task.

   :::warning Important

   Be sure to select **Register API Client for Integration** rather than just
   **Register API Client**. Axiad Mesh requires the former because it uses the
   OAuth 2.0 Client Credentials grant flow.

   :::

2. Set the **Client Name** to a friendly name that's meaningful to the
   integration.
3. Set the **Client Grant Type** to **Authorization Code Grant**.
4. Check the **Support Proof Key for Code Exchange (PKCE)** option.
5. Set the **Access Token Type** to **Bearer**.
6. Set the **Redirect URI** to a syntactically valid URL. The integration
   doesn't use this value, but the client configuration requires one.
7. Set the **Refresh Token Timeout** to your preferred number of days.
8. Check the **Grant Administrative Consent** option.

   ![Workday Register API Client for Integration form](/img/imported/workday-connector-integration/workday-api-client.png)

9. Select the scopes that this API client can access. The required scopes are:
   - **Organization and Roles**
   - **System**
10. Check the **Include Workday Owned Scope** option.
11. Complete the creation, then copy the **Client ID** and **Client Secret**
    values. You need them for the Axiad Mesh configuration steps.

### Generate a refresh token for the API client

1. In Workday, locate the **View API Clients** report.
2. In the **API Clients for Integrations** tab, locate your newly created API
   client.
3. Click the three-dot menu button next to the client's name, hover over
   **API Client**, and then click **Manage Refresh Tokens for Integrations**.
4. In the **Workday Account** field, add the **ISU** account that you created
   in [Create an Integration Systems User and security group](#create-an-integration-systems-user-and-security-group).

   ![Workday Manage Refresh Tokens for Integrations dialog](/img/imported/workday-connector-integration/workday-refresh-token.png)

5. Click **OK** to generate the refresh token.
6. Copy the refresh token to use in the Axiad Mesh configuration steps.

## Axiad Mesh configuration steps

You can add Workday as a connector easily from the Mesh administrative portal.

1. From the homepage, click the gear icon menu button to open the **Settings**
   page.

   ![Mesh homepage with the Settings gear icon](/img/imported/workday-connector-integration/mesh-settings-gear.png)

2. On the **Connectors** page, click the **Add connector** button — either in
   the middle of the page if this is your first connector, or in the top-right
   side of the screen.

   ![Mesh Connectors page with the Add connector button](/img/imported/workday-connector-integration/mesh-add-connector.png)

3. In the pop-up window, set the **Name** to a friendly name that appears on
   the **Connectors** page.
4. Select **Workday** from the **Provider** dropdown.
5. Set the **Workday tenant** to the Workday **Organization ID**.

   :::tip Retrieve your Workday Organization ID

   You can find the Organization ID in the URL of your Workday console, or by
   clicking the user icon in the top right, selecting **My Account**, and then
   selecting **Organization ID**. Copy that value and paste it into the
   **Workday tenant** field.

   :::

6. Set the **Workday API `client_id`** and **Workday API `client_secret`**
   fields to the values that you copied in the final step of
   [Create an API client](#create-an-api-client).
7. Set the **Workday API `refresh_token`** to the value that you copied at the
   end of
   [Generate a refresh token for the API client](#generate-a-refresh-token-for-the-api-client).

   ![Mesh Add connector dialog with the Workday configuration fields](/img/imported/workday-connector-integration/mesh-workday-connector-config.png)

8. After you provide all the values, click the **Test connection** button.
9. Following a successful test, click **Add & connect** to complete the
   configuration.

Your Workday connector now appears on the **Connectors** page.