How to connect to Workday

To create a connection with Workday, you have to complete 2 steps.

  1. Create Integration System User
  2. Vault Connection Setup

1. Create Integration System User (ISU)

The first step is to set up an Integration System User (ISU) in Workday. This way, your Apideck usage will be logged as one user. This also allows you to limit permissions to Apideck. Select only the required permissions for your integration use case.

If you encounter 403 errors when using Unify, ensure your ISU has enough permissions.

Create a Security Group

Navigate to the Create Security Group task in Workday and create an Integration System Security Group.

Grant permissions to the Security Group

The next step is to grant permissions to your newly created security group.

For each domain you want to grant access to:

  1. Navigate to the View Domain report and find the domains listed below
  2. Click Domain > Edit Security Policy Permissions
  3. Add the security group you just created, and grant permissions for GET, POST and PUT.

Workday Domain Security Policy Permissions

Please note that the permissions listed below are suggested to access the full HRIS or ATS Workday data. If you only want to use a subset of the data, you can limit the permissions to the required domains.

Required domains for the Workday HRIS integration:

  • Person Data: Personal Data
  • Person Data: Home Contact Information
  • Person Data: Work Contact Information
  • Worker Data: Compensation
  • Worker Data: Workers
  • Worker Data: All Positions
  • Worker Data: Current Staffing Information
  • Worker Data: Public Worker Reports
  • Worker Data: Employment Data
  • Worker Data: Organization Information
  • Worker Data: Time Off

Required domains for the Workday ATS integration:

  • Job Requisition Data
  • Candidate Data: Job Application
  • Candidate Data: Personal Information
  • Candidate Data: Other Information
  • Pre-Hire Process Data: Name and Contact Information
  • Person Data: Personal Data
  • Person Data: Home Contact Information
  • Person Data: Work Contact Information
  • Manage: Location
  • Worker Data: Public Worker Reports

Also, grant access to the following security policies:

  • Integration Build
  • Integration Process
  • Integration Debug
  • Integration Event

Lastly, activate these permissions by navigating to the Activate Pending Security Policy Changes task.

Create Integration System User (ISU)

Navigate to the Create Integration System User task and configure a Workday user for Apideck.

Workday Create ISU Form

Set the Session Timeout Minutes to 0 to prevent session expiration.

Navigate to the Maintain Password Rules task and add the ISU to the System Users exempt from a password expiration.

Optionally, enable the Do Not Allow UI Sessions checkbox to block the ISU from logging in through the Workday UI.

After creating the ISU, select Security Profile > Assign Integration System Security Groups. Select the security group you created previously.

Navigate to the View Integration System report and access the Connector or Studio integration. Click Workday Account > Edit and select the ISU.

2. Vault Connection Setup

Now that you've created an ISU, you're ready to fill out your credentials in Vault.

Workday Vault Form

Username (required)The username of your Workday Integration Services User (ISU) created in step 1
Password (required)The password of your Workday Integration Services User (ISU) created in step 1
Tenant ID (required)The Tenant ID is found in the URL when you are logged into Workday. For example, if the URL of your Workday UI is, your tenant ID is sample_company
WSDL URL (required)The Workday WSDL URL is used as the base URL for every API request. Find your WSDL URL here: If you are unsure, use

Click Save after completing the form. Your Workday account is now connected.