Workday Connector Documentation

Overview

The Workday connector enables seamless integration between Leena AI and Workday's cloud-based Human Capital Management suite. This connector allows you to automate HR workflows, manage employee data, process time-off requests, and handle business process approvals directly from your Leena AI workspace using Workday REST APIs.

Integration Details

Leena AI integrates with Workday using Workday Community REST APIs.

Supported Workday REST Version: v1

Prerequisites

Before setting up the Workday connector, ensure you have:

• Administrator access to your Workday organization
• Access to Workday with sufficient permissions to create Integration System Users
• Ability to register API clients and generate tokens in Workday
• Access to your Leena AI workspace with connector management permissions

Setup Instructions

Before You Begin

Before integrating with Workday, we strongly recommend using an Integration System User (ISU). Using an ISU ensures that all integration operations are logged under a designated user, separate from regular workflow processes.

Note: If your integration involves custom objects in Workday, you must register a Workday API client as the Workday REST API requires authentication through an OAuth client setup.

Step 1: Create Integration System User (ISU)

Your Integration System User must be assigned the required permissions to create a successful integration. You may receive a 403 error during integration if your ISU has insufficient permissions.

1. Type Create Integration System User into Workday's search bar and select the task
2. Enter a username and set a password in the Create Integration System User task
3. Set Session Timeout Minutes to 0 to prevent the ISU from timing out
4. Select the Do Not Allow UI Sessions checkbox to enhance security by restricting UI logins
5. Navigate to the Maintain Password Rules task
6. Exempt the integration system user from password expiration by adding them to the System Users exempt from password expiration field

Step 2: Create Integration Security Group

To set up a security group for your integration, complete the following steps:

1. Search for Create Security Group in Workday and select the corresponding task
2. Locate the Type of Tenanted Security Group field and select your security group type:
   • Integration System Security Group (Unconstrained): Allows group members to access all data instances secured by the group
   • Integration System Security Group (Constrained): Grants access to a subset of data instances based on context

Note: Contact your Workday integration partner before selecting an option to ensure the appropriate security group type is used.

3. Name your security group
4. Assign the Integration System User (ISU) you created in Step 1 as a member
5. For constrained groups, specify the organization scope

Step 3: Grant Domain Access to Security Group

1. Search for Maintain Permissions for Security Group in Workday and select the task
2. Choose the security group you created from the Source Security Group list
3. Go to the Domain Security Policy Permissions tab
4. Assign necessary permissions for each domain (e.g., GET and PUT operations)
5. Ensure the security group has GET permissions for the following domain security policies:
   • Integration Build
   • Integration Process
   • Integration Debug
   • Integration Event

Step 4: Activate Security Policy Changes

1. Type Activate Pending Security Policy Changes into Workday's search box and select the task
2. Enter a reason for your audit in the comment field, then click OK
3. On the next screen, select the Confirm checkbox, then click OK

Step 5: Register API Client for Integrations (Required for Custom Objects)

This step is only required if you plan to work with custom objects in Workday.

Prerequisites:

• Admin access to your company's Workday account
• Integration System User (ISU) authenticated with GET and View access enabled

Steps:

1. Search for Register API Client for Integrations in Workday's search field
2. Select the task to access the registration page
3. Enter a name for your API client in the Client Name field
4. Select the Non-Expiring Refresh Tokens option
5. Specify the scope of access for the API client. Ensure to include the Integration scope, which covers:
   • Integration Build
   • Integration Debug
   • Integration Process
   • Integration Event
6. Click OK to generate the Client ID and Client Secret
7. Save the Client Secret and Client ID securely
8. Click Done

Step 6: Generate Non-Expiring Refresh Token

1. Type View API Clients in the search field in Workday
2. Open the View API Clients report from the search results
3. Navigate to the API Clients for Integrations tab
4. Select the API client you registered in Step 5
5. Click the ellipsis (...) next to the client name and choose API Client > Manage Refresh Tokens for Integrations
6. Input the Workday account of a user authorized to access the custom report in the Workday Account field
7. Click OK
8. Navigate to the Delete or Regenerate Refresh Token page and select Generate New Refresh Token
9. Click OK
10. Copy the refresh token from the Successfully Regenerated Refresh Token page
11. Click Done to complete the process

Step 7: Find Your Token Endpoint URL

1. Enter View API Clients into the search field in Workday
2. Access the View API Clients report from the search results
3. Save the URL listed in the Token Endpoint field

Step 8: Find Your WSDL/Base URL

1. In the search bar, search for and click Public Web Services
2. At the top of the page, click the more options menu beside Public Web Services
3. In the drop-down menu, hover over Web Service, then click View WSDL
4. Copy the WSDL URL

Step 9: Identify Your Tenant ID

Your tenant ID can be fetched from your Workday login URL.

Example: If your URL is https://impl.wd12.myworkday.com/leenaai_dpt1/d/home.htmld, the tenant ID is leenaai_dpt1 (the ID after the base URL).

Step 10: Configure Workday Connector in Leena AI

1. Log in to your Leena AI workspace

   
   

2. Navigate to Settings > Integrations

3. Search for "Workday" and select it from the list

4. Choose one of the two authentication types:

   
   

Option A: Workday OAuth 2.0 (Recommended)

Option B: Basic Authentication

Note: The admin user must have access to the domain to which the REST API/action is associated.

Supported Actions

Time-Off Management

Get Time-Off Balances

Retrieve time-off balances for all assigned time-off/leave types for a worker.

Input Fields:

---

Get Eligible Absence Types

Fetch applicable/eligible absence types for a specific worker.

Input Fields:

---

Get Time-Off Details

Retrieve applied time-off details for a worker. Can be used to view or cancel applied time-offs.

Input Fields:

---

Request Time-Off

Raise time-off requests for a specific worker.

Input Fields:

---

Get Holidays

Retrieve assigned/eligible holidays for a worker.

Input Fields:

---

Worker Information Management

Get Workers

Retrieve a list of all workers in your Workday organization.

---

Get Additional Names

Retrieve additional names specific to a worker.

Input Fields:

Note: Most transactions associate a user via Worker ID, but Person ID can be used for fetching and updating profiles.

---

Get Home Addresses

Retrieve all home addresses for a worker.

Input Fields:

---

Get Work Addresses

Retrieve work addresses for a worker.

Input Fields:

---

Get Home Emails

Retrieve all home emails for a worker.

Input Fields:

---

Get Work Emails

Retrieve work emails for a worker.

Input Fields:

---

Get Home Phones

Retrieve all home phone numbers for a worker.

Input Fields:

---

Get Work Phones

Retrieve work phone numbers for a worker.

Input Fields:

---

Get Personal Information

Retrieve personal information for a worker, including:

• Marital Status (date, status, location)

• Gender

• Date of Birth

• Ethnicities for Visual Display

  
  

Input Fields:

---

Get Payslips

Retrieve all payslips for a worker.

Input Fields:

---

Update Worker Information

Update Home Addresses

Update or upsert home addresses for a worker.

Input Fields:

---

Update Home Emails

Update or upsert home emails for a worker.

Input Fields:

---

Update Work Emails

Update or upsert work emails for a worker.

Input Fields:

---

Update Home Phones

Update or upsert home phone numbers for a worker.

Input Fields:

---

Update Work Phones

Update or upsert work phone numbers for a worker.

Input Fields:

---

Update Work Addresses

Update or upsert work addresses for a worker.

Input Fields:

---

Business Process Management

Retrieve Business Process Events

Fetch all initiations/events for a specific business process. For example, 'Request time-off' is a business process with events such as 'Request time-off: Alex Garcia', 'Request time-off: Leah Wang', etc.

Input Fields:

---

Retrieve Business Process Steps

Fetch steps for a specific business process event. Can be used to get the status of tasks/steps for a business process event (such as approval of a time-off request) for a worker.

Input Fields:

---

Send Back a Step

Act upon a step in a business process event and send the process back to another step as per its definition.

Input Fields:

---

Cancel a Business Process Event

Cancel a business process event. This action can be used when requests such as time-off requests need to be cancelled on behalf of the requester.

Input Fields:

---

Use Cases

Time-Off Request Automation

Scenario: Employee requests to apply for time-off via virtual assistant

Workflow:

1. Employee initiates time-off request through Leena AI Virtual Assistant
2. Orchestrator retrieves eligible absence types and balances
3. Employee selects time-off type and dates
4. System submits time-off request to Workday
5. Employee can track approval status through business process events

Actions Used:

• Get Eligible Absence Types
• Get Time-Off Balances
• Request Time-Off
• Retrieve Business Process Events
• Retrieve Business Process Steps

---

Employee Self-Service Profile Management

Scenario: Employee needs to view and update personal details

Workflow:

1. Employee requests to view profile details via virtual assistant
2. System retrieves current home emails, addresses, and phone numbers
3. Employee reviews information and requests updates
4. Virtual assistant assists in updating details directly in Workday

Actions Used:

• Get Home Addresses
• Get Home Emails
• Get Home Phones
• Update Home Emails
• Update Home Phones
• Update Home Addresses

---

Payroll Issue Resolution

Scenario: Employee raises a payout-related issue

Workflow:

1. Employee reports payroll discrepancy to virtual assistant
2. Orchestrator fetches employee's payslips
3. System presents payslip information for review
4. Employee and HR can address the issue with complete payment history

Actions Used:

• Get Payslips
• Get Personal Information

---

Holiday Planning and Verification

Scenario: Employee planning time-off around holidays

Workflow:

1. Employee requests to view upcoming holidays
2. System retrieves applicable holiday events
3. Employee requests time-off avoiding holiday conflicts
4. System validates dates against holiday calendar before submitting

Actions Used:

• Get Holidays
• Get Time-Off Balances
• Request Time-Off

---

Business Process Approval Management

Scenario: Manager needs to approve time-off requests

Workflow:

1. Manager receives notification of pending approvals
2. System retrieves business process events requiring action
3. Manager reviews event details and steps
4. Manager approves or denies event steps directly through virtual assistant

Actions Used:

• Retrieve Business Process Events
• Retrieve Business Process Steps
• Get Event Details
• Approve Event Step
• Deny Event Step

---

Troubleshooting

Common Issues

403 Forbidden Error

• Verify your Integration System User has sufficient permissions
• Check that domain security policies are properly assigned
• Ensure security policy changes have been activated
• Confirm the ISU is a member of the integration security group

Authentication Failed

• For OAuth: Verify Client ID, Client Secret, and Refresh Token are correct
• For Basic Auth: Confirm username and password have proper domain access
• Check that your WSDL/Base URL is correct and starts with 'https://'
• Verify Tenant ID matches your Workday login URL

Invalid Token Error

• Ensure refresh token hasn't expired (should be non-expiring)
• Regenerate refresh token following Step 6 if necessary
• Verify token endpoint URL is correct

Worker/Record Not Found

• Confirm Worker ID or Person ID format is correct
• Check that you're using the appropriate ID type for the action
• Verify the user exists in Workday

Missing Data in Response

• Check pagination parameters (Limit and Offset)
• Verify filter criteria aren't too restrictive
• Ensure date ranges are appropriate for the query

Permission Denied on Specific Actions

• Review domain security policies assigned to your integration security group
• Confirm GET and PUT permissions are enabled as needed
• Check that ISU has access to required domains

Security Best Practices

• Use Integration System Users (ISU): Always use an ISU for integration operations to maintain clear audit trails
• Disable UI Sessions: Keep "Do Not Allow UI Sessions" enabled for ISUs to prevent unauthorized access
• Session Timeout: Set session timeout to 0 for ISUs to prevent unexpected disconnections
• Non-Expiring Tokens: Use non-expiring refresh tokens and store them securely
• Least Privilege Principle: Grant only the minimum required permissions to your integration security group
• Regular Audits: Monitor integration activity through Workday's audit logs
• Secure Credentials: Never share API credentials, Client Secrets, or Refresh Tokens
• Password Exemption: Exempt ISU from password expiration policies
• Constrained Security Groups: Use constrained security groups when access should be limited to specific organizational scopes
• Token Rotation: While using non-expiring tokens, establish a policy for periodic token regeneration
• API Scope Management: Only include necessary scopes when registering API clients

Support

For additional assistance with the Workday connector:

• Contact your Leena AI support team
• Consult your Workday integration partner for security group configuration
• Refer to Workday Community documentation for REST API details
• Check Leena AI knowledge base for connector updates and troubleshooting guides

---

Last Updated: November 2025