---
title: Workday ATS -> Ashby Recruiting API Migration Guide
slug: workday-ats-greater-ashby-recruiting-api-migration-guide
docTags: HnLaVwOXkGQqP1zfLQjeE,hPENnkxx3VjCUn4cldjD9,wmC4lKFZnq662iUhrSK0l
createdAt: 2025-09-03T10:40:07.119Z
---
Data migration from Workday uses several Workday APIs, each of which requires varying user and permission configuration.
The setup requires three steps:
1. Configuring Ashby's Integration System User (ISU)
2. Configuring domain and business process security for Ashby's ISU
3. Creating the "API Client for Integrations" for Ashby
:::hint{type="warning"}
In each step, we advise you to copy down some important information that needs to be configured within Ashby to connect your Ashby and Workday instances. The prompts to copy information appear in warning callouts like this one.
:::
:::hint{type="info"}
For information on Workday integrations, see [Workday](docId\:Lser77iHgverWT8Ovu5gx).
:::
# Configuring Ashby's ISU
1. Log in to your Workday application using an administrator account.
2. In the application's search box, search for "create user" and select **Create Integration System User**.
::Image[]{src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcYa7Avc718NkWih6VkQZE6rXMI-zfedLHSUz1XcUDF5pBXQuPkuZQfMFiehJJd_c-7tb-gL8L37WMkcMX_54QV-ZKbWe12UA1qipVsl-u8Aba3lYfTV7KYFK5t4COjA0AsWF2-4A?key=NUnBBF0wtOair6h4at6P4g" size="70" alt="Screenshot of the Create Integration System User screen in Workday" isUploading="false" width="331" height="116" darkWidth="331" darkHeight="116" showCaption="false"}
3. Enter a username and password.
:::hint{type="warning"}
Copy down the **username** and **password** for future configuration within Ashby.
:::
4. Leave the **Require New Password at Next Sign In** checkbox unchecked. This user accesses Workday programmatically and does not need to set a new password.
5. Leave **Session Timeout Minutes** at its default value of 0. This prevents the user's sessions from timing out prematurely.
6. Select **Do Not Allow UI Sessions**. This prevents the account from logging into Workday.
::Image[]{src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeQIbIesSasrQzKH0x6NtR_0dgv_XTJyrBqWkyvb4HD4yBCaXsJ09uQRtDDIyk3AVPj1pfj9qok8bWs1PzmtnVoGnkCZsfse8GVfZN8pP_Y0uiZSoHcHAHN6WUWbeCVmfAOmXLPFw?key=NUnBBF0wtOair6h4at6P4g" size="90" alt="Screenshot of the ISU session settings screen in Workday, showing the Session Timeout Minutes and Do Not Allow UI Sessions options" isUploading="false" width="777" height="842" darkWidth="777" darkHeight="842" showCaption="false"}
:::hint{type="warning"}
If possible, make sure the password does not expire. Otherwise, Ashby's sync stops when the password expires. You can do this by going to the **Maintain Password Rules** task and adding Ashby's ISU to the **System Users exempt from password expiration** field.
:::
# Configure domain security for Ashby's ISU
## Create a security group
In this step, you create an unconstrained integration system security group in Workday and assign the ISU created in the previous step to this group.
1. In the search box, search for "security group" and select **Create Security Group**.
::Image[]{src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdJs97Huc1WP8NunuyttRt9wb7LcL1UgQuUawYHH5IsItHxw8gqzn0Jmcc-yM-eyCuy-ppuipsYcEYQ8ewEkPyrH0o3Yt3NVX_b1S73sG_qG1cagfuVm-3D28BAgDKqDPuw7A1l0Q?key=NUnBBF0wtOair6h4at6P4g" size="70" alt="Screenshot of the Create Security Group task in Workday" isUploading="false" width="283" height="119" darkWidth="283" darkHeight="119" showCaption="false"}
2. Complete the **Create Security Group** task.
3. Select **Integration System Security Group (Unconstrained)** from the **Type of Tenanted Security Group** dropdown.
::Image[]{src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc9jfx6qmeCxH2g3NsY2h_PM0BbT2JbOZdAv66mzKUvmGts4KtohjXw5y8SuQymLZiIj67l7bQ5ZsbMH1de9fpN9IqVfwKTlYcPWEaAroliP4MNuw-MghLQ9eWsyRvChs4FdR94?key=NUnBBF0wtOair6h4at6P4g" size="70" alt="Screenshot of the security group member assignment page in Workday" isUploading="false" width="444" height="174" darkWidth="444" darkHeight="174" showCaption="false"}
4. After the security group is created successfully, you see a page where you can assign members to the security group.
5. Add the new ISU created in the previous step to this security group.
## Configure domain security policy permissions
In this step, you grant domain security policy permissions that allow Ashby access to recruiting and HR data domains related to the Ashby Analytics integration.
1. Enter "Security Group Membership and Access" in the search box and click the report link.
::Image[]{src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXevV_tMSzF7X23jb15FYQEMBzUkmh7LWjG_Fzx0SchLh3e7lYf8iJh7xNgSxGTjmZ0AgytMYK8vqJE8msOXnvdbwMIe9l7G6uuzAieDzUo_0pBPbG3V_MARD6Omgs7Fn-V2VzsK?key=NUnBBF0wtOair6h4at6P4g" size="80" alt="Screenshot of the Security Group Membership and Access report in Workday, showing the ellipsis menu with the Maintain Domain Permissions option" isUploading="false" width="379" height="131" darkWidth="379" darkHeight="131" showCaption="false"}
2. Search for and select the security group created in the previous step.
3. Click the ellipsis (`...`) next to the group name and select **Security Group > Maintain Domain Permissions for Security Group**.
4. Add the following domains to the **Domain Security Policies** list.
:::hint{type="info"}
In rows where multiple domains are listed, all domains after the first may be included or inherited by the first domain, depending on your Workday instance's security configuration. Where no reason is listed in a row, the reason from the nearest row above applies.
:::
| **Domain Security Policy** | **Operation** | **Reason** |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- | --------------------------------------------------------------------------------------------------- |
| Organization: Cost Center | Get Only | Sync org relationships for jobs and job role assignees |
| Manage: Organization Integration | Get Only | |
| Manage: Organization Roles | Get Only | |
| Staffing Organizations: Cost Center | Get Only | |
| Worker Data: Organization Information
Worker Data: Management Chain
Worker Data: Organizations | Get Only | |
| Worker Data: Active and Terminated Workers | Get Only | Sync basic worker information for Ashby user account and employee data |
| Person Data: Legal Name | Get Only | |
| Person Data: Preferred Name | Get Only | |
| Person Data: Name | Get Only | |
| Person Data: Home Email | Get Only | |
| Person Data: Work Email | Get Only | |
| Person Data: Home Contact Information | Get Only | |
| Person Data: Public Work Email Address Integration | Get Only | |
| Pre-Hire Data: Name and Contact Information
Pre-Hire Data: Contact Information
Pre-Hire Data: Names | Get Only | |
| Worker Data: Public Worker Reports | Get Only | |
| Worker Data: Worker ID | Get Only | |
| Worker Data: Workers | Get Only | |
| Worker Data: All Positions | Get Only | |
| Worker Data: Current Staffing Information
Worker Data: Historical Staffing Information | Get Only | Sync worker position data |
| Worker Data: Employment Data | Get Only | |
| Job Directory | Get Only | Sync job requisition data |
| Job Information | Get Only | |
| Job Profile: View | Get Only | |
| Job Postings: External | Get Only | |
| Job Postings: Internal | Get Only | |
| Job Postings | Get Only | |
| Job Requisitions for Recruiting | Get Only | |
| Job Requisition Data | Get Only | |
| Manage: Evergreen Requisitions | Get Only | |
| All Prospects | Get Only | Sync prospect data |
| Prospects
Prospect Sharing | Get Only | |
| Reports: Prospect | Get Only | |
| Candidate Data: Job Application
Candidate Data: Assessment Results
Candidate Data: Bundle Resumes
Candidate Data: Eligibility Results
Candidate Data: Interview Feedback Comments
Candidate Data: Interview Feedback Results
Candidate Data: Language Skills
Candidate Data: Offer Details
Candidate Data: Quick Stats
Candidate Data: Sharing
Candidate Data: Attachments | Get Only | Sync candidate and application data, including resume files |
| Candidate Data: Interview Schedule | Get Only | |
| Candidate Data: Other Jobs | Get Only | |
| Candidate Data: Questionnaires | Get Only | |
| Candidate Data: Questionnaire Total Score | Get Only | |
| Questionnaire Results | Get Only | |
| Manage Pre-Hire Process: View Pre-Hire Interviews | Get Only | |
| Candidate Data: Gender | Get Only | Sync candidate EEOC data |
| Candidate Data: Ethnicity | Get Only | |
| Candidate Data: Personal Information
Candidate Data: Military Status
Candidate Data: Nationalities
Candidate Data: Sexual Orientation
Candidate Data: Sexual Orientation & Gender | Get Only | |
| Find Candidates: Internal and External | Get Only | |
| Find Candidates: External | Get Only | |
| Pre-Hire Data: Employment Agreement
Employment Agreement: Employee Contracts | Get Only | Sync candidate offer data |
| Pre-Hire Data: Start Date and Location | Get Only | |
| Purge Person Data
Purge Single Entity Data | Get Only | So we can delete candidates and applications that have been merged into others |
| Manage: Recruiting Agency | Get Only | Sync recruiting agency data |
| Integration Build | Get Only | Access to low-level identifiers to connect Workday objects together (e.g., a job to a location) |
| Business Process Administration
Business Process Definition View
Business Process Delegation | Get Only | Access to business process history (for job application process history) |
| Business Process Reporting | Get Only | |
| Manage: Business Process Definitions | Get Only | |
| Reporting Audits | Get Only | Allows running reports via REST API WQL |
| Workday Query Language | View and Modify | "View and Modify" appears to be required here, even though we can only run queries that fetch data. |
| Manage: Candidate Job Application Notes | Get Only | Sync job application notes |
## Configure business process permissions
To see certain historical information for a job application, Ashby needs elevated access on recruiting-specific business processes.
To give Ashby the right access, you need to go to each business process as follows (using "job application" as an example in step 1):
1. Go to **bp: job application**.
2. Select **Related Actions** (the `...` menu at the top) > **Business Process Policy > Edit**.
3. Scroll down to **Who Can Do Actions on Entire Business Process**.
4. Go to the **View All** section.
5. Add the integration system security group you created in the previous steps.
Ashby needs this for the following recruiting business processes (substitute each of the following in your Workday search):
- "Assess Candidate"
- "Employment Agreement"
- "Interview"
- "Job Application"
- "Offer"
- "Rate Interview"
- "Ready for Hire"
- "Reference Check"
- "Review Candidate"
- "Screen"
:::hint{type="info"}
Your Workday instance may not have a business process for each of these.
:::
# Create the "API Client for Integrations" for Ashby
To facilitate mapping the Workday recruiting process into Ashby, we need a report of candidate application history. We use this to understand stage transitions for candidates and build interview plans in Ashby.
We run this report using Workday Query Language (WQL) via Workday's REST API. Access to the REST API requires a special API client to be configured.
1. Open the **Register API Client for Integrations** task via Workday search.
2. Use the following configuration:
- **Client Name**: Ashby API Access
- **Non-Expiring Refresh Tokens**: ✅
- **Scope**: System, Recruiting, Staffing, and Pre-Hire Process (allows high-level access to recruiting and reporting data; data within is still guarded by domain security)
- **Included Workday Owned Scope**: ✅ (access to Workday-owned fields)
3. Click `Okay`.
:::hint{type="warning"}
The client ID and secret are needed to configure REST API access for Ashby.
:::
4. On the page that appears, copy down the client ID and secret.
5. Click the `...` menu next to the client name in the blue header at the top, then select **API Client > Manage Refresh Tokens for Integrations**.
6. In the **Workday Account** box in the dialog that appears, find and select Ashby's ISU, then click `Okay`.
7. On the next page, check the **Generate New Refresh Token** box, then click `Okay`.
8. Copy down the refresh token that appears on the next page.
:::hint{type="warning"}
The refresh token is needed to configure REST API access for Ashby.
:::
9. Go to the **View API Clients** report via Workday search.
10. On this page, there are three endpoints at the top. Copy these down.
:::hint{type="warning"}
These endpoints are needed to configure REST API access for Ashby.
:::
## Collect final tenant information
Most of the Workday-side configuration is now complete. We just need to collect a few final pieces of information before configuring the connection in Ashby.
### Workday tenant ID
Your Workday tenant ID is found in the URL when you're logged into Workday. For example, if the URL is [https://impl.workday.com/example/d/home.html](https://impl.workday.com/example/d/home.html), your tenant ID is "example".
:::hint{type="warning"}
Copy your tenant ID for configuration within Ashby.
:::
### WSDL URL
Your Web Services Description Language (WSDL) URL can be found by following the [Workday Public Web Services article](https://community.workday.com/articles/6120#endpoint).
In short:
1. Type "Public Web Services" in the Workday search bar.
2. Under **Reports**, select **Public Web Services**.
3. From the **Public Web Services** list, select any entry and click the ellipsis icon to reveal a dropdown menu. Select **Web Service > View WSDL**, which displays the full WSDL in a separate window.
::Image[]{src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc-up-ul-XHkHOYHjwcdDb74yMH2v-D77gCTKM41DjJ5foAmpEa9_y7b6BljGHaX05AQdd4BUqhTNI2INlJl6I16XjkoaJDpJXXl7iTrWcX2q4n3wohW_JmKVjglXaMCkQoS2gF?key=NUnBBF0wtOair6h4at6P4g" size="80" alt="Screenshot of the Public Web Services list in Workday, showing the ellipsis dropdown menu with the View WSDL option" isUploading="false" width="480" height="410" darkWidth="480" darkHeight="410" showCaption="false"}
4. The WSDL URL is the link in your browser bar.
:::hint{type="warning"}
Copy the WSDL URL for configuration within Ashby.
:::
# Configure the connection in Ashby
Now that you've collected all of the information needed, you're ready to configure the connection in Ashby.
Navigate to [https://app.ashbyhq.com/admin/integrations/workday](https://app.ashbyhq.com/admin/integrations/workday), where you see the screen below.
## Steps
:::hint{type="warning"}
Your Workday tenant ID is case-sensitive. Take care when entering it in step 2.
:::
1. In the first box, paste the WSDL URL.
2. In the **Workday ISU Username** field, enter the ISU username you created for Ashby, followed by `@` and your tenant ID (e.g., `Ashby_ISU@acme`).
3. In the **Workday ISU Password** field, paste the ISU password.
4. In the **Workday REST API Base URL** field, paste the "host" part of the endpoints you copied when configuring the REST API client. It looks something like `https://wd5-services1.myworkday.com`, which is just the part of the URLs that ends in `myworkday.com`. They should all be the same, though yours may start with `wd4-services1` for example.
5. In the **Workday REST API Client ID** field, paste the client ID you copied when configuring the REST API client.
6. In the **Workday REST API Client Secret** field, paste the client secret you copied when configuring the REST API client.
7. In the **Workday REST API Client Refresh Token** field, paste the refresh token you copied when configuring the REST API client.
:::hint{type="success"}
Once this is complete, let us know so we can monitor the initial sync and make sure all is well.
:::
# What is migrated from Workday?
## Objects migrated
- Job requisitions (non-confidential)
- Evergreen job requisitions
- Teams and departments
- Locations
- Openings
- Candidates (non-confidential)
- Job considerations and applications
- Interview feedback ratings
- Sources
- Candidate attachments, including resumes
:::hint{type="info" indent="1"}
Resume attachments will be imported on the second sync (after the first successful full sync of candidates and job applications). Subsequent delta syncs will import the Resume immediately.
:::
- Disposition reasons
- Work experience
- Education
- Contact information (name, email, phone, and social links)
- EEOC forms
- Employees (as inactive users, so they can be assigned hiring team roles)
## Objects not migrated
- Job templates
- Job postings
- Custom fields
- Candidate tags
- Candidate pools
- Emails and messages
- Email templates
- Application forms
- Questionnaires for the candidate
- Confidential jobs
- Confidential prospects