--- title: Workday HRIS Integration Setup slug: workday-hris-integration-setup docTags: rl7p3XLQknqPB1UQ70cu_,pnTugMDqVVXgkHZy0AYvk createdAt: 2025-10-17T11:17:05.403Z --- This article explains how to configure the Workday HRIS integration with Ashby. Ashby connects to Workday using several Workday APIs, each of which requires varying user and permission configurations. The setup has three phases: 1. Configuring Ashby's Integration System User (ISU) 2. Creating the API Client for Integrations for Ashby 3. Configuring domain security for Ashby's ISU In each phase, we advise you to copy down important information that you need to configure within Ashby to connect your Ashby and Workday instances. :::hint{type="info"} For an overview of the Workday API migration, see [Workday ATS -> Ashby Recruiting API Migration Guide](docId\:tUr-37IFYBpkRDpV6kc3r). For more on syncing Workday positions with Ashby and hired Ashby candidates with Workday, see [Workday](docId\:Lser77iHgverWT8Ovu5gx). For frequently asked questions, see [Workday Integration FAQ](docId\:PUdepE2jbFIXjwfHhsfUd). ::: # Configuring Ashby's Integration System User (ISU) 1. Log in to your Workday application using an Administrator account. 2. In the application's search box, search for create user and then select `Create Integration System User`. 3. Enter a User Name and Password. As a username, we recommend `Ashby_ISU`. :::hint{type="info"} Copy down the username and password for future configuration within Ashby. Some of Workday's Copy UI can copy unnecessary details of fields, so check that you are copying just the username and password. ::: 4. Leave the `Require New Password at Next Sign In` checkbox unchecked, as this user accesses Workday programmatically. 5. Leave the `Session Timeout Minutes` field with its default value of 0, which prevents the user's sessions from timing out prematurely. 6. Select the option `Do Not Allow UI Sessions` (this prevents the account from logging into Workday). :::hint{type="info"} If possible, make sure the password does not expire. Otherwise, Ashby's sync stops when the password expires. You can do this by going to the **Maintain Password Rules** task and adding Ashby's ISU to the **System Users exempt from password expiration** field. ::: # Create the API Client for Integrations for Ashby For syncing and mapping certain fields, Ashby needs additional access to the Workday API to run custom reports. We run this report using Workday Query Language (WQL) via Workday's REST API. Access to the REST API requires a special API client to be configured. 1. Open the **Register API Client for Integrations** task (via Workday search). 2. Use the following configuration: - Client Name: Ashby API Access - Non-Expiring Refresh Tokens: ✅ - Scope: System, Recruiting, Staffing, Pre-Hire Process, Organizations and Roles, Jobs & Positions, Integration, Tenant Non-Configurable, Public Data (allows high level access to recruiting and reporting data; data within is still guarded by domain security). - Included Workday Owned Scope: ✅ (access to "workday owned" fields) 3. Click `OK`. 4. On the page that appears, copy down the client ID and secret. :::hint{type="info"} The client ID and secret are needed to configure REST API access for Ashby. ::: 5. On the same page, click the `...` menu next to the client name in the blue header at the top, and then choose **API Client > Manage Refresh Tokens for Integrations**. 6. In the **Workday Account** box in the dialog that appears, find and choose Ashby's ISU, and then click `OK`. 7. On the next page, check the `Generate New Refresh Token` box, and then click `OK`. 8. Copy down the refresh token that appears on the next page. :::hint{type="info"} The refresh token is needed to configure REST API access for Ashby. ::: 9. Go to the **View API Clients** report (via Workday search). 10. On this page, there are three "endpoints" at the top. :::hint{type="info"} Copy these down. These endpoints are needed to configure REST API access for Ashby. ::: # Collect final tenant information Most of the Workday-side configuration is now done. We just need to collect a few final pieces of information before going to Ashby to configure the connection. ## Workday Tenant ID Your Workday Tenant ID is found in the URL when you're logged into Workday. For example, if the URL is `https://impl.workday.com/example/d/home.html`, your Tenant ID is "example." :::hint{type="info"} Copy your Tenant ID down for configuration within Ashby. ::: ## WSDL URL Your Web Services Description Language (WSDL) URL can be found by following the relevant Workday article. In short: 1. Type **Public Web Services** in the Workday search bar. 2. Under **Reports**, select `Public Web Services`. 3. From the **Public Web Services** list, select any one and click the ellipsis icon to reveal a drop-down menu. Select **Web Service > View WSDL**, which displays the full WSDL XML in a separate window. 4. Search the XML for a URL containing the text `ccx/service`. Copy that URL up to and including the `ccx/service` piece. This is the WSDL URL you add to Ashby. It may look something like `https://wd2-impl-services1.workday.com/ccx/service`. :::hint{type="info"} Copy the WSDL URL for configuration within Ashby. ::: # Configure security for Ashby's ISU ## Create a security group In this step, you create an unconstrained Integration System Security Group in Workday and assign the ISU created in the previous step to this group. 1. In the search box, search for "security group" and then select `Create Security Group`. 2. Complete the **Create Security Group** task. 3. Select `Integration System Security Group` (Unconstrained) from the **Type of Tenanted Security Group** dropdown. 4. After the security group is created, you see a page where you can assign members to the security group. 5. Add the new ISU created in the previous step to this security group. ## Configure domain security policy permissions In this step, you grant "domain security" policy permissions that allow Ashby access to recruiting and HR data domains related to the Ashby Analytics integration. 1. Enter **Security Group Membership and Access** in the search box and click on the report link. 2. Search and select the security group created in the previous step. 3. Click on the ellipsis `...` next to the group name and from the menu, select **Security Group > Maintain Domain Permissions for Security Group**. 4. Add the following domains to the **Domain Security Policies** list: :::hint{type="info"} In rows where multiple domains are listed, all domains after the first may be included or inherited by the first domain, depending on your Workday instance's security configuration. Where no reason is listed, the reason is the same as the nearest row above. ::: | Domain Security Policy | Operation | Reason | | ---------------------------------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------- | | Manage: Organization Integration | Get Only | Get list of supervisory organizations and cost center for offers, positions, and job requisitions | | Integration Build | Get Only | Access to low-level identifiers to connect Workday objects together (e.g. a job to a location) | | Worker Data: All Positions | Get Only and View Only | Sync worker position data into Ashby Openings and view Overlap settings on Position Restrictions | | Worker Data: Public Worker Reports | Get Only | Get list of workers for user sync | | Job Requisition Data | Get Only | Sync job requisition data | | Manage: Evergreen Requisitions | Get Only | Sync evergreen requisition data | | Job Information | Get Only | Get information about job profiles, job families, and job family groups | | Manage: Location | Get Only | Get list of available locations | | Reporting Audits | Get Only | Allows running reports via REST API WQL | | Worker Data: Active and Terminated Workers | Get Only | Access data source Workers for HCM Reporting to sync Employee fields | | Worker Data: Workers | Get Only | Allows Ashby to run the Get\_Workers API | | Manage Pre-Hire Process: Manage Pre-Hires | Get and Put | Get pre-hire records and allow Ashby to set fields on pre-hire records (e.g. Referred\_By) | | Manage Pre-Hire Process: Consider Pre-Hires | Get Only | Get job considerations for pre-hires | | Workday Query Language | View and Modify | "View and Modify" appears to be required here, even though we can only run queries that fetch data. | | Compensation Change: Salary | View and Modify | Allows Ashby to override the position salary plan when creating an offer. | | Person Data: Work Contact Information | Get Only | Allows Ashby to connect the Employee list with Workday Worker using work email. | | Person Data: Public Work Email Address Integration | Get Only | Allows Ashby to connect the Employee list with Workday Worker using work email in the Get\_Workers web service. | | Person Data: ID Information | Get Only | Allows Ashby to connect the Employee list with Workday Worker using work email. | | Manage: Custom Organization | Get Only | Allows Ashby to navigate organization hierarchies (e.g. Cost Center, Supervisory, custom org) | | Non-Worker Data: Compensation Pay Range (\*see note) | Get Only / View Only | ONLY: If you want to display Compensation data (range, grade, grade profile) fields from Positions in Workday to Ashby | | Worker Data: Compensation Pay Range (\*see note) | Get Only / View Only | ONLY: If you want to display Compensation data (range, grade, grade profile) fields from Positions in Workday to Ashby | | Set Up: Stock (\*see note) | Get Only | ONLY: If you are overriding the Stock Plan Target at the time of offer | ## Configure business process permissions Ashby needs access to recruiting-specific business processes. To give Ashby the right access, go to each business process as follows (using "hire" as an example in step 1): 1. Go to **bp: hire**. 2. Select **Related Actions** (`...` menu at the top) **> Business Process Policy**, then click `Edit`. 3. Scroll to **Who Can Start the Business Process**. 4. In the **Initiating Action: Hire Employee (Web Service)** section, add Ashby's Integration System Group (ISG) to the **Security Groups** list. 5. Scroll down to **Who Can Do Actions on Entire Business Process**. 6. Go to the **View All** section. 7. Add Ashby's ISG. Ashby needs this for the following recruiting business processes (substitute each of the following in for your Workday search): - Hire - Change Job - Contract Contingent Worker - Create Position (uncommon: only if you need to create new Positions in Workday from a hire in Ashby) After adding all of the above business process permissions, run `Activate Pending Security Policy Changes`. # Configure the connection in Ashby Now that you have collected all the information needed, you are ready to configure the connection in Ashby. Go to [https://app.ashbyhq.com/admin/integrations/marketplace/workday](https://app.ashbyhq.com/admin/integrations/marketplace/workday), and you see the screen below. ::Image[]{src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfpyfCRTXIJ8d9v4ZGqQY5RFx5_uEvA-NPq8m2xXecI0mWZvHjwhLWGCfxSI_2o7eHfJXfWrrTZpX6TAMRHHDV2Fp8O2lBpt2Nax3n8ATV0djdDX8aA5ylLkxEsN26qv9MRp9g_7Q?key=NUnBBF0wtOair6h4at6P4g" size="64" width="1374" height="1340" position="center" showCaption="false" darkWidth="1374" darkHeight="1340"} ## Steps :::hint{type="info"} Your Workday Tenant ID is case-sensitive, so take care when entering it in step 2. ::: 1. In the **Webservice Endpoint URL** field, paste the WSDL URL (it may look something like `https://wd2-impl-services1.workday.com/ccx/service`). 2. Add your Workday Tenant Name (case sensitive). 3. In the **ISU Username** field, enter the ISU username you created for Ashby. 4. In the **ISU Password** field, paste the ISU password. 5. In the **REST API Base URL** field, paste the "host" part of the endpoints you copied when configuring the REST API client. It looks something like `https://wd5-services1.myworkday.com`, which is just the part of the URLs that end in `myworkday.com`. They should all be the same, though yours may start with `wd4-services1`, for example. 6. In the **REST API Client ID** field, paste the client ID you copied when configuring the REST API client. 7. In the **REST API Client Secret** field, paste the client secret you copied when configuring the REST API client. 8. In the **REST API Client Refresh Token** field, paste the refresh token you copied when configuring the REST API client. 9. In the **Workday Tenant URL** field, you may leave it blank. If you find the `Open in Workday` button is not working correctly, update this using the portion of your Workday Tenant URL for tasks starting with `https://` through `/d`. It looks something like `https://wd5-impl.workday.com/example/d`. :::hint{type="info"} Once this is complete, let us know, and we'll monitor the initial sync to make sure all is well. An Edit Authentication Policy task may need to be run to take your ISU into account. :::