Connect Workday to Bindbee with an Integration System User (ISU) username and password. Each numbered step below matches one screen in the Bindbee magic link, so you can keep this guide open beside the magic link and work through it in order.
Why Use the API?
Benefit
What it means
No reports to maintain
Data is read from Workday's standard objects. You don't need to build any custom reports.
Read and write
Sync data from Workday and write supported updates back.
Secured by Workday
Access is limited to the domains you grant the integration account.
Need to share calculated fields or custom objects with your provider? Add an Integration System ID in the final step of the connection (see Step 6: Enter Your Integration System ID (Optional)).
Before You Begin
You must have sufficient Workday administrative permissions to configure integration users, security groups, authentication policies, and domain security policies. You will also need the Bindbee magic link provided for your Workday connection.
Step 1: Allow Bindbee to Access Workday
Open the Bindbee magic link and click Allow and Continue.
Step 2: Choose How You Want to Authenticate
Select I want to use my username and password.
Authentication Method
How It Works
Setup Required
ISU Username and Password
Bindbee authenticates using the credentials of a Workday Integration System User.
Integration System User, security group, authentication policy, and domain permissions
OAuth
Bindbee authenticates using a Workday API Client and a Refresh Token.
API Client, Client ID, Client Secret, Refresh Token, scopes, and Workday domain permissions
Step 3: Enter the Credentials for the ISU
An Integration System User (ISU) is a dedicated Workday account that Bindbee uses to sign in and read your Workday data. Set it up in Workday with steps 3.1 to 3.6 below, then enter its credentials in step 3.7.
Already have an ISU for Bindbee? Skip to 3.7 Enter the ISU Credentials in Bindbee.
3.1 Create a Workday Integration System User
Go to your Workday Dashboard.
Search for Create Integration System User and select it.
Enter a User Name. Do not select Generate Random Password. Enter a password manually, as you will need to provide this password when completing the Bindbee connection.
Review the remaining settings and configure them as follows:
Ensure Require New Password at Next Sign In is not selected.
Keep the Session Timeout Minutes default value of zero to prevent session expiration.
(Optional) Select Do Not Allow UI Sessions to prevent the ISU from signing in to the Workday UI.
Click OK, then Done.
3.2 Prevent the ISU Password from Expiring
Search for and open Maintain Password Rules.
In Select users exempt from password expiration, add the newly created Integration System User and click OK, then Done.
3.3 Create a Security Group
Search for and open Create Security Group.
In Type of Tenanted Security Group, select Integration System Security Group (Unconstrained).
Enter a name for the group and click OK.
Add the ISU you created to the security group.
Click OK, then Done.
3.4 Manage Authentication Policies
Search for and open Manage Authentication Policies.
Locate the current authentication policy and click Edit.
Create a new authentication rule, give it an appropriate name, and add the security group you created earlier.
Set the Authentication Condition Name to "credentials" and leave the rest unchanged.
Click OK, then Done.
Click Activate All Authentication Policies.
Add a comment and click OK.
Confirm the selection.
3.5 Grant Permissions to the Security Group
The ISU's security group must have access to the domains required for the data you want to sync or write through Bindbee.
Search for and open Maintain Permissions for Security Group.
Select the security group you created earlier.
Select Get Only for permissions that Bindbee only needs to read, and Get and Put for permissions required by Bindbee write operations.
Add the domain permissions required for the data you want to sync or write through Bindbee.
Workday uses Domain Security Policies to control which data an Integration System User (ISU) can access or modify. These permissions are required whether you connect to Bindbee using ISU username/password authentication or OAuth with a Workday API Client.
The tables below list the permissions Bindbee needs for each data model and write operation. Add the ones that match the data you want to sync.
Workday tenants can have different security configurations. Grant only the permissions required for the data you plan to sync or write through Bindbee. Use Get Only for read access and Get and Put where write access is required.
Read Permissions
Company, Organization, Group, and Pay Group
Access Required
Domain Security Policy
Get Only
Manage: Organization Integration
Employee
The following permissions are used to access employee profile and related personal information.
Access Required
Domain Security Policy
Used For
Get Only
Worker Data: Public Worker Reports
Minimum worker permission required for the integration
Get Only
Person Data: Name
Employee names
Get Only
Person Data: Personal Data
Employee personal information
Get Only
Person Data: Home Contact Information
Home address, home email, and home phone
Get Only
Person Data: Work Contact Information
Work address, work email, and work phone
Get Only
Person Data: Work Address
Employee work address
Get Only
Person Data: ID Information
Employee identification information, including National Identifiers such as SSN where available
Get Only
Person Data: Date of Birth
Employee date of birth
Get Only
Person Data: Gender
Employee gender
Get Only
Worker Data: Workers
Worker information, including data used with Custom Objects
Get Only
Worker Data: Current Staffing Information
Employment status and current staffing information
Depending on your tenant configuration and the employee data you need, additional Person Data permissions may also be required. Open Additional Workday domains and subdomains below.
Employment
Access Required
Domain Security Policy
Used For
Get Only
Worker Data: All Positions
Worker position information
Get Only
Worker Data: Current Staffing Information
Current employment and employment status
Get Only
Worker Data: Employment Data
Employment information
Get Only
Worker Data: Organization Information
Organization information associated with workers
Get Only
Worker Data: All Worker’s Positions Past and Present
Historical and current worker positions
Get Only
Worker Data: All Worker’s Positions
Historical employments
Workday domain names can vary between tenant configurations. If one of the position-related domains above is not available, review the equivalent position domain available in your tenant.
Compensation
Access Required
Domain Security Policy
Get Only
Worker Data: Compensation
Get Only
Worker Data: Compensation by Organization
Depending on the historical compensation data you need, Worker Data: Compensation - All Worker’s Positions Past and Present may also be required.
Payroll Run, Employee Payroll Run, and Payroll Codes
Access Required
Domain Security Policy
Get Only
Reports: Pay Calculation Results for Worker (Results)
Get Only
Worker Data: Payroll
Get Only
Integration Build
Bank Information
Access Required
Domain Security Policy
Get Only
Worker Data: Payroll (Payment Elections)
Time Off
Access Required
Domain Security Policy
Get Only
Worker Data: Time Off
Get Only
Worker Data: Time Off (Accrual and Time Off Adjustments/Overrides by Batch ID)
Time Off Balances
Access Required
Domain Security Policy
Get Only
Worker Data: Time Off (Time Off Balances)
Benefits, Employer Benefits, Dependents, and Dependent Benefits
Access Required
Domain Security Policy
Get Only
Set Up: Benefits
Get Only
Worker Data: Benefit Elections
Get Only
Worker Data: Beneficiaries and Dependents
Timesheet Entries
Access Required
Domain Security Policy
Get Only
Process: Export Time Blocks
Additional Workday domains and subdomains (if data is still missing)
Workday security configuration can vary across tenants. If the expected data is still unavailable after granting the permissions above, or if a listed domain is not available in your tenant, review the related domains and subdomains below.
Enable only the domains and subdomains relevant to the data you need to access.
Person Data: Personal Data
Related permissions include:
Person Data: Citizenship Status
Person Data: Disabilities
Person Data: ID Information
Person Data: National ID Identification
Person Data: Marital Status
Person Data: Date of Birth
Person Data: Gender
Person Data: Government IDs
Person Data: Personal Information
Person Data: Photo
Person Data: Home Contact Information
Related permissions include:
Person Data: Home Address
Person Data: Home Email
Person Data: Home Instant Messenger
Person Data: Home Phone
Person Data: Home Web Address
Person Data: Work Contact Information
Related permissions include:
Person Data: Work Address
Person Data: Work Email
Person Data: Work Instant Messenger
Person Data: Work Phone
Person Data: Work Web Address
Person Data: Public Work Email Address
Worker Data: Time Off
Related permissions include:
Worker Data: Time Off (Time Off)
Worker Data: Time Off (Accrual and Time Off Adjustments/Overrides by Batch ID)
Worker Data: Time Off (Time Off Balances)
Worker Data: Time Off (Time Off Balances Manager View)
Worker Data: Time Off (Time Off Manager View)
Additional Domains
Depending on the data you need, the following additional domains may also be required:
Worker Data: All Worker’s Positions Past and Present
Worker Data: Payroll (Payment Elections)
Worker Data: Compensation - All Worker’s Positions Past and Present
Reports: Pay Calculation Results for Worker (Results)
Write permissions (only if Bindbee writes data back to Workday)
Write permissions are optional and are only required if you plan to create or update data in Workday through Bindbee.
Create Employees
The following domain permissions are used for employee creation:
Access Required
Domain Security Policy
Get Only
Job Requisition Data
Get Only
Manage: Location
Get and Put
Pre Hire: Personal Data
Get and Put
Person Data: Personal Information
Employee creation also requires Business Process Security Policy access.
Additional Business Process Setup for Creating Employees
In addition to the Domain Security Policies above, employee creation requires access to the Hire Business Process Security Policy.
Search for Edit Business Process Security Policy.
Enter Hire as the Business Process Type.
Add the Integration System Security Group in the section where the Initiating Action is Hire Employee (Web Service).
Click OK, then Done.
Create Timesheet Entries
Access Required
Domain Security Policy
Get and Put
Process: Put Reported Time Blocks for Worker
Create Employee Payroll Runs
Access Required
Domain Security Policy
Get and Put
Worker Data: Payroll (Payroll Input)
Get and Put
Worker Data: Payroll Interface (Payroll Input by Worker)
Create Time Off
Access Required
Domain Security Policy
Get and Put
Worker Data: Time Off (Accrual and Time Off Adjustments/Overrides by Batch ID)
Click OK, then Done.
3.6 Activate Pending Security Policy Changes
Search for and open Activate Pending Security Policy Changes.
Enter a comment and click OK.
3.7 Enter the ISU Credentials in Bindbee
Back in the magic link, enter the ISU's User Name in the User ID field, and its Password.
Click Continue. Once the credentials are verified, Bindbee can access the Workday data allowed by the ISU's security group.
Step 4: Enter Your Workday Web Services Endpoint URL
Return to your Workday dashboard.
Search for Public Web Services.
Navigate to Human Resource → Web Service → View WSDL. You can also use Benefit Administration → Web Service → View WSDL, as shown in the screenshot below.
Scroll to the bottom of the WSDL and locate the Workday web service URL.
Copy everything before /service in the URL.
Back in the magic link, paste the value into the Workday Web Services Endpoint URL field and click Continue.
Step 5: Enter Your Workday Tenant Name
Your tenant name appears in your Workday dashboard URL.
Copy the part after workday.com/ (for example, acme in https://wd5-services1.workday.com/acme) and enter it in the Workday Tenant Name field. Do not enter the full URL.
Step 6: Enter Your Integration System ID (Optional)
The Integration System ID is required only if you want to use Workday calculated fields or custom objects through Bindbee.
If you do not need calculated fields or custom objects, leave this field blank and click Connect.
To find your Integration System ID:
Create an Integration System if you have not already done so. See the Add Custom/Calculated Fields guide for setup instructions.
From your Workday dashboard, search for and open View Integration System.
Select the Integration System you created earlier.
Click the System ID dropdown.
Copy the displayed System ID.
Back in the magic link, paste the value into the Integration System ID field.
Once you have entered all required connection details, click Connect.
Troubleshooting
Why are my Workday ISU credentials invalid?
If Bindbee is unable to authenticate using the Workday ISU credentials, verify that the User Name and Password entered in the connection flow match the credentials created for the Integration System User.
Also confirm that Require New Password at Next Sign In is not selected and that the required authentication policy has been configured for the ISU's security group.
Why did my Workday ISU suddenly stop working?
If an integration that was previously working stops authenticating, check whether the ISU password has expired or been updated.
Make sure the Integration System User is included under Select users exempt from password expiration in Maintain Password Rules. If the password was changed, update the credentials in your Bindbee connection as well.
Why does the connection succeed but some employee fields are missing?
If the Workday connection succeeds but certain fields or records are missing, the Integration System User may not have access to the required Workday domains.
Review 3.5 Grant Permissions to the Security Group and make sure the appropriate Domain Security Policies have been granted to the ISU's security group.
After making any permission changes, run Activate Pending Security Policy Changes for the changes to take effect.
Why can't I find a Workday task mentioned in this guide?
If you can't find a task such as Create Integration System User, Manage Authentication Policies, or Maintain Permissions for Security Group, your Workday account may not have the required administrative or security permissions. Contact your Workday administrator to verify your access.
