Connect Workday to Bindbee with a Workday API Client (Client ID, Client Secret and Refresh Token). Each numbered step below matches one screen in the Bindbee magic link, so you can keep this guide open beside the magic link and work through it in order.
Why Use the API?
Benefit
What it means
No reports to maintain
Data is read from Workday's standard objects. You don't need to build any custom reports.
Read and write
Sync data from Workday and write supported updates back.
Secured by Workday
Access is limited to the domains you grant the integration account.
Need to share calculated fields or custom objects with your provider? Add an Integration System ID in the final step of the connection (see Step 6: Enter Your Integration System ID (Optional)).
Before You Begin
You must have sufficient Workday administrative permissions to configure integration users, security groups, API clients, authentication policies, and domain security policies.
You will also need the Bindbee magic link provided for your Workday connection.
Step 1: Allow Bindbee to Access Workday
Open the Bindbee magic link and click Allow and Continue.
Step 2: Choose How You Want to Authenticate
Select I want to use my Client ID, Client Secret & Refresh Token.
Authentication Method
How It Works
Setup Required
ISU Username and Password
Bindbee authenticates using the credentials of a Workday Integration System User.
Integration System User, security group, authentication policy, and domain permissions
OAuth
Bindbee authenticates using a Workday API Client and a Refresh Token.
API Client, Client ID, Client Secret, Refresh Token, scopes, and Workday domain permissions
Step 3: Enter Your Workday Web Services Endpoint URL
Open your Workday dashboard.
Search for Public Web Services.
Navigate to Human Resource → Web Service → View WSDL. You can also use Benefit Administration → Web Service → View WSDL, as shown in the screenshot below.
Scroll to the bottom of the WSDL and locate the Workday web service URL.
Copy everything before /service in the URL.
Back in the magic link, paste the value into the Workday Web Services Endpoint URL field and click Continue.
Step 4: Enter Your Workday Tenant Name
Your tenant name appears in your Workday dashboard URL.
Copy the part after workday.com/ (for example, acme in https://wd5-services1.workday.com/acme) and enter it in the Workday Tenant Name field. Do not enter the full URL.
Step 5: Enter Your Client ID, Client Secret and Refresh Token
OAuth also needs a Workday Integration System User (ISU). The Refresh Token is generated for the ISU, and the ISU's security group controls which data Bindbee can access.
Set up the ISU with steps 5.1 to 5.6 and the API Client with steps 5.7 to 5.9, then enter the credentials in step 5.10.
Already have an ISU and an API Client for Bindbee? Skip to 5.10 Enter the Credentials in Bindbee.
5.1 Create a Workday Integration System User
Go to your Workday Dashboard.
Search for Create Integration System User and select it.
Enter a User Name. Do not select Generate Random Password. Enter a password manually and store it securely.
Review the remaining settings and configure them as follows:
Ensure Require New Password at Next Sign In is not selected.
Keep the Session Timeout Minutes default value of zero to prevent session expiration.
(Optional) Select Do Not Allow UI Sessions to prevent the ISU from signing in to the Workday UI.
Click OK, then Done.
5.2 Prevent the ISU Password from Expiring
Search for and open Maintain Password Rules.
In Select users exempt from password expiration, add the newly created Integration System User and click OK, then Done.
5.3 Create a Security Group
Search for and open Create Security Group.
In Type of Tenanted Security Group, select Integration System Security Group (Unconstrained).
Enter a name for the group and click OK.
Add the ISU you created to the security group.
Click OK, then Done.
5.4 Manage Authentication Policies
Search for and open Manage Authentication Policies.
Locate the current authentication policy and click Edit.
Create a new authentication rule, give it an appropriate name, and add the security group you created earlier.
Set the Authentication Condition Name to "credentials" and leave the rest unchanged.
Click OK, then Done.
Click Activate All Authentication Policies.
Add a comment and click OK.
Confirm the selection.
5.5 Grant Permissions to the Security Group
The ISU's security group must have access to the domains required for the data you want to sync or write through Bindbee.
Search for and open Maintain Permissions for Security Group.
Select the security group you created earlier.
Select Get Only for permissions that Bindbee only needs to read, and Get and Put for permissions required by Bindbee write operations.
Add the domain permissions required for the data you want to sync or write through Bindbee.
Workday uses Domain Security Policies to control which data an Integration System User (ISU) can access or modify. These permissions are required whether you connect to Bindbee using ISU username/password authentication or OAuth with a Workday API Client.
The tables below list the permissions Bindbee needs for each data model and write operation. Add the ones that match the data you want to sync.
Workday tenants can have different security configurations. Grant only the permissions required for the data you plan to sync or write through Bindbee. Use Get Only for read access and Get and Put where write access is required.
Read Permissions
Company, Organization, Group, and Pay Group
Access Required
Domain Security Policy
Get Only
Manage: Organization Integration
Employee
The following permissions are used to access employee profile and related personal information.
Access Required
Domain Security Policy
Used For
Get Only
Worker Data: Public Worker Reports
Minimum worker permission required for the integration
Get Only
Person Data: Name
Employee names
Get Only
Person Data: Personal Data
Employee personal information
Get Only
Person Data: Home Contact Information
Home address, home email, and home phone
Get Only
Person Data: Work Contact Information
Work address, work email, and work phone
Get Only
Person Data: Work Address
Employee work address
Get Only
Person Data: ID Information
Employee identification information, including National Identifiers such as SSN where available
Get Only
Person Data: Date of Birth
Employee date of birth
Get Only
Person Data: Gender
Employee gender
Get Only
Worker Data: Workers
Worker information, including data used with Custom Objects
Get Only
Worker Data: Current Staffing Information
Employment status and current staffing information
Depending on your tenant configuration and the employee data you need, additional Person Data permissions may also be required. Open Additional Workday domains and subdomains below.
Employment
Access Required
Domain Security Policy
Used For
Get Only
Worker Data: All Positions
Worker position information
Get Only
Worker Data: Current Staffing Information
Current employment and employment status
Get Only
Worker Data: Employment Data
Employment information
Get Only
Worker Data: Organization Information
Organization information associated with workers
Get Only
Worker Data: All Worker’s Positions Past and Present
Historical and current worker positions
Get Only
Worker Data: All Worker’s Positions
Historical employments
Workday domain names can vary between tenant configurations. If one of the position-related domains above is not available, review the equivalent position domain available in your tenant.
Compensation
Access Required
Domain Security Policy
Get Only
Worker Data: Compensation
Get Only
Worker Data: Compensation by Organization
Depending on the historical compensation data you need, Worker Data: Compensation - All Worker’s Positions Past and Present may also be required.
Payroll Run, Employee Payroll Run, and Payroll Codes
Access Required
Domain Security Policy
Get Only
Reports: Pay Calculation Results for Worker (Results)
Get Only
Worker Data: Payroll
Get Only
Integration Build
Bank Information
Access Required
Domain Security Policy
Get Only
Worker Data: Payroll (Payment Elections)
Time Off
Access Required
Domain Security Policy
Get Only
Worker Data: Time Off
Get Only
Worker Data: Time Off (Accrual and Time Off Adjustments/Overrides by Batch ID)
Time Off Balances
Access Required
Domain Security Policy
Get Only
Worker Data: Time Off (Time Off Balances)
Benefits, Employer Benefits, Dependents, and Dependent Benefits
Access Required
Domain Security Policy
Get Only
Set Up: Benefits
Get Only
Worker Data: Benefit Elections
Get Only
Worker Data: Beneficiaries and Dependents
Timesheet Entries
Access Required
Domain Security Policy
Get Only
Process: Export Time Blocks
Additional Workday domains and subdomains (if data is still missing)
Workday security configuration can vary across tenants. If the expected data is still unavailable after granting the permissions above, or if a listed domain is not available in your tenant, review the related domains and subdomains below.
Enable only the domains and subdomains relevant to the data you need to access.
Person Data: Personal Data
Related permissions include:
Person Data: Citizenship Status
Person Data: Disabilities
Person Data: ID Information
Person Data: National ID Identification
Person Data: Marital Status
Person Data: Date of Birth
Person Data: Gender
Person Data: Government IDs
Person Data: Personal Information
Person Data: Photo
Person Data: Home Contact Information
Related permissions include:
Person Data: Home Address
Person Data: Home Email
Person Data: Home Instant Messenger
Person Data: Home Phone
Person Data: Home Web Address
Person Data: Work Contact Information
Related permissions include:
Person Data: Work Address
Person Data: Work Email
Person Data: Work Instant Messenger
Person Data: Work Phone
Person Data: Work Web Address
Person Data: Public Work Email Address
Worker Data: Time Off
Related permissions include:
Worker Data: Time Off (Time Off)
Worker Data: Time Off (Accrual and Time Off Adjustments/Overrides by Batch ID)
Worker Data: Time Off (Time Off Balances)
Worker Data: Time Off (Time Off Balances Manager View)
Worker Data: Time Off (Time Off Manager View)
Additional Domains
Depending on the data you need, the following additional domains may also be required:
Worker Data: All Worker’s Positions Past and Present
Worker Data: Payroll (Payment Elections)
Worker Data: Compensation - All Worker’s Positions Past and Present
Reports: Pay Calculation Results for Worker (Results)
Write permissions (only if Bindbee writes data back to Workday)
Write permissions are optional and are only required if you plan to create or update data in Workday through Bindbee.
Create Employees
The following domain permissions are used for employee creation:
Access Required
Domain Security Policy
Get Only
Job Requisition Data
Get Only
Manage: Location
Get and Put
Pre Hire: Personal Data
Get and Put
Person Data: Personal Information
Employee creation also requires Business Process Security Policy access.
Additional Business Process Setup for Creating Employees
In addition to the Domain Security Policies above, employee creation requires access to the Hire Business Process Security Policy.
Search for Edit Business Process Security Policy.
Enter Hire as the Business Process Type.
Add the Integration System Security Group in the section where the Initiating Action is Hire Employee (Web Service).
Click OK, then Done.
Create Timesheet Entries
Access Required
Domain Security Policy
Get and Put
Process: Put Reported Time Blocks for Worker
Create Employee Payroll Runs
Access Required
Domain Security Policy
Get and Put
Worker Data: Payroll (Payroll Input)
Get and Put
Worker Data: Payroll Interface (Payroll Input by Worker)
Create Time Off
Access Required
Domain Security Policy
Get and Put
Worker Data: Time Off (Accrual and Time Off Adjustments/Overrides by Batch ID)
Click OK, then Done.
5.6 Activate Pending Security Policy Changes
Search for and open Activate Pending Security Policy Changes.
Enter a comment and click OK.
5.7 Create a Workday API Client for Integrations
If you do not already have an API client configured, search for and open Register API Client for Integrations in Workday. If you already have an API client for this integration, you can skip this section.
Enter a recognizable client name, such as Bindbee Integration.
Select the required scopes
Add the required scopes based on the data you want to sync. Available scopes may vary depending on your Workday tenant and configuration.
Data or Use Case
API Client Scope
Required for all integrations
Staffing
Required for all integrations
Tenant Non-Configurable
Required for all integrations
Implementation
Company Data
Organizations and Roles
Employee Data
Personal Data
Employee Data
Contact Information
Bank Info, Compensation, Payroll Data
Expenses, Core Payroll, Payroll Interface
Benefits Data
Benefits
Timesheet Data
Time Tracking
Time Off Data
Time Off and Leave
If Tenant Non-Configurable is not available in the scope list, try enabling Include Workday Owned Scope.
After creating the API client, securely copy and store the Client Secret, as it is displayed at the time of creation and cannot be viewed again after you leave the page.
API client scopes determine the functional areas the API client can access. The Integration System User (ISU) used for the integration must also have the required security permissions for the corresponding data. You will select this ISU later when generating the refresh token.
5.8 Get the Client ID and Client Secret
Go to View API Clients and open the API Clients for Integrations tab. Locate your API client.
Click the name of the API client. The Client ID will be displayed on the API client details page.
If you no longer have the Client Secret saved, use Generate New Client Secret to generate a new one.
5.9 Get the Refresh Token
Go to View API Clients and open the API Clients for Integrations tab. Search for the API client you created earlier.
Click the three-dot menu next to your API client, then select API Client → Manage Refresh Tokens for Integrations.
In the Workday Account field, select the Integration System User (ISU) configured for this integration. If you do not have an ISU set up for this integration, see 5.1 Create a Workday Integration System User above.
Note: Ensure that the selected ISU has the required security permissions. Missing permissions may cause certain fields or records to be unavailable even when the appropriate API client scopes are selected.
The full list of permissions is in 5.5 Grant Permissions to the Security Group above.
We recommend generating a dedicated refresh token for this integration. Select Generate New Refresh Token, then click OK.
Copy the Refresh Token and store it securely. You will need it when setting up your Workday connection.
5.10 Enter the Credentials in Bindbee
Back in the magic link, enter the credentials you collected above:
Client ID
Client Secret
Refresh Token
Click Continue.
Step 6: Enter Your Integration System ID (Optional)
The Integration System ID is required only if you want to use Workday calculated fields or custom objects through Bindbee.
If you do not need calculated fields or custom objects, leave this field blank and click Connect.
To find your Integration System ID:
Create an Integration System if you have not already done so. See the Add Custom/Calculated Fields guide for setup instructions.
From your Workday dashboard, search for and open View Integration System.
Select the Integration System you created earlier.
Click the System ID dropdown.
Copy the displayed System ID.
Back in the magic link, paste the value into the Integration System ID field.
Once you have entered all required connection details, click Connect.
Troubleshooting
Why is my Workday OAuth connection failing?
Verify that:
The Client ID and Client Secret belong to the API Client configured for the integration.
The Refresh Token was generated for the intended Workday account.
The required scopes are configured on the API Client.
The Workday account associated with the Refresh Token has the required permissions.
See 5.7 Create a Workday API Client for Integrations above for the complete OAuth setup.
Why does the Workday connection succeed but some data is missing?
If Bindbee can successfully connect to Workday but certain fields or records are unavailable, the Workday account may not have access to the required domains.
Review 5.5 Grant Permissions to the Security Group and make sure the required Domain Security Policies have been granted.
If you modify Workday security permissions, make sure the pending security policy changes are activated before testing the connection again.
Why can't I find a Workday task mentioned in this guide?
If you cannot find tasks such as Create Integration System User, Manage Authentication Policies, or Register API Client for Integrations, your Workday account may not have the necessary administrative or security permissions.
Contact your Workday administrator to verify your access.
