> ## Documentation Index
> Fetch the complete documentation index at: https://developers.techwolf.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Installation

> Step-by-step guide to configure your Workday tenant for the Workday Data Source Connector.

## Prerequisites

* A Workday tenant with the Workday Query Language (WQL) feature enabled.
* Security administrator access in Workday.
* An active TechWolf contract with SkillEngine API credentials.

## Workday configuration

The setup consists of creating an Integration System User, granting the appropriate security permissions, and registering an API client. Follow each step in order.

<Steps>
  <Step title="Create an Integration System User (ISU)">
    1. Search for **Create Integration System User** in the Workday search bar.
    2. Create a new user (e.g. `TechWolf_Source_ISU`).
    3. Set a password — it will not be used directly but is required by Workday.
    4. Check **Do Not Allow UI Sessions** to restrict this user to API-only access.

    <Warning>
      Store the ISU credentials securely. You will need the username when generating a refresh token.
    </Warning>
  </Step>

  <Step title="Create an Integration Security Group">
    1. Search for **Create Security Group**.
    2. Choose **Integration System Security Group (Unconstrained)**.
    3. Name it (e.g. `ISSG_TechWolf_Source`).
    4. Add the ISU created in the previous step.

    <Info>
      If you want to limit the connector to a specific subset of workers (e.g. a particular country or business unit), create two security groups for the same ISU:

      * an **Integration System Security Group (Unconstrained)** for the **Workday Query Language** permission
      * an **Integration System Security Group (Constrained)** for the worker data permissions

      On the constrained group, add the ISU, add the relevant organisation, and choose whether access applies only to that organisation or also to subordinate organisations.
    </Info>
  </Step>

  <Step title="Grant domain security permissions">
    1. Search for **Maintain Permissions for Security Group** and select the security group created in the previous step.
    2. Under **Integration Permissions**, add **View** access for the **Workday Query Language** domain. This is required for all data types.
    3. Add the required permissions listed in the [permissions table](#permissions-per-data-type) below. The table separates **Get** and **View** domain access.
    4. If the [permissions table](#permissions-per-data-type) lists Business Process Security Policies for your selected data types, give **View All** access on those Business Processes.
    5. Search for **Activate Pending Security Policy Changes** and activate the changes.

    <Info>
      For a constrained setup, grant **Workday Query Language** on the unconstrained security group and grant the worker data domains on the constrained security group. Workday may not allow the **Workday Query Language** domain to be added directly to an Integration System Security Group (Constrained).
    </Info>

    <Info>
      You only need to grant permissions and API client scopes for the data types you plan to use. For example, if you only need Workers and Jobs, you do not need to grant access to Learning or Person Data domains.
    </Info>
  </Step>

  <Step title="Register an API Client for Integrations">
    1. Search for **Register API Client for Integrations**.
    2. Set a client name (e.g. `TechWolf Datasource Integration`).
    3. Under **Scope (Functional Areas)**, add **System** and **Tenant Non-Configurable**. If you plan to use Feedback, also add **Performance Enablement**.
    4. Check the following boxes:
       * **Non-Expiring Refresh Tokens**
       * **Include Workday Owned Scope**
    5. After creation, securely store the **Client ID** and **Client Secret**.
  </Step>

  <Step title="Generate a refresh token">
    1. Search for **View API Clients**.
    2. Click the **API Clients for Integrations** tab.
    3. Find the API client created in the previous step.
    4. Select **API Client** > **Manage Refresh Tokens for Integrations**.
    5. Under **Workday Account**, enter the ISU created in Step 1.
    6. Check **Generate New Refresh Token** and confirm.
    7. Securely store the refresh token.

    <Warning>
      The refresh token is displayed only once. If you lose it, you must generate a new one.
    </Warning>
  </Step>

  <Step title="Find base URL and tenant name">
    1. Search for **View API Clients** in the Workday search bar.
    2. Locate the **Workday REST API Endpoint** field. It will look like:
       ```
       https://wd2-impl-services1.workday.com/ccx/api/v1/mycompany
       ```
    3. The **base URL** is the host portion: `https://wd2-impl-services1.workday.com`
    4. The **tenant** is the last path segment after `/v1/`: `mycompany`

    <Info>
      The API URL can differ between implementation tenants and production tenants. Repeat this step for each tenant you want to connect.
    </Info>
  </Step>
</Steps>

## Share credentials with TechWolf

Once the Workday configuration is complete, securely share the following credentials with TechWolf:

| Credential | Description |
| - | - |
| Client ID | The API client ID from Step 4 |
| Client secret | The API client secret from Step 4 |
| Refresh token | The non-expiring refresh token from Step 5 |
| Base URL | The Workday REST API host (e.g. `https://wd2-impl-services1.workday.com`) |
| Tenant | The tenant name (e.g. `mycompany`) |

TechWolf will validate that the ISU has the required permissions and that the credentials are correct. If any permissions are missing, the connector will report exactly which security domains need to be added.

## Permissions per data type

Grant the domains below for every data type you plan to use. Entries marked
"incremental only" are only needed when TechWolf configures incremental change
detection for that data type.

| Data type | Get | View | Business Process Security Policies |
| - | - | - | - |
| Workers | Worker Data: Current Staffing Information<br />Worker Data: Current Job Profile Information<br />Worker Data: Public Worker Reports | Workday Query Language | - |
| Organisational Units | Manage: Supervisory Organization | Workday Query Language | - |
| Jobs | Job Information | Workday Query Language | - |
| Vacancies | Job Requisition Data | Workday Query Language | - |
| External History | Worker Data: Current Staffing Information<br />Person Data: Job History<br />Worker Data: Public Worker Reports (incremental only)<br />Business Process Administration (incremental only) | Workday Query Language | - |
| Certificates | Worker Data: Current Staffing Information<br />Person Data: Certifications<br />Worker Data: Public Worker Reports (incremental only)<br />Business Process Administration (incremental only) | Workday Query Language | - |
| Education | Worker Data: Current Staffing Information<br />Person Data: Education<br />Worker Data: Public Worker Reports (incremental only)<br />Business Process Administration (incremental only) | Workday Query Language | - |
| Learning | Worker Data: Current Staffing Information<br />Person Data: Learning | Workday Query Language | - |
| Goals | Worker Data: Current Staffing Information<br />Worker Data: Employee Goals<br />Worker Data: Public Worker Reports (incremental only) | Workday Query Language | - |
| Internal History | Worker Data: Current Staffing Information<br />Worker Data: Historical Staffing Information<br />Worker Data: Public Worker Reports (incremental only) | Workday Query Language | View All: Hire<br />Change Job<br />Termination<br />Contract Contingent Worker<br />Transfer Contingent Worker Inbound<br />End Contingent Worker Contract |
| Courses | Set Up: Learning Catalog<br />Manage: Learning Content | Workday Query Language | - |
| Performance Reviews | Worker Data: Current Staffing Information<br />Worker Data: Employee Reviews<br />Worker Data: Public Worker Reports (incremental only)<br />Business Process Administration (incremental only) | Workday Query Language | - |
| Feedback | Worker Data: Public Worker Reports<br />Worker Data: Confidential Feedback (incremental only)<br />Business Process Administration (incremental only) | Workday Query Language<br />Worker Data: Anytime Feedback<br />Worker Data: Role Requested Feedback<br />Worker Data: Self Requested Feedback<br />Worker Data: Confidential Feedback<br />Worker Data: Private Feedback | - |
| Job Families | Job Information | Workday Query Language | - |

## API client scopes

Every API client must include **System** and **Tenant Non-Configurable**. Keep **Include Workday Owned Scope** selected.

Add these additional scopes based on the data types enabled for the connector:

| Enabled data types | Additional API client scopes |
| - | - |
| Feedback | Performance Enablement |

<Info>
  Workday tenant configuration can hide scopes for products that are not enabled. If Performance Enablement is unavailable in your tenant but you want to use Feedback, share that during setup so TechWolf can validate the exact access against your Workday environment.
</Info>

<Info>
  **Business Process Administration** is a domain permission, not a Business
  Process Security Policy. It is only needed for incremental change detection on
  data types that resolve named Business Process identifiers.
</Info>

<Warning>
  **Feedback** requires **View** permissions on the Feedback domains. Granting
  only Get on those domains will result in empty data with no error message.
</Warning>

## TechWolf configuration

After receiving the credentials, TechWolf will:

1. Validate the credentials and security permissions.
2. Configure the connector for the agreed-upon data types.
3. Set up the connector on a daily schedule.
4. Run an initial data extraction.
5. Confirm the integration is operational.

No further action is required from your side unless permission issues are reported.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.