‍A guide to integrating with Workday’s API

Workday, a leading human capital management (HCM) and financial management platform, stores a wide range of valuable data, from employee details to financial transactions to supplier contracts.

Given all the valuable information collected and created in the platform, you can benefit from integrating with the solution in a number of different ways.

To help you identify the best Workday integrations for your business, we’ll break several impactful use cases. And to help you implement any, we’ll walk through each authentication step you’ll need to follow and high-level best practices.

Workday API integration use cases

Let’s break down a few internal integration use cases and then highlight a couple customer-facing ones.

Analyze employee performance and adjust compensation effectively

Say you use a tool like Lattice to manage performance reviews and to make decisions on salary adjustments, bonus payouts, promotions, etc.

To help your team manage performance reviews for each employee with ease and make the appropriate compensation adjustments over time, you can integrate Workday with Lattice and sync data like employees’ annual salaries and job titles on a consistent cadence. 

Streamline the employee onboarding process

To help you onboard employees quickly and on time, you can integrate your ATS (e.g., Greenhouse) with Workday and build a sync where once a candidate is marked as hired in the ATS, their profile automatically gets created in Workday.

From there, your HR team can learn about the incoming employee’s start date, address, job title, and more within Workday, allowing them to kickstart the onboarding process successfully.

Add users to your product in a scalable, seamless way

To help customers add users to your product, you can integrate with their instances of Workday and build the following flow: Once a customer adds an employee in their Workday instance, your product can notify admin users and allow them to add these users with the click of a button.

For example, BILL, a financial operations platform, notifies admin users when new employees are added to the integrated instance of Workday.

BILL’s admin users can then search for individual users or collect groups of them and add anyone by simply clicking “Add”. 

Remove users from your product easily and quickly 

To help you remove users from your product on time, you can integrate with customers’ instances of Workday and build the following flow: Any time a user is marked as terminated or removed from a customer’s integrated HRIS, your product can notify the admin user and enable them to remove that user with the click of a button.

Ramp, a spend management platform, uses HRIS integrations to do exactly that: Admin users can identify employees who’ve been marked as terminated from the integrated HRIS—whether that’s Workday or another system, like Gusto. The Ramp admins can then remove those employees’ accounts with a few clicks.

How to authenticate to Workday’s API

Regardless of your integration use case, you or your customers will need to authenticate to Workday’s API either through an Integration System User (ISU) or OAuth.

Here are the steps for each method: 

Integration System User

1. You’ll first need to login to your Workday tenant. From there, you can search for the task “Create Integration System User.” 

Once you click on this, you’ll get to a page where you can create an Integration System User via a username and password.

2. Create a Security Group and assign the Integration System User to that Group.

3. Configure the Domain Security Policy Permissions for the Security Group in a way that’s relevant to your use case.

4. Activate Security Policy Changes to review all updates that need to be approved.

5. Search Public Web Services and gather your WSDL.

6. Using your WSDL, ISU Username, and ISU Password, you should be able to authenticate to the Workday API. And if the integration is for a customer, they can perform the steps above and either send you these credentials securely via a secure link or you can build a way for them to enter in their credentials in your application.

OAuth

1. Login to your Workday tenant and register a new API Client for Integrations.

2. Add in the following Scopes: Public Data, Staffing (HRIS), Recruiting (ATS) and Tenant Non-Configurable

3. Ensure there’s a Non-Expiring Refresh Token, and then save your Client ID and Client Secret.

4. Navigate to View API Clients, API Clients for Integrations, and click the Client created earlier. 

5. Generate a non-expiring Refresh Token. 

‍

7. Search Public Web Services and gather your WSDL.

8. You can now authenticate to the Workday API by adding your WSDL, Client ID, Client Secret, OAuth Token URL, and Refresh Token. 

If the integration is for a customer, they can perform the steps above and either send you these credentials via a secure link or add them to your application (assuming you provide a way for them to do so).

Examples of Workday API requests

To help you build to specific endpoints, let’s take a closer look at a few common requests and how you can structure them.

GET /employees 

By making this request, you can access a wide range of employee data, from personal information to employment details to benefits enrollments.

Here’s how you can structure it:

GET /candidates

Similarly, you can fetch key information on candidates from Workday, including candidates’ application details, attachments from applications, and personal information.

Here’s how you can structure your request to fetch this data in Workday:

Tips for integrating with Workday’s API

Here are a few best practices for integrating with Workday.

Carefully decide between OAuth and ISU

Choosing between the two authentication methods should depend on your integration's security requirements, user context, and operational needs.

ISU provides granular, user-based access control. You can set permissions based on Workday roles, meaning users interact with the system under the ISU accounts. This makes the integration more personalized and trackable.

On the other hand, OAuth API clients can be customized to provide specific scopes of access, limiting what each application can do and reducing data exposure. This is especially valuable when only limited permissions are needed.

In addition, OAuth is a widely-accepted industry standard supported by many platforms. This makes integrations with other applications and ecosystems straightforward, especially for REST integrations. OAuth also provides a flexible, secure, and user-centered approach for Workday integrations, making it a great choice for applications where user-specific access or dynamic permissions are needed.

Craft an extensive go-to-market strategy alongside the build

Offering a customer-facing Workday integration is a significant milestone for your organization.

Many, if not most, of your customers will use the HRIS and will be interested in connecting their instance with your product. Moreover, the integration may prove critical in unblocking sales deals and moving prospects across the finish line.

With all of this in mind, you should align on how the integration will be priced, supported, marketed, demoed and more before the integration is live. That way, your team can hit the ground running as soon as it is.

Related: Our best resources for taking your integrations to market

Consider outsourcing your Workday integration

Building and maintaining your Workday integration in-house can prove difficult for countless reasons.

For one, the process of scoping, developing, and testing the integration will take your engineers months, and it'll force them to move away from other projects that are critical to your core product.

Your Workday integration will—like any other integration—also prove difficult to maintain. Something as simple as receiving a response in a different format than expected (e.g., a string versus an integer) could be all it takes to break your integration.

Forcing your engineers to keep up with and address any edge cases on time—like the situation above—can be extremely time intensive and a poor use of their time. 

A 3rd-party integration solution can neatly address these drawbacks and more (depending on the vendor), allowing your engineers to save countless hours over time, helping you integrate with Workday faster, and enabling you to provide a more reliable Workday integration.

Integrate all of your customers' HRIS solutions with your product via a single API

Merge not only lets you integrate with Workday; it also lets you connect to 70+ other HRIS solutions—all through its HRIS Unified API.

Merge also provides comprehensive Common Models and advanced features to sync custom data (e.g., Field Mapping), enabling you to sync all the employee data that’s relevant.

Finally, Merge provides integration observability features—from fully-searchable logs to automated issue detection functionality—to help your customer-facing teams identify, diagnose, and troubleshoot integration issues quickly and easily.

Learn more about using Merge to add HRIS integrations to your product by scheduling a demo with one of our integration experts.

Workday API integration FAQ

In case you have any more questions on Workday, we’ve answered several common questions below.

What is a Workday API integration?

It’s any API-based integration that lets you access and sync data from Workday. These integrations can be internal (between your instance of Workday and another application your organization uses) or customer-facing (between your product and customers’ instances of Workday).

What are the benefits of integrating with Workday’s API?

The benefits differ depending on whether you’re referring to internal or customer-facing Workday integrations.

For internal integrations, the benefits include time savings, fewer human errors, an improved employee experience, and productivity gains. Customer-facing integrations, on the other hand, enable you to improve your close rate, retention rate, and help you expand into new markets (upmarket, downmarket, regional expansion, etc.). 

How do you access a Workday sandbox account?

Workday customers may be able to access sandbox environments. 

However, integration service providers (ISPs) like Merge may need to enter into a formal business partnership before they can get one. 

Merge did just that. You can learn about our partnership with Workday and how it will allow us to improve our Workday integration over time here.

How do you authenticate to Workday’s API?

Workday lets you authenticate either through an Integration System User (ISU) or by using OAuth.

ISU might be easier to manage and can work well when the data that’s synced isn’t sensitive. But in most cases you’ll want to use OAuth; it enforces user-specific permissions and SSO, making it more secure and effective at helping you follow the principle of least privilege.

Does Workday offer an API?

Yes, Workday offers both SOAP and REST APIs. That said, Workday’s REST API is easier to use, more efficient, offers faster syncs, and covers a wide range of endpoints—from attachments to budgets to compensation to payroll—so it’ll likely meet your integration requirements more effectively.