Connecting Workday

Background

This article walks through the steps for connecting Workday to Lumos and helps you resolve common setup issues.

Required plan & roles

There's no minimum plan required to connect the Workday integration.

The specific permissions required by the Workday integration user account are outlined in further detail in the setup steps below.

Workday Steps

The section below walks through the steps you need to take in Workday to connect it to Lumos.

Stage 1: Create an Integration System User.

It's highly-recommended that you connect Workday to Lumos with an Integration System User. To create the user, follow the steps below:

1. Visit the Create Integration System User page in Workday (find it via the search bar)

2. Click the Create Integration System User button.

3. Enter a User Name (such as "Lumos-ISU") and create a strong password for the account, then click Ok.

Stage 2: Add the Integration System User to a Security Group.

Once you've created the ISU, you need to add it to a Security Group by following the steps below.

1. Visit the Create Security Group page in Workday (find it via the search bar)

2. Click the Create Security Group button.

3. In the Type of Tenanted Security Group dropdown, select “Integration System Security Group” and enter a name, such as "Lumos Security Group".

4. On the Edit Integration System Security Group (Unconstrained) page, enter the name of the ISU you created in Stage 1 above (e.g. “Lumos-ISU”), then click Ok.

Stage 3: Set Policy Permissions

1. Click into the Security Group you created in Stage 2 and select "Domain Security Policy Permissions".

2. Select the permissions in the table below.

3. Search for Activate Pending Security Policy Changes in the search bar and approve the changes you just proposed.

Stage 4: Create an API Client for the integration

Next, you'll create a Workday API Client to use in Lumos.

1. Visit the View API Clients page in Workday (find it via the search bar).

2. Click the Register API Client for Integration button and fill out the form that appears with the info from the table below.

3. Securely store the generated Client ID, Client Secret, Workday REST API Endpoint, Token Endpoint, and Authorization Endpoint.

4. Next, select Action > API Client > Manage Refresh Tokens for Integrations.

5. For the Workday Account, select the ISU user that you created in stage 1.

6. Generate a new Refresh Token and securely store the value.

Stage 5: Workday Public SOAP API Access

At this stage, you'll be determining where Lumos can make calls to your tenant over the internet.

1. Visit the Public Web Services page (find it via the search bar).

2. Open the Public Web Services Report.

3. Hover over Human Resources and click on the three dots menu.

4. Click Web Services > View WSDL.

5. Within the WSDL, there should be a URL with a format like https://{domain}/ccx/service/{tenant}/hcm
   . Securely store the domain and tenant value for later.

Lumos Steps

1. Click on the Workday card in your Lumos integrations (Reconnect or add new).

2. In the Connection section, enter the following values:

• Workday tenant name: The tenant name from Stage 5 above.

• Workday domain name: The domain name from Stage 5 above.

• Client ID: The client ID from Stage 4 above.

• Client Secret: The client secret from Stage 4 above.

• Refresh Token: The refresh token from Stage 4 above.

3. Click Connect Workday to connect the integration.

FAQ

What fields do you need from Workday's API?

We are ingesting the following fields from the Worker_Data payload in the Get_Workers operation.