Skip to main content

Integrating Workday with Atomicwork

Learn how to connect Workday to Atomicwork for automated leave and team management workflows.

R
Written by Riya Sebastian

The Workday integration connects your Atomicwork workspace to Workday's Human Capital Management (HCM) module. This integration focuses on Leave Management, such as leave balances and time off requests, and Staffing, which includes employee details.
​
You can also sync employee data from Workday with Atomicwork.

Prerequisites

Before you connect Workday to Atomicwork, prepare a dedicated Integration System User (ISU), create an integration security group, register an API client, and grant and activate the required domain permissions. You must have Security Administrator access in Workday, or equivalent permissions, to complete these setup tasks.

Field

Description

Client ID

The OAuth 2.0 Client ID from the Workday API Client registration

Client Secret

The OAuth 2.0 Client Secret from the Workday API Client registration

Tenant Name

The Workday tenant name (e.g., acme_impl1)

REST API Base URL

The base URL for Workday REST APIs (Look at the URL you use to access Workday. If your login URL is https://acme.workday.com, your REST API Base URL is likely https://acme-services1.workday.com)

Authorization Base URL

The base URL for Workday OAuth authorization (e.g., https://acme.workday.com)

Step 1: Create the Integration System User (ISU)

The ISU is the dedicated service account behind the integration. Workday API calls, including user sync and leave or staffing actions, run under this account. Using a dedicated ISU keeps the integration independent of any personal user account.

  1. In Workday, search for and open the Create Integration System User task.

  2. Enter a user name, such as ISU_Atomicwork.

  3. Set a strong password and store the credentials securely. You need these credentials during authorization.

  4. Set Session Timeout Minutes to 0.

  5. Leave Require New Password at Next Sign In unchecked.

  6. Leave Do Not Allow UI Sessions unchecked. The account must be able to sign in through the browser during authorization.

  7. Click OK.

Step 2: Create the Security Group and add the ISU

An ISU has no access on its own. Workday permissions are granted to a security group, and the ISU inherits those permissions by being a member of the group.

  1. In Workday, search for and open the Create Security Group task.

  2. Set Type of Tenanted Security Group to Integration System Security Group (Unconstrained). Unconstrained access is required so the integration can access all workers, not only workers in specific organizations.

  3. Enter a name, such as ISSG_Atomicwork, and click OK.

  4. On the next screen, add your ISU, such as ISU_Atomicwork, under Integration System Users.

  5. Click OK, then click Done.

Step 3: Register the API Client

Follow these steps in order to register an API client in Workday so Atomicwork can connect to your tenant. You'll need an account with administrator or integration security permissions for the Register API Client task to appear in Workday search.

  1. Open the API Client task. In Workday, search for and open the Register API Client task. This opens the Edit API Client screen where you'll enter everything below.

  2. Enter a Client Name. In the Client Name field, type `Atomicwork` (or any label you'll recognize later).

  3. Choose the grant type. In Client Grant Type, select Authorization Code Grant. This is the OAuth flow Atomicwork uses to connect.

  4. Set the access token type. In Access Token Type, select Bearer.

  5. Enter the Redirection URI. In the Redirection URI field, enter: https://esd.atomicwork.com/api/external-oauth/public/install

  6. Enter it exactly as shown — it must match Atomicwork's value precisely, or the connection will fail.

  7. Add the scopes for the capabilities you want. In Scope (Functional Areas), add scopes based on which Atomicwork capabilities you plan to use. You can start with what you need and add more later.

For user / employee sync, add:

Scope

Purpose

Staffing

Worker details and list workers

System

Required for WQL, which user sync uses to retrieve worker attributes

For common actions, add the scopes that match the actions you plan to use:

Capability

Scope to add

Apply for leave / request time off, including leave balances, eligible absence types, and valid time-off dates

Time Off and Leave

Update / read user details

Staffing

Add only the scopes for the features you intend to use. If a required scope is missing, the related capability will fail. To enable user sync, add both Staffing and System.

8. Enable the three required checkboxes. Check each of these boxes:

  • Non-Expiring Refresh Tokens — keeps the connection alive so it doesn't need re-authorizing later.

  • Grant Administrative Consent — approves the integration for the whole org so individual users aren't prompted.

  • Include Workday Owned Scope — required for the scopes in Step 6 to work fully.

9. Leave everything else at its default. Don't change any of the following — leave them unchecked or empty:

  • Support Proof Key for Code Exchange (PKCE) — unchecked

  • Allow User Delegation — unchecked

  • Enforce Customized Access Token Expiry — unchecked

  • Allow Integration Messages — unchecked

  • Disabled — unchecked (this switch turns the client off; leaving it off keeps the client active)

  • Locked Out due to Excessive Failed Signon Attempts — unchecked

  • Restricted to IP Ranges — empty

  • x509 Certificate — empty

  • Refresh Token Timeout (in days) — leave as `0`

10. Save. Click OK to save the API client. Workday will display the generated Client ID and Client Secret — copy the Client Secret now, as it is shown only once.

Step 4: Grant Domain Permissions and Activate

API client scopes control what the integration is allowed to request. Domain permissions are a separate Workday control that determines what data the ISU is allowed to read. Workday requires both, so grant the matching domain permissions to the security group you created.

  1. In Workday, search for and open the Maintain Permissions for Security Group task.

  2. Select your security group, such as ISSG_Atomicwork, set Operation to Maintain, and click OK.

  3. On the Domain Security Policy Permissions tab, add the domains for the capabilities you are using. Add one domain per row, then activate the changes at the end.

For user / employee sync, add these domains with Get access:

Domain

Access

Workday Query Language (enables WQL itself)

Get

Worker Data: Public Worker Reports

Get

Worker Data: Workers

Get

Worker Data: Current Staffing Information

Get

Person Data: Personal Data

Get

Person Data: Work Contact Information

Get

Person Data: Home Contact Information

Get

For other actions, such as leave, time-off, worker details, and similar actions, grant the tenant-specific domains those actions require. If an action is denied, the Workday error names the domain to add. You can also run View Security for Securable Item on the relevant web service to identify the exact domain an action needs.

  1. Click OK.

  2. Search for and open Activate Pending Security Policy Changes, enter a comment, tick Confirm, and click OK.

Permission changes remain inactive until activation is complete.

Step 5: Connect Workday in Atomicwork

Once your Workday environment is prepared, you can connect it to your workspace.

  1. Navigate to Settings > App store > Workday.

  2. Click Connect button.

  3. Enter your Client ID, Client Secret, Tenant Name, REST API Base URL, and Authorization Base URL.

  4. You are redirected to Workday's authorization page. Sign in with the username and password of the ISU you created in Step 1 — for example ISU_Atomicwork (or ISU_Atomicwork@<tenant> if prompted) — not a personal account, then grant consent. This binds the integration to the ISU so all API calls run under it.

  5. After granting consent, you are redirected back to Atomicwork, and the connection is established automatically.

The REST API Base URL, Authorization Base URL and Tenant Name all come from the endpoint rows near the bottom of the page. The page shows them like this:

Workday REST API Endpoint: https://wd2-impl services1.workday.com/ccx/api/v1/ibmsrv_pt1

Authorization Endpoint: https://impl.workday.com/ibmsrv_pt1/authorize`

Read the values off those rows:

In short: for both base URLs, keep only up to `.com` and delete everything after it (the struck-through part above). The tenant name is the short code repeated in those URLs.

Supported actions and modules

After connecting, the integration supports three configurable feature modules: Absence Management, Team Management, and Time Tracking. These modules enable the following actions in your workflows:

  • Get leave balances: Retrieves leave balances for a specific worker.

  • Get eligible leave types: Retrieves eligible absence types for a specific worker, filterable by category.

  • Apply for time off: Submits a time off request for a specific worker, supporting multiple dates.

  • Get worker details: Retrieves detailed information including job, location, and organization data.

  • Get valid time off dates: Validates which dates are valid for time off for a specific worker.

  • List workers: Retrieves a list of all workers with optional search and pagination.

  • Call API: Executes a generic API call to any Workday endpoint for custom operations.

Troubleshooting common issues

  • Worker not found: The worker ID is a Workday internal UUID, not the employee number. Use the List Workers action to find the correct UUID.

  • Leave type requires reason: Some leave types require a reason. Use the Get Eligible Leave Types action to check if a reason is required and provide the reason ID.

  • Position-based leave type: Some leave types require a position ID. Use the Get Leave Balances action to find the position ID associated with the worker.

  • Token expired: If the refresh token expires due to prolonged inactivity, you must reconnect the integration in Atomicwork.

Did this answer your question?