Workday Guide

Setting up the Workday Integration

To access your users' data from Workday, you need to enable the Workday integration in the Platforms Page of the Rutter dashboard.

Workday does not require any developer app setup on your side. Workday does not expose its OAuth flow as a wizard, so a Workday administrator has to perform a one-time setup inside the tenant and then paste the resulting values into Rutter Link. Once complete, the refresh token never expires and this setup does not need to be repeated for the tenant.

User Authentication with Workday

A Rutter Connection is created when your end user authenticates their Workday tenant via Rutter Link. This in turn allows you to access their account data via the Rutter API.

Step 1: Create an Integration System User (ISU) and Security Group.

We recommend a dedicated Integration System User and Integration System Security Group rather than re-using an admin account, so Rutter's access is auditable and unaffected by password rotations or MFA on a human account.

Run the Create Integration System User task. Set Session Timeout Minutes to 0 so the session never expires, and optionally tick Do Not Allow UI Sessions to block human UI login.
Run Maintain Password Rules and add the new ISU to the System Users exempt from password expiration list.
Run Create Security Group, choose type Integration System Security Group (Unconstrained), name it (for example, "Rutter Integration ISSG"), and add the ISU from the first task as a member.

Step 2: Register the API Client for Integrations.

Run the Register API Client for Integrations task.

Set Client Name to "Rutter Integration" (or similar).
Tick Non-Expiring Refresh Tokens and Include Workday Owned Scope.
Under Scope (Functional Areas), add: Accounting Center, Customer Accounts, Financial Accounting, Public Data, Suppliers, System, Tenant Non-Configurable. Add Banking and Settlement if you plan to use Rutter's bank feeds, and Staffing for HR data.
Click OK, then Done.
Copy the Client ID and Client Secret from the confirmation screen immediately.

Note: The Client Secret is shown only once. If it is lost, regenerate it via Related Actions → Generate New Client Secret.

Step 3: Grant the security group read access on the required domains.

Run Maintain Permissions for Security Group, pick the security group from Step 1, and grant Get access on:

Workday Query Language (required for WQL reads)
Reports: Customer
Process: Customer Invoice (NEW)
Set Up: Customer Categories
Set Up: Revenue Categories
Set Up: Spend Categories
Set Up: Supplier Categories
Process: Journals (NEW)
Set Up: Accounts
Reports: Supplier
Manage: Organization Integration
Set Up: Sale Item
Set Up: Purchase Item
Set Up: Bank Entity
Process: Purchase Order - View
Process: Supplier Invoice
Set Up: Project Tracking
Set Up: Tax
Process: Customer Invoice Payment
Process: Credit Card
Process: Credit Card Files

For employee reads, make sure the API Client has the Staffing scope from Step 2 and grant Get Only on Worker Data: Public Worker Reports and Worker Data: Current Staffing Information. For bank feeds, also grant Get + Put on Process: Bank Reconciliation and Process: Intraday Bank Statements.

Then run Activate Pending Security Policy Changes and commit. Permissions do not take effect until activated.

Step 4: Grant write access (optional).

Skip this step if you only need read access. Otherwise, in Maintain Permissions for Security Group, also grant Put access on the accounting domains listed in Step 3 to the security group (not the employee Get Only domains). Then, for each Rutter entity you want to write, run Edit Business Process Security Policy, pick the Business Process Type listed below, and add the security group to the Initiating Action shown next to it:

Entity	Business Process Type	Initiating Action
Invoices	Customer Invoice Event	Submit Customer Invoice (Web Service)
Purchase Orders	Purchase Order Event	Submit Purchase Order (Web Service)
Suppliers	Supplier Event	Submit Supplier (Web Service)
Customers	Customer Event	Submit Customer (Web Service)
Bills	Supplier Invoice Event	Submit Supplier Invoice (Web Service)
Projects	Create Project	Submit Project (Web Service)

Also grant the security group access to these security policies: Integration Build, Integration Process, Integration Debug, Integration Event. Finally, run Activate Pending Security Policy Changes and commit.

Note: Write calls fail with a 403 until activation completes.

Step 5: Generate a non-expiring Refresh Token.

Run View API Clients, open the API Clients for Integrations tab, and click the client you registered in Step 2.
On the detail page, open the Related Actions menu next to the client name, then API Client → Manage Refresh Tokens for Integrations.
Set Workday Account to the ISU from Step 1 (this account's permissions determine what the token can read), then click OK.
On the next page, tick Generate New Refresh Token and click OK.
Copy the Refresh Token from the confirmation screen.

Note: Workday shows the Refresh Token only on the confirmation screen. If it is lost, repeat this step, which invalidates any previously issued token.

Step 6: Locate the Tenant Host and Tenant Name.

Run View API Clients again. At the top of the report there are three URLs. The Token Endpoint has the form https://{tenantHost}/ccx/oauth2/{tenantName}/token. For example, given https://impl-services1.wd12.myworkday.com/ccx/oauth2/rutter_dpt1/token, the Tenant Host is impl-services1.wd12.myworkday.com and the Tenant Name is rutter_dpt1.

Step 7: Enter the values into Rutter Link.

Paste the Client ID, Client Secret, Refresh Token, Workday Host (no protocol, no path) and Workday Tenant Name into Rutter Link.

Reference

See the supported endpoints for Workday.