{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-agen-for-work/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["Notification"]},"type":"markdown"},"seo":{"title":"Workday integration","siteUrl":"https://developers.frontegg.com/","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"workday-integration","__idx":0},"children":["Workday integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Workday is a cloud-based enterprise platform for human capital management (HCM), payroll, and financials. The Workday integration with Frontegg lets your application read worker data, supervisory organizations, job profiles, locations, and time off and leave information from your Workday tenant on behalf of your users through the Workday REST API."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Workday hosts its OAuth and REST endpoints per tenant, on a datacenter-specific host. Because of this, the integration needs four values: your OAuth ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},", your Workday ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["host"]},", and your Workday ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["tenant"]}," name."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Prerequisites","type":"attention"},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A Workday tenant (implementation or production) and the security permissions required to run the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register API Client"]}," task — typically the Integration System Administrator or Security Administrator role."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access to a Frontegg account so you can retrieve your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Redirect URL"]}," (see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/agen-for-work/connectors/redirect-url"},"children":["How to get your Redirect URL"]},")."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"connect-workday","__idx":1},"children":["Connect Workday"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Workday registers an OAuth client through a single task. The steps below walk through that task and the values you need to collect from it."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-1-open-the-register-api-client-task","__idx":2},"children":["Step 1: Open the Register API Client task"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sign in to your Workday tenant. In the search box at the top, type ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Register API Client"]}," and select the task named ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register API Client"]}," (not ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["Register API Client for Integrations"]}," and not ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["Register External OAuth Client"]}," — those are for different grant types)."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-2-configure-the-api-client","__idx":3},"children":["Step 2: Configure the API client"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Register API Client"]}," form, fill in the core settings:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Name"]},": enter an identifiable name, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Frontegg Integration"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Grant Type"]},": select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization Code Grant"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access Token Type"]},": select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Bearer"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Non-Expiring Refresh Tokens"]},": enable this option. Frontegg requests offline access so it can refresh the access token without prompting the user to sign in again."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-3-enter-the-redirect-url","__idx":4},"children":["Step 3: Enter the redirect URL"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Redirection URI"]}," field, enter your Frontegg Redirect URL:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://YOUR_MCP_GATEWAY_URL/integration-callback"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The redirect URL must match exactly what Frontegg sends during the OAuth flow, including the scheme and path. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/agen-for-work/connectors/redirect-url"},"children":["How to get your Redirect URL"]}," for how to obtain ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["YOUR_MCP_GATEWAY_URL"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-4-select-the-functional-area-scopes","__idx":5},"children":["Step 4: Select the functional area scopes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Scope (Functional Areas)"]}," field, add the functional areas that cover the data the integration reads. Each Workday functional area maps to a group of REST resources."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Scope (functional area)"},"children":["Scope (functional area)"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Grants access to"},"children":["Grants access to"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Worker Data"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Worker records and worker details"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Staffing"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Job profiles, locations, and staffing data"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Organizations and Roles"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Supervisory organizations and worker organization memberships"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Time Off and Leave"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Time off requests, time off balances, absence types, and leave types"]}]}]}]}]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Take only what you need","type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Following the principle of least privilege, add only the functional areas your integration actually uses. The exact functional-area names available in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Scope"]}," field depend on your tenant's configuration — if a name above is not listed verbatim, choose the closest matching area that covers the same domain (Human Resources / Absence). You can adjust the scope assignments later by editing the API client."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-5-register-and-copy-your-credentials","__idx":6},"children":["Step 5: Register and copy your credentials"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OK"]}," to register the client. Workday displays the generated credentials, including the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},", along with the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token Endpoint"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization Endpoint"]},", and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["REST API Endpoint"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]}," and store them securely now. The Client Secret is shown only once — if you navigate away before copying it, you will have to generate a new secret."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"step-6-find-your-workday-host-and-tenant","__idx":7},"children":["Step 6: Find your Workday host and tenant"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["host"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["tenant"]}," are both contained in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["REST API Endpoint"]}," shown on the credentials screen (you can also find it later by running the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["View API Clients"]}," task). The endpoint looks like this:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"https://wd2-impl-services1.workday.com/ccx/api/v1/acme\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["From this URL:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Host"]}," is the domain — ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["wd2-impl-services1.workday.com"]}," (your value may differ, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["wd5-services1.myworkday.com"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tenant"]}," is the path segment after the API version — ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme"]}," in the example above."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keep both values handy for the Frontegg portal."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configure-the-frontegg-portal","__idx":8},"children":["Configure the Frontegg portal"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once you have your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["host"]},", and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["tenant"]},", enter them in the integration configuration page of the Frontegg portal:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Frontegg portal"]}," and navigate to [ENVIRONMENT] → Integrations → Workday."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enter the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]}," in the corresponding fields."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enter your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workday host"]}," (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["wd2-impl-services1.workday.com"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enter your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Workday tenant"]}," (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["acme"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the required ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["scopes"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},"."]}]},{"$$mdtype":"Tag","name":"Notification","attributes":{"title":"Keep your credentials secure","type":"attention"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Never share or commit your Client Secret to version control."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"additional-resources","__idx":9},"children":["Additional resources"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://community.workday.com/sites/default/files/file-hosting/restapi/index.html"},"children":["Workday REST API documentation"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://doc.workday.com/admin-guide/en-us/authentication-and-security/oauth/dan1370797527096.html"},"children":["Workday OAuth 2.0 and API client registration"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"/agen-for-work/connectors/redirect-url"},"children":["How to get your Redirect URL"]}]}]}]}]},"headings":[{"value":"Workday integration","id":"workday-integration","depth":2},{"value":"Connect Workday","id":"connect-workday","depth":3},{"value":"Step 1: Open the Register API Client task","id":"step-1-open-the-register-api-client-task","depth":4},{"value":"Step 2: Configure the API client","id":"step-2-configure-the-api-client","depth":4},{"value":"Step 3: Enter the redirect URL","id":"step-3-enter-the-redirect-url","depth":4},{"value":"Step 4: Select the functional area scopes","id":"step-4-select-the-functional-area-scopes","depth":4},{"value":"Step 5: Register and copy your credentials","id":"step-5-register-and-copy-your-credentials","depth":4},{"value":"Step 6: Find your Workday host and tenant","id":"step-6-find-your-workday-host-and-tenant","depth":4},{"value":"Configure the Frontegg portal","id":"configure-the-frontegg-portal","depth":3},{"value":"Additional resources","id":"additional-resources","depth":3}],"frontmatter":{"category":"HR","displayName":"Workday","seo":{"title":"Workday integration"}},"lastModified":"2026-06-10T05:29:28.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/agen-for-work/connectors/marketplace/workday","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}