Workday

Workday is an HRIS integration. Unlike other integrations, Trustle does not manage access inside Workday. Trustle reads worker records from Workday and uses them to keep your Trustle users and your Identity Provider accurate.

Trustle uses the Workday data for two things:

• Employee profile enrichment. Trustle fills in each user’s start date, department, and manager from their Workday worker record.
• Leaver detection. When Workday marks a worker as terminated, Trustle suspends that person’s account in your Identity Provider, so sign-in is locked as soon as HR records the termination.

Note

The integration is read-only. Workday does not allow technology partners to create, change, or delete anything.

Prerequisites

• For Workday: a Workday administrator who can create an Integration System User and register an API client.
• For Trustle: your Workday Tenant Host and Tenant Name.
• For Trustle: the Client ID, Client Secret, and Refresh Token created in the steps below.

Configure Workday

Create the Integration System User

Trustle authenticates as a dedicated Workday Integration System User (ISU) rather than as a person, so the connection keeps working when staff change roles.

1. Sign in to your Workday tenant as an administrator.
2. Search for and run the Create Integration System User task.
3. Enter the details for the new user.
   1. Give it a recognizable name, such as ISU_Trustle.
   2. Set a password and record it securely.
   3. Select Require New Password at Next Sign In = No.
   4. Set Session Timeout Minutes to 0 so the integration session does not expire.
4. Click OK.

Note

A dedicated ISU gives the integration its own audit trail in Workday, and lets you revoke Trustle’s access by disabling one account.

Create the Security Group and Grant Worker Data Access

The ISU has no access to data until you place it in a security group and grant that group permission to read worker records.

1. Create the security group.
   1. Search for and run the Create Security Group task.
   2. Choose type Integration System Security Group (Unconstrained).
   3. Name it something recognizable, such as ISSG_Trustle.
   4. Add the ISU created in the previous step as a member.
2. Grant the group access to worker data.
   1. Search for and run the Maintain Permissions for Security Group task.
   2. Select the security group from above.
   3. Grant Get (view) permission on the domains that expose worker data, including the Workday Query Language domain.
3. Activate the changes.
   1. Search for and run the Activate Pending Security Policy Changes task.
   2. Enter a comment and confirm.

Trustle reads exactly these worker fields, and nothing else:

• Worker ID and preferred name.
• Primary work email.
• Hire date.
• Active and Terminated flags.
• Primary supervisory organization name, used as the department.
• The primary supervisory organization manager’s work email.

Note

Trustle reads worker records through the Workday Query Language (WQL) API. Without access to the WQL domain and the worker data domains, the connection authenticates but returns no data. Ask your Workday administrator to confirm the exact domain security policies for your tenant — the required set depends on how your tenant’s security is configured.

Register the API Client for Integrations

This step creates the OAuth 2.0 credentials Trustle uses to authenticate.

1. Search for and run the Register API Client for Integrations task.
2. Complete the client details.
   1. Client Name: Trustle.
   2. Select Non-Expiring Refresh Tokens.
   3. Scope: select the functional areas that cover worker and staffing data.
3. Click OK.
4. Record the credentials Workday displays.
   1. Client ID.
   2. Client Secret.

Caution

Copy the Client Secret before you leave this screen. Workday shows it only once. If you lose it, you must generate a new one.

Generate the Refresh Token

The refresh token lets Trustle obtain short-lived access tokens without storing a Workday password.

1. Search for and run the View API Clients task.
2. Open the API Clients for Integrations tab and select the Trustle client.
3. Select Manage Refresh Tokens for Integrations.
4. Choose the ISU created in the first step as the Workday Account.
5. Select Generate New Refresh Token and click OK.
6. Record the refresh token that Workday displays.

Note

The refresh token must be non-expiring. Trustle cannot renew an expired token on its own, and the integration stops syncing when the token lapses.

Collect the Tenant Host and Tenant Name

Trustle builds its Workday API URLs from two values you can read out of the address bar while signed in to Workday.

1. Sign in to your Workday tenant and look at the browser address bar.
2. Record the Tenant Host — the hostname only, with no https:// and no path, for example wd2-impl-services1.workday.com.
3. Record the Tenant Name — your tenant identifier, for example acme_preview1.

If you are unsure of the tenant name, your Workday administrator can confirm it. It is the same value that appears in your Workday API endpoint URLs.

Connect in Trustle

1. Sign in to Trustle as an administrator.
2. Go to Connections and select Workday.
3. Complete the form.
   1. Connection Name: a name for this connection, for example Workday.
   2. Description: optional note.
   3. Tenant Host: from the previous section, hostname only.
   4. Tenant Name: from the previous section.
   5. Client ID: from the Register the API Client for Integrations step.
   6. Client Secret: from the Register the API Client for Integrations step.
   7. Refresh Token: from the Generate the Refresh Token step.
4. Click Connect. Trustle validates the credentials before it saves the connection. It requests an access token from Workday, then reads a single worker record. The connection is created only if both calls succeed. The Client Secret and Refresh Token are encrypted at rest.
5. Designate Workday as your HRIS connection.

Note

Employee profile enrichment stays off until Workday is set as your organization’s HRIS connection. An organization has one HRIS connection. Until you set it, Trustle still reads workers and still suspends leavers in your Identity Provider, but it does not write start date, department, or manager onto user records.

Verify

1. Click Connect and confirm Trustle reports success. Trustle creates the connection only after it requests an access token from Workday and reads a single worker record.
2. Set Workday as your HRIS connection, then check a user’s profile for a start date, department, and manager populated from Workday.
3. To confirm leaver detection, terminate a worker in Workday and confirm Trustle suspends the matching account in your Identity Provider.

Security notes

Note

• The integration is read-only. Trustle never creates, changes, or deletes anything in Workday, and Workday does not allow technology partners to do so.
• Trustle authenticates as a dedicated Integration System User (ISU), which gives the integration its own audit trail in Workday and lets you revoke access by disabling one account.
• The Client Secret and Refresh Token are encrypted at rest.
• Trustle reads only the worker fields listed under Create the Security Group and Grant Worker Data Access: worker ID, preferred name, work email, hire date, active and terminated status, department, and the department manager’s work email.