Workday

Trustle reads workers from Workday: name, work email, hire date, employment status, department, and manager. It reads nothing else. This connection is read-only.

Caution

Workday support is partial. You cannot finish the setup on the Connections page yet: Test Connection fails, so Save Connection stays off. To connect Workday, do the steps in Configure Workday, then email support@trustle.com.

Prerequisites

• A Workday administrator who can create an integration system user, create security groups, and register API clients.
• For leaver suspension: an identity provider connected in Trustle that can suspend users, for example Okta. When Workday marks a worker as terminated, Trustle suspends the matching user there. Trustle cannot suspend users in Microsoft Entra ID.
• For leaver suspension: each user’s email in the identity provider must exactly match the worker’s primary work email in Workday.

Configure Workday

Step 1: Create an integration system user

Trustle signs in to Workday as this user, not as a person.

1. Sign in to Workday as an administrator.
2. Run the Create Integration System User task.
3. Enter a user name, for example ISU_Trustle.
4. Set a password. Set Require New Password at Next Sign In to No.
5. Set Session Timeout Minutes to 0.
6. Click OK.

Step 2: Create a security group

1. Run the Create Security Group task.
2. Select the type Integration System Security Group (Unconstrained).
3. Enter a name, for example ISSG_Trustle.
4. Add the user from Step 1 as a member.
5. Click OK.

Step 3: Grant permissions

1. Run the Maintain Permissions for Security Group task.

2. Select the security group from Step 2.

3. Add Get (view) access on the domains that hold the worker data below:

   Permission	Required	What Trustle does with it
   Get on the Workday Query Language domain	Yes	Runs the worker query. Without it, the query returns no data.
   Get on the worker domains: worker ID, preferred name, primary work email, hire date, active and terminated status	Yes	Imports workers and finds leavers.
   Get on the supervisory organization domains: organization name and manager work email	Yes	Fills in the department and the manager.

4. Run the Activate Pending Security Policy Changes task. Enter a comment and confirm.

Note

The domain names depend on how your tenant’s security is set up. Ask your Workday security administrator to confirm them.

Step 4: Register an API client

1. Run the Register API Client for Integrations task.
2. Enter the Client Name Trustle.
3. Select Non-Expiring Refresh Tokens.
4. In Scope, select the functional areas that hold worker and staffing data.
5. Click OK.
6. Copy the Client ID and the Client Secret.

Caution

Workday shows the client secret once. If you lose it, generate a new one.

Step 5: Generate a refresh token

1. Run the View API Clients task.
2. Select the API Clients for Integrations tab. Select the Trustle client.
3. Select Manage Refresh Tokens for Integrations.
4. In Workday Account, select the user from Step 1.
5. Select Generate New Refresh Token. Click OK.
6. Copy the refresh token.

Step 6: Collect the values for Trustle

1. Run the View API Clients task.
2. At the top of the page, find the Token Endpoint. It has the form https://<tenant-host>/ccx/oauth2/<tenant-name>/token.
3. Copy the host and the tenant name from this address. Do not copy them from the browser address bar. The API host can differ from the host you sign in to.

Trustle field	Where to find it in Workday	Example
Tenant Host	Token Endpoint, between https:// and /ccx. Host name only.	wd2-impl-services1.workday.com
Tenant Name	Token Endpoint, between /oauth2/ and /token	your_tenant
Client ID	Step 4	ODk3NjM…
Client Secret	Step 4	a1b2c3…
Refresh Token	Step 5	d4e5f6…

Connect in Trustle

1. In Trustle, go to Connections.
2. Under HRIS, find Workday and click Connect.
3. Enter a Connection Name, for example Workday. Description is optional.
4. Enter the values from Step 6.
5. Click Test Connection. Trustle gets an access token from Workday and reads one worker.
6. After the test passes, click Save Connection.

Note

Trustle copies the start date, department, and manager from Workday to each Trustle user only when Workday is your organization’s HRIS connection. You cannot set this in the Trustle app. Ask Trustle support to set it. Leaver suspension works without it.

Verify

1. On the Connections page, open the Workday connection.
2. Wait for the first sync to finish.
3. Check that the worker count matches the number of workers in Workday.
4. If Workday is your HRIS connection, open a user in Trustle. Check that the start date, department, and manager match Workday.

If something is missing, see Troubleshooting.

Caution

Trustle suspends each terminated worker on every sync. If you enable a former worker again in the identity provider, for example after a rehire, Trustle suspends the user again on the next sync. This continues until Workday no longer reports the worker as terminated.

Security notes

Note

• Trustle never changes anything in Workday.
• Use a dedicated integration system user for Trustle only. It gives Trustle its own audit trail in Workday. To stop Trustle’s access, disable this user or the API client.
• Trustle encrypts the client secret and the refresh token at rest.
• Store the client secret and the refresh token in a secret manager. Never commit them to a repository.
• The refresh token does not expire. Generate a new one if it leaks, then paste it into the Trustle connection.

Troubleshooting

Test Connection fails

Setup on the Connections page is not available yet. Email support@trustle.com to connect Workday.

After Trustle ships Workday support, check these values:

• Tenant Host: the host from the Token Endpoint, without https:// or a path.
• Tenant Name: the name from the Token Endpoint.
• Client ID, Client Secret, and Refresh Token: the refresh token must belong to the same API client and to the user from Step 1.
• Permissions: the security group needs Get on the Workday Query Language domain. Activate the security policy changes after each change.

A terminated worker is not suspended in the identity provider

• The identity provider must support suspension. Trustle cannot suspend users in Microsoft Entra ID.
• The user’s email in the identity provider must exactly match the worker’s primary work email in Workday.

Start date, department, or manager is empty

• Workday must be your organization’s HRIS connection. Ask Trustle support to set it.
• The security group needs Get on the supervisory organization domains. See Step 3.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the Tenant Name. Never send a secret, key, or token.