Skip to main content
Workday needs an OAuth API client in your organization’s Workday tenant before you can connect an account. Your organization supplies the client credentials; the person signing in supplies the Workday account that agents will use.
A Workday administrator needs access to Register API Client and View API Clients in your Workday tenant. An organization admin saves the OAuth credentials in Recursion. An organization developer or admin can then connect an account. A Workday developer account by itself does not replace access to your organization’s Workday tenant.

​
Register an API client in Workday

In your Workday tenant, search for Register API Client. Create a client with Authorization Code Grant and select Bearer as the access token type. Open Integrations → Add integration → Workday in Recursion and copy the exact Redirection URI shown in the setup form into Workday. The URI must match exactly, including its path. Under Scope (Functional Areas), select Tenant Non-Configurable and Public Data, then add the functional areas needed for the data and actions your agents will use. Common examples are Staffing for employee data, Organizations and Roles for organizational data, Contact Information for email and phone numbers, Time Off and Leave for absence data, and Time Tracking for timesheets. Payroll, compensation, and recruiting workflows need their corresponding functional areas. Select Include Workday Owned Scope. Your Workday administrator should also grant the signing-in account the security access required for the selected actions. Click OK, then save the Client ID and Client Secret while Workday displays them; the secret cannot be recovered from that page later. Search for View API Clients and record the Authorization Endpoint and Workday REST API Endpoint for this client. Also record the tenant identifier from your Workday URL. Use endpoints from the same tenant as the client you registered.

​
Save the credentials in Recursion

In the Recursion console, open Integrations → Add integration → Workday. The Workday OAuth setup form asks for: For example, if Workday shows https://impl-services1.wd12.myworkday.com/ccx/api/v1/acme_dpt1 as its REST API Endpoint, enter impl-services1.wd12.myworkday.com in the hostname field. The form also accepts the full HTTPS REST API Endpoint and extracts its hostname. Do not enter the Token Endpoint in either URL field. Click Save Workday credentials. Then choose the account label and allowed tools, click Add and sign in to Workday, and sign in with the Workday account whose access you want agents to use. Return to Integrations and click Test connection on the Workday account. After it succeeds, grant the active connection in an agent’s Integrations section and save a new agent version.

​
Update credentials or reconnect

To replace the OAuth client’s credentials, open the Workday account’s menu in Integrations and choose Update Workday OAuth credentials. Enter every field again, including the client secret. The secret is never shown after saving. Non-secret values may be filled from this browser’s last saved copy; check them against the current Workday client before saving. If authorization expires or the Workday account changes, use Reconnect on the connection and sign in again. Run Test connection after either change. If saving fails after the request reaches the integration provider, check whether the Workday credentials show as configured before trying again. A retry sends the settings to the provider and records another audit attempt. If Recursion says an update is already in progress, wait a few minutes for the update lease to expire, then retry.