> ## Documentation Index
> Fetch the complete documentation index at: https://docs.labelbox.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Workday

> Register an OAuth API client in your Workday tenant, save its credentials in Recursion, and connect a Workday account.

Workday needs an OAuth API client in your organization's Workday tenant before you can connect an account. Your organization supplies the client credentials; the person signing in supplies the Workday account that agents will use.

> [!NOTE]
>
> A Workday administrator needs access to **Register API Client** and **View API Clients** in your Workday tenant. An organization admin saves the OAuth credentials in Recursion. An organization developer or admin can then connect an account. A Workday developer account by itself does not replace access to your organization's Workday tenant.

## Register an API client in Workday

In your Workday tenant, search for **Register API Client**. Create a client with **Authorization Code Grant** and select **Bearer** as the access token type. Open **Integrations → Add integration → Workday** in Recursion and copy the exact **Redirection URI** shown in the setup form into Workday. The URI must match exactly, including its path.

Under **Scope (Functional Areas)**, select **Tenant Non-Configurable** and **Public Data**, then add the functional areas needed for the data and actions your agents will use. Common examples are **Staffing** for employee data, **Organizations and Roles** for organizational data, **Contact Information** for email and phone numbers, **Time Off and Leave** for absence data, and **Time Tracking** for timesheets. Payroll, compensation, and recruiting workflows need their corresponding functional areas. Select **Include Workday Owned Scope**. Your Workday administrator should also grant the signing-in account the security access required for the selected actions. Click **OK**, then save the **Client ID** and **Client Secret** while Workday displays them; the secret cannot be recovered from that page later.

Search for **View API Clients** and record the **Authorization Endpoint** and **Workday REST API Endpoint** for this client. Also record the tenant identifier from your Workday URL. Use endpoints from the same tenant as the client you registered.

## Save the credentials in Recursion

In the Recursion console, open **Integrations → Add integration → Workday**. The Workday OAuth setup form asks for:

| Recursion field | Workday value |
| - | - |
| **Client ID** | The new API client's Client ID. |
| **Client secret** | The new API client's Client Secret. |
| **Tenant** | Your Workday tenant identifier, for example `acme_dpt1`. |
| **Authorization Endpoint** | The full URL from Workday, for example `https://impl.wd12.myworkday.com/acme_dpt1/authorize`. |
| **Workday REST API hostname** | Only the hostname from Workday's REST API Endpoint, for example `impl-services1.wd12.myworkday.com`. |

For example, if Workday shows `https://impl-services1.wd12.myworkday.com/ccx/api/v1/acme_dpt1` as its REST API Endpoint, enter `impl-services1.wd12.myworkday.com` in the hostname field. The form also accepts the full HTTPS REST API Endpoint and extracts its hostname. **Do not enter the Token Endpoint** in either URL field.

Click **Save Workday credentials**. Then choose the account label and allowed tools, click **Add and sign in to Workday**, and sign in with the Workday account whose access you want agents to use. Return to **Integrations** and click **Test connection** on the Workday account. After it succeeds, grant the active connection in an agent's **Integrations** section and save a new agent version.

## Update credentials or reconnect

To replace the OAuth client's credentials, open the Workday account's menu in **Integrations** and choose **Update Workday OAuth credentials**. Enter every field again, including the client secret. The secret is never shown after saving. Non-secret values may be filled from this browser's last saved copy; check them against the current Workday client before saving. If authorization expires or the Workday account changes, use **Reconnect** on the connection and sign in again. Run **Test connection** after either change.

If saving fails after the request reaches the integration provider, check whether the Workday credentials show as configured before trying again. A retry sends the settings to the provider and records another audit attempt. If Recursion says an update is already in progress, wait a few minutes for the update lease to expire, then retry.