---
title: Workday Access Requirements - HR Cases
excerpt: ''
deprecated: false
hidden: false
metadata:
  title: ''
  description: ''
  robots: index
next:
  description: ''
---
# Setup Overview

You will need to provide the following to Moveworks.

* Integration System User (ISU) Credentials
  * Username
  * Password
* API Client for Integrations Credentials
  * Client ID
  * Client Secret
  * API Client Refresh Token for the ISU
* Enable OAuth 2.0 Clients Enabled
  * Edit Tenant Setup
* URLs
  * The following RaaS-Enabled Report URLs
    * Cases Retrieval
    * Case Type Details
  * Token Endpoint
  * Workday REST API Endpoint
  * End User URLs
    * Workday Help - Cases Page

👉 Provide provide ALL of the above to your Moveworks Customer Success team via encrypted email.

# Grant ISU Domain Security Permissions

Please create an Integration System User (ISU) and Integration System Security Group (ISSG).

## How to Create an ISU with Domain Security Permissions

### Create the ISU

1. Use the universal search to find the `Create Integration System User` (ISU) Workday Task.\
   ![](https://files.readme.io/ba33220-62ba12f-workday_universal_search.png)
2. Use the `Create Integration System User` (ISU) Workday Task to create a user following these settings. Write down the username and password that you use.\
   ![](https://files.readme.io/e1b1815-Untitled_-_2023-10-16T151651.126.png)
3. Validate that the ISU has these default permissions after creation.\
   ![](https://files.readme.io/5b51351-Untitled_1.png)

<br />

### Create an ISSG and add the ISU to it

1. Find the `Create Security Group` task.\
   ![](https://files.readme.io/d540e6b-3fac8e8-create_security_group_search.png)
2. Create an `Integration System Security Group (Unconstrained)` (ISSG). Title it "ISSG\_Moveworks" for best practices.\
   ![](https://files.readme.io/3024e38-Untitled_2.png)
3. Use the `All Workday Accounts` report to find the account again.\
   ![](https://files.readme.io/7c7a36a-1f6244d-wday_accounts.png)
4. Use the action menu to select `Assign Integration System Security Groups`.\
   ![](https://files.readme.io/e9dc997-Untitled_4.png)
5. Add the ISU to the ISSG.\
   ![](https://files.readme.io/dbad1c9-Untitled_5.png)

### Add Domain Security Policies to the ISSG

1. Navigate to the ISSG using the `View Security Group` Report.\
   ![](https://files.readme.io/aa54237-Untitled_6.png)
2. Use the menu item for Maintain Domain Permissions for Security Group.\
   ![](https://files.readme.io/bc40341-Untitled_7.png)
3. Add any permissions that are needed for your Moveworks bot. You can find the full list of permissions [here](/docs/workday-access-requirements#permissions).\
   ![](https://files.readme.io/e7f7014-permission_copying.png)
4. Activate your permissions with the `Activate Pending Security Policy Changes` task.\
   ![](https://files.readme.io/12e8659-Untitled_9.png)

## Permissions

<Table>
  <thead>
    <tr>
      <th>
        **Permission Type**
      </th>

      <th>
        **Permission/Domain Security Policy**
      </th>

      <th>
        Domain Security Policies Inheriting Permission
      </th>

      <th>
        **Business Justification**
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        View Only
      </td>

      <td>
        Custom Report Administration
      </td>

      <td>

      </td>

      <td>
        Needed to identify users, retrieve cases
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Manage: All Custom Reports
      </td>

      <td>

      </td>

      <td>
        Needed to identify users, retrieve cases
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Worker Data: Worker ID
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Worker Data: Public Worker Reports
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Security Administration
      </td>

      <td>
        External Account Provisioning  

        Lock Out Workday Accounts  

        Manage Authorized Applications  

        Provisioning Group Administration  

        Set Up: Security Rules  

        User-Based Security Group Administration  

        Workday Account Monitoring
      </td>

      <td>
        Needed to identify users, retrieve cases
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Workday Accounts
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        View and Modify
      </td>

      <td>
        Workday Query Language
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        View and Modify
      </td>

      <td>
        Custom Report Creation
      </td>

      <td>

      </td>

      <td>
        Needed to identify users, retrieve cases
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Worker Data: Active Employees
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Worker Data: Active Employees
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Person Data: Work Email
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Person Data: Work Email
      </td>

      <td>

      </td>

      <td>
        Needed to create cases of behalf of users
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Person Data: Work Address
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Person Data: Work Address
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Person Data: Work Contact Information
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Person Data: Work Contact Information
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Manage: Organization Roles
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Manage: Organization Roles
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get and Put
      </td>

      <td>
        Workday Query Language
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Worker Data: Public Worker Reports
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get and Put
      </td>

      <td>
        Help Case External Contacts
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        Get and Put
      </td>

      <td>
        Manage: Case Create on Behalf Of
      </td>

      <td>

      </td>

      <td>
        Needed to create a case
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Workday Accounts
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Worker Data: Worker ID
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Indexed Data Source: Workers
      </td>

      <td>

      </td>

      <td>
        Needed to identify users
      </td>
    </tr>

    <tr>
      <td>
        View and Modify
      </td>

      <td>
        Help Case Data
      </td>

      <td>
        Help Case Internal NotesHelp Case Messages
      </td>

      <td>
        Needed to retrieve case details, create case comments
      </td>
    </tr>

    <tr>
      <td>
        Get and Put
      </td>

      <td>
        Help Case Data
      </td>

      <td>
        Help Case Internal NotesHelp Case Messages
      </td>

      <td>
        Needed to retrieve case details, create case comments
      </td>
    </tr>

    <tr>
      <td>
        View and Modify
      </td>

      <td>
        Manage: Case Create on Behalf Of
      </td>

      <td>

      </td>

      <td>
        Needed to create a case
      </td>
    </tr>

    <tr>
      <td>
        View and Modify
      </td>

      <td>
        Process: Help Cases
      </td>

      <td>

      </td>

      <td>
        Needed to create a case, create case comments
      </td>
    </tr>

    <tr>
      <td>
        Get and Put
      </td>

      <td>
        Process: Help Cases
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Reports: Help Case Management
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Reports: Help Case Management
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Set Up: Help Case Management
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Set Up: Help Case Management
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        View: Confidential Help Cases
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        View: Confidential Help Cases
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Manage: Case Create About
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Manage: Case Create About
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Custom Report Administration
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Manage: All Custom Reports
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Custom Report Creation
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case details
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Reports: Questionnaires
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case type details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Reports: Questionnaires
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case type details
      </td>
    </tr>

    <tr>
      <td>
        View Only
      </td>

      <td>
        Question Library
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case type details
      </td>
    </tr>

    <tr>
      <td>
        Get Only
      </td>

      <td>
        Question Library
      </td>

      <td>

      </td>

      <td>
        Needed to retrieve case type details
      </td>
    </tr>
  </tbody>
</Table>

<br />

> 💡
>
> **Note**: The Modify and Put permissions are not necessarily required to identify users. The View and Get permissions should be enough for the use case. However, we might need to explore those permissions too if we fail to fetch users using just the View and Get permission types.

# Create API Client for Integrations

Please create an API Client for Integrations and provide the following function areas (scopes). Then create a refresh token for the ISU you created earlier.

## How to Create an API Client for Integrations

<br />

### Create API Client

1. Search for `Register API Client for Integrations`.\
   ![](https://files.readme.io/a9e9269-Untitled_10.png)
2. Set the name to **Moveworks** and add the scopes required. You can find the full list of scopes [here](/docs/workday-access-requirements#scopes).\
   ![](https://files.readme.io/6d10f24-registration.png)
3. Write down your **Client ID** and **Client Secret**.\
   ![](https://files.readme.io/0ba00e6-a5984da-client_secret.png)
4. Navigate to `View API Clients`. Write down the **Token Endpoint** and **Workday REST API Endpoint**.\
   ![](https://files.readme.io/7c83e62-tokenandapi.png)

### Provision a Refresh Token for the ISU

1. From the `View API Clients` view, click on the `API Clients for Integrations` tab. Click on the API Client you just created.\
   ![](https://files.readme.io/473d054-inspectclient.png)
2. From the related actions menu, select `Manage Refresh Tokens for Integrations`.\
   ![](https://files.readme.io/c122321-Untitled_14.png)
3. Add the ISU Account you created earlier to the API Client.\
   ![](https://files.readme.io/9c804a2-isu_to_client.png)
4. Select `Generate Refresh Token`.\
   ![](https://files.readme.io/00ce590-gen_refresh_token.png)
5. Write down your new refresh token.\
   ![](https://files.readme.io/c2d9060-9cd43d6-refresh_token.png)

## Enable OAuth 2.0 Clients Enabled

> 👍 Check the box for **OAuth 2.0 Clients Enabled**

> Access the Edit Teams Setup – Security task and select the checkbox for OAuth 2.0 Clients Enabled

> 📘 Follow the above step with the help of this screenshot and box in red

![](https://files.readme.io/7c6b067-image_20.png)

## Scopes

| **Functional Area (Scope)** | **Business Justification**                                                     |
| --------------------------- | ------------------------------------------------------------------------------ |
| Staffing                    | Needed to identify users                                                       |
| System                      | Needed to identify users, retrieve cases & run RaaS reports                    |
| Tenant Non-Configurable     | Needed to identify users & run RaaS reports                                    |
| Contact Information         | Needed to identify users                                                       |
| Public Data                 | Needed to identify users                                                       |
| Personal Data               | Needed to identify users                                                       |
| Organizations and Roles     | Needed to identify users                                                       |
| Help                        | Needed to create case, case comments and run Cases and Case Types RaaS reports |

# Create RaaS-Enabled Reports

Create each of the following reports into your Workday instance. Transfer ownership to our ISU, then share the JSON URL with your Moveworks Customer Success team.

## Case Retrieval Report

[Moveworks Cases Retrieval.xlsx](https://developer.moveworks.com/file-hosting/workday/Moveworks_Cases_Retrieval.xlsx)

### How it is used

We use this report to detect when new cases are created or previously created cases are updated in your Workday instance.

### Prompt Instructions

Please provide all the prompts (default and additional) as mentioned in the file above since they are crucial for the integration to function.

## Case Type Details Retrieval Report

[Moveworks Case Types Retrieval.xlsx](https://developer.moveworks.com/file-hosting/workday/Moveworks_Case_Types_Retrieval.xlsx)

> ❗️ Important!
>
> Please ensure your Workday instance has a description (`Case Type Description`) attached to each of your Case Types. If you don’t have a description field, please create descriptions for your Case Types. 
>
> This is important because both the title and the description of the Case Type are required by our Machine Learning models to determine the correct Case Type based on the query that the user has raised.

<br />

### How it is used

We use this report to get the list of Case Type and their details from your Workday instance.

### Prompt Instructions

Please provide all the prompts (default and additional) as mentioned in the file above since they are crucial for the integration to function.

## How to Create & Transfer a Workday Report

Repeat the steps below for EACH report you need to create, which are the Case Retrieval Report and the Case Type Details Report.

<br />

### Create the Report

1. Download the reports listed above by clicking on the files link under [Case Retrieval Report](/docs/workday-access-requirements-cases#case-retrieval-report) and [Case Type Details Retrieval Report](/docs/workday-access-requirements-cases#case-type-details-retrieval-report). 
2. Navigate to the `Create Custom Report` task.\
   ![](https://files.readme.io/02b18a3-d26ab55-create_custom_report.png)
3. Setup the initial report settings.\
   ![](https://files.readme.io/237f5d9a17c44a65337f9dee6e4a9ca2e9237c5bbe99e69ae94bc8154f0bd419-initreport.png)
4. Copy over the tabs for Columns, Filter, Prompts, Advanced EXACTLY as shown in the Excel template.\
   ![](https://files.readme.io/4f77ac150fd76de0f8ddddf356aa341c9c4b6c32ec46d205dd0cea4cb99784af-edit_raas.png)

> 🚧 Warning!
>
> Make sure to copy over all tabs EXACTLY. The naming and capitalization are both important.

<br />

### Authorize & share the report definition

1. Authorize the ISU you created earlier to run the report from the Share tab.\
   ![](https://files.readme.io/77984a4-authorizeISU.png)
2. On the Advanced tab, select the enable as a web service box to enable it for API consumption

   ![](https://files.readme.io/d272a130a5430c485a9b763edf89f0bb8320666634d2482905ce5f8f4f8affb7-Advanced.png)
3. Save the report.
4. From the related actions of the custom report, select `Web Service` -> `View URLs`:

   ![](https://files.readme.io/eea9b86df38f579a4d91e6ed4e630db8916efeff0cb4de57857fdb0476c3a476-viewurl.png)
5. Scroll down to `JSON` and right click on the hyperlink to select “Copy URL”. Share this URL with your Moveworks Customer Success team.\
   ![](https://files.readme.io/8b72c77-Untitled_20.png)

   ### (Optional) Transfer Ownership of the Report to the ISU

   We recommend doing this so that our ISU has access to report even if a member of your Workday Reports team leaves the company.

   1. Ensure that the ISU has the domain permissions needed to access the business objects referenced & through their data sources. If you need assistance with this, we recommend getting support from your Workday security team.
   2. Transfer the ownership using related actions on the report definition.\
      ![](https://files.readme.io/6682f56-IMG_9143.png)

   <br />