---
title: Workday Access Requirements (Knowledge)
excerpt: ''
deprecated: false
hidden: false
metadata:
  title: ''
  description: ''
  robots: index
next:
  description: ''
---
As Moveworks has integrated with Workday Knowledge, we would need the following details to connect our services with your Workday instance. Our systems fetch the knowledge articles stored in your system and serve the user with relevant answers.

## Prerequisites

You will need to provide the following to Moveworks.

* Integration System User (ISU) Credentials
  * Username
  * Password
* API Client for Integrations Credentials
  * Client ID
  * Client Secret
  * API Client Refresh Token
* Enable OAuth 2.0 Clients Enabled
  * Edit Tenant Setup
* URLs
  * Token Endpoint
  * Workday REST API Endpoint

👉 Please provide ALL of the above to your Moveworks Implementation team via an encrypted email.

# Grant ISU Domain Security Permissions

Please create an Integration System User (ISU) and Integration System Security Group (ISSG).

## How to Create an ISU with Domain Security Permissions

### Create the ISU

1. Use the universal search to find the `Create Integration System User` (ISU) Workday Task.

   ![](https://files.readme.io/01ad08e-image_-_2024-04-08T113155.484.png)
2. Use the `Create Integration System User` (ISU) Workday Task to create a user following these settings. Write down the username and password that you use.

   ![](https://files.readme.io/f63f430-image_-_2024-04-08T113132.491.png)
3. Validate that the ISU has these default permissions after creation.

   ![](https://files.readme.io/c982468-image_-_2024-04-08T113114.923.png)

### Create an ISSG and add the ISU to it

1. Find the `Create Security Group` task.

   ![](https://files.readme.io/4129d15-image_-_2024-04-08T113055.985.png)
2. Create an `Integration System Security Group (Unconstrained)` (ISSG). Title it "ISSG\_Moveworks" for best practices.

   ![](https://files.readme.io/9737eb0-image_-_2024-04-08T113039.059.png)
3. Use the `All Workday Accounts` report to find the account again.

   ![](https://files.readme.io/5564827-image_-_2024-04-08T113022.449.png)
4. Use the action menu to select `Assign Integration System Security Groups`.

   ![](https://files.readme.io/4542fad-image_-_2024-04-08T113006.690.png)
5. Add the ISU to the ISSG.

   ![](https://files.readme.io/4ae14e9-image_-_2024-04-08T112944.590.png)

### Add Domain Security Policies to the ISSG

1. Navigate to the ISSG using the `View Security Group` Report.

   ![](https://files.readme.io/bb1a92b-image_-_2024-04-08T112925.174.png)
2. Use the menu item for Maintain Domain Permissions for Security Group.

   ![](https://files.readme.io/3640a9a-image_-_2024-04-08T112854.516.png)
3. Add any permissions that are needed for your Moveworks bot. You can find the full list of permissions [here](/docs/workday-access-requirements-knowledge#permissions).

   ![](https://files.readme.io/1b07504-image_-_2024-04-08T112804.372.png)
4. Activate your permissions with the Activate Pending Security Policy Changes task.

   ![](https://files.readme.io/027f1be-image_-_2024-04-08T112732.999.png)

### Permissions

| Permission Type | Permission            | Business Justification                      |
| --------------- | --------------------- | ------------------------------------------- |
| View Only       | Help Article REST API | To read Article content present in Workday  |
| Get Only        | Help Article REST API | To fetch Article data from Workday ReST API |

# Create API Client for Integrations

Please create an API Client for Integrations and provide the following function areas (scopes). Then create a refresh token for the ISU you created earlier.

## How to Create an API Client for Integrations

### Create API Client

1. Search for `Register API Client for Integrations`.

   ![](https://files.readme.io/95dd3c3-image_-_2024-04-08T112641.150.png)
2. Set the name to **Moveworks** and add the scopes required. You can find the full list of scopes [here](/docs/workday-access-requirements-knowledge#scopes).

   ![](https://files.readme.io/cc0ccec-Untitled_-_2024-04-08T112558.949.png)
3. Write down your **Client ID** and **Client Secret**.

   ![](https://files.readme.io/b451f97-Untitled_-_2024-04-08T112540.000.png)
4. Navigate to `View API Clients`. Write down the **Token Endpoint** and **Workday REST API Endpoint**.

   ![](https://files.readme.io/b655ce9-image_-_2024-04-08T112512.815.png)

### Provision a Refresh Token for the ISU

1. From the `View API Clients` view, click on the `API Clients for Integrations` tab. Click on the API Client you just created.

   ![](https://files.readme.io/422c0c6-image_-_2024-04-08T112448.314.png)
2. From the related actions menu, select `Manage Refresh Tokens for Integrations`.

   ![](https://files.readme.io/d10b1a9-image_-_2024-04-08T112433.792.png)
3. Add the ISU Account you created earlier to the API Client.

   ![](https://files.readme.io/4d57c90-image_-_2024-04-08T112423.645.png)
4. Select `Generate Refresh Token`.

   ![](https://files.readme.io/bad4d56-image_-_2024-04-08T112410.417.png)
5. Write down your new refresh token.

   ![](https://files.readme.io/15059b4-image_-_2024-04-08T112353.391.png)

## Enable OAuth 2.0 Clients Enabled

👍 **Check the box for OAuth 2.0 Clients Enabled**

> Access the Edit Teams Setup – Security task and select the checkbox for OAuth 2.0 Clients Enabled

📘 **Follow the above step with the help of this screenshot and box in red**

![](https://files.readme.io/6907572-image_-_2024-04-08T112336.565.png)

## Scopes

| Functional Area (Scope) | Business Justification             |
| ----------------------- | ---------------------------------- |
| Help                    | Needed to fetch knowledge articles |