Overview

Workday is an HRIS integration. Unlike the other integrations in this guide, Trustle does not manage access inside Workday — it reads worker records from Workday and uses them to keep your Trustle users and your Identity Provider accurate.

‍

Trustle uses the Workday data for two things:

• Employee profile enrichment — Trustle fills in each user's start date, department, and manager from their Workday worker record.
• Leaver detection — when Workday marks a worker as terminated, Trustle suspends that person's account in your Identity Provider, so sign-in is locked as soon as HR records the termination.

‍

The integration is read-only. Workday does not allow technology partners to create, change, or delete anything

‍

What you'll need:

‍

• For Workday: a Workday administrator who can create an Integration System User and register an API client
• For Trustle: your Workday Tenant Host and Tenant Name
• For Trustle: the Client ID, Client Secret, and Refresh Token created in the steps below

‍

Step 1: Create the Integration System User

Trustle authenticates as a dedicated Workday Integration System User (ISU) rather than as a person, so the connection keeps working when staff change roles.

‍

Instructions:

1. Sign in to your Workday tenant as an administrator
2. Search for and run the Create Integration System User task
3. Enter the details for the new user
   
   1. Give it a recognizable name, such as ISU_Trustle
   2. Set a password and record it securely
   3. Select Require New Password at Next Sign In = No
   4. Set Session Timeout Minutes to 0 so the integration session does not expire
4. Click OK

‍

Why Trustle needs this: a dedicated ISU gives the integration its own audit trail in Workday, and lets you revoke Trustle's access by disabling one account.

‍

Step 2: Create the Security Group and Grant Worker Data Access

The ISU has no access to data until you place it in a security group and grant that group permission to read worker records.

Instructions:

‍

1. Create the security group
   
   1. Search for and run the Create Security Group task
   2. Choose type Integration System Security Group (Unconstrained)
   3. Name it something recognizable, such as ISSG_Trustle
   4. Add the ISU created in Step 1 as a member
2. Grant the group access to worker data
   
   1. Search for and run the Maintain Permissions for Security Group task
   2. Select the security group from above
   3. Grant Get (view) permission on the domains that expose worker data, including the Workday Query Language domain
3. Activate the changes
   
   1. Search for and run the Activate Pending Security Policy Changes task
   2. Enter a comment and confirm

‍

Trustle reads exactly these worker fields, and nothing else:

‍

• Worker ID and preferred name
• Primary work email
• Hire date
• Active and Terminated flags
• Primary supervisory organization name, used as the department
• The primary supervisory organization manager's work email

‍

Why Trustle needs this: Trustle reads worker records through the Workday Query Language (WQL) API. Without access to the WQL domain and the worker data domains, the connection authenticates but returns no data. Ask your Workday administrator to confirm the exact domain security policies for your tenant — the required set depends on how your tenant's security is configured.

‍

Step 3: Register the API Client for Integrations

This step creates the OAuth 2.0 credentials Trustle uses to authenticate.

‍

Instructions:

‍

1. Search for and run the Register API Client for Integrations task
2. Complete the client details
3. Client Name: Trustle
4. Non-Expiring Refresh Tokens: selected
5. Scope: select the functional areas that cover worker and staffing data
6. Click OK
7. Record the credentials Workday displays
8. Client ID
9. Client Secret

‍

Copy the Client Secret before you leave this screen. Workday shows it only once. If you lose it, you must generate a new one.

‍

Step 4: Generate the Refresh Token

‍

The refresh token lets Trustle obtain short-lived access tokens without storing a Workday password

‍

Instructions:

‍

1. Search for and run the View API Clients task
2. Open the API Clients for Integrations tab and select the Trustle client
3. Select Manage Refresh Tokens for Integrations
4. Choose the ISU created in Step 1 as the Workday Account
5. Select Generate New Refresh Token and click OK
6. Record the refresh token that Workday displays

‍

Why Trustle needs this: the refresh token must be non-expiring. Trustle cannot renew an expired token on its own, and the integration stops syncing when the token lapses.

‍

Step 5: Collect the Tenant Host and Tenant Name

Trustle builds its Workday API URLs from two values you can read out of the address bar while signed in to Workday.

‍

Instructions:

‍

1. Sign in to your Workday tenant and look at the browser address bar
2. Record the Tenant Host — the hostname only, with no https:// and no path, for example wd2-impl-services1.workday.com
3. Record the Tenant Name — your tenant identifier, for example acme_preview1

‍

If you are unsure of the tenant name, your Workday administrator can confirm it. It is the same value that appears in your Workday API endpoint URLs.

Step 6: Set up the Workday Integration in Trustle

Instructions:

‍

1. Sign in to Trustle as an administrator
2. Go to Connections and select Workday
3. Complete the form
   
   • Connection Name: A name for this connection, for example Workday
   • Description: Optional note
   • Tenant Host: From Step 5, hostname only
   • Tenant Name: From Step 5
   • Client ID: From Step 3
   • Client Secret: From Step 3
   • Refresh Token: From Step 4
4. Click Connect
   
   • Trustle validates the credentials before it saves the connection. It requests an access token from Workday, then reads a single worker record. The connection is created only if both calls succeed. The Client Secret and Refresh Token are encrypted at rest.
5. Designate Workday as your HRIS connection

‍

Employee profile enrichment stays off until Workday is set as your organization's HRIS connection. An organization has one HRIS connection. Until you set it, Trustle still reads workers and still suspends leavers in your Identity Provider, but it does not write start date, department, or manager onto user records.