Setting Up Your Workday Integration (Advanced)

In order to setup your Workday Integration, you will need to follow these steps:

1. Generate Integration Credentials in Workday

The steps below will walk you through the process necessary to successfully complete your Workday integration.

Step 1: Generate Integration Credentials in Workday

Step 1-A: ISU Username and ISU Password

Log in to Workday and type in Create Integration System User in the search bar. Then, click the Create Integration System User task.

Fill in the Account Information as follows:

• User Name: RippleMatch_ISU

• New Password: create a password of your choosing

  • Note: choose a password that you wouldn't mind potentially sharing with the RippleMatch team

• Session Timeout Minutes: 0

Click OK. Click Done. Save the ISU Username and Password for a future step. Next, user the search bar to locate the Maintain Password Rules task and click into it.

Scroll down to the Session Timeout section of this task and add the ISU Username created in the last step to the System Users Exempt from Password Expiration field.

You should now see the new ISU Username appear in the box of other ISUs. Click OK. Click Done.

Please be sure to check if you have an Authentication Policy in place which could deny inbound connections. If so, you will need to exempt this newly created ISU Username.

Step 1-B: Integration System Security Group (ISSG)

Next, use the search bar to locate the Create Security Group task and click into it.

Then, fill in the Create Security Group form as follows:

• Type of Tenanted Security Group: Integration Systems Security Group (Unconstrained)

• Name: RippleMatchISSG

Click OK. Then, under the Integration Systems Users section, search and select the ISU Username created in Step 1-A.

Click OK, and then Done. Save this ISSG for a future step.

Step 1-C: Domain Access

Using the search bar, look for Maintain Permissions for Security Group and click into it.

In the Source Security Group field, search and select the ISSG created in step 1-B and click OK.

Then, reference the below table to add all of the necessary permissions listed in column Domain Security Policy. Please reference column Operation to determine whether the Domain is a Get and/or Put.

Click OK. Click Done.

Repeat the sub-steps under Step 1-C for all of the below domains:

Once you have completed Step 1-C for all of the above domains, head over Activate Pending Security Policy Changes to publish the change.

Step 1-D: Tenant ID

Navigate back to the homepage by clicking on the Workday icon on the top-left of the screen. You will find your Tenant ID in the URL, which will look like a series of letters and numbers that immediately follow .com.

For example, if your URL is https://impl.workday.com/example/d/home.html, then your Tenant ID would be 'example'. Save this Tenant ID for a future step.

Step 1-E: Recruiting WSDL URL and Integrations WSDL URL

Using the search bar, locate the Public Web Services report and click into it.

From here, locate the Recruiting (Public) web service listed and then click the ellipsis icon near the words Recruiting (Public) to reveal a drop-down menu.

Select Web Service > View WSDL, which displays the full WSDL in a separate window.

Scroll to the very bottom of that page to find the Recruiting WSDL URL.

The Recruiting WSDL URL is the part of this line that reads https://wd2-impl-services1.workday.com/ccx/service/bnb_dpt1/Recruiting/v37.0. If you're unfamiliar with the WDSL, you can use Command + F to search the doc for "soapbind:address" which should locate the Recruiting WSDL URL for you. Save this Recruiting WSDL URL for a future step.

Using the search bar, locate the Public Web Services report again and click into it. From here, locate the Integrations (Public) web service listed and then click the ellipsis icon near the words Integrations (Public) to reveal a drop-down menu.

Select Web Service > View WSDL, which displays the full WSDL in a separate window.

Scroll to the bottom of that page to find the Integrations WSDL URL.

Save this Integrations WSDL URL for a future step.

Step 1-F: Applicant Source ID

Using the search bar, locate the Maintain Recruiting Sources task and click into it.

Add a new source for RippleMatch by clicking the + button in the top left-hand corner.

In the Recruiting Source Category Name field, add in a title that feels most relevant to you. We used External.

Next, click the + sign to the right of the Name field. Then, enter RippleMatch in the Source field.

Click OK. Click Done.

Using the search bar, locate the Integrations IDs report and click into it.

Type Applicant Source into the Business Object field. Select Applicant Source and click OK.

Then find the new Applicant Source titled RippleMatch that you just created. In the far right column you'll see a Reference ID that is written in this format: Applicant_Source_ID.

Save this Applicant Source ID for a future step.

Generating REST credentials allows you to create a custom report and expose it as a web service via Workday's Report as a Service (RaaS) interface. This is necessary to enable and display both questions and answers to applications. To provision REST to access Workday custom reports, the following are required credentials:

• Client ID

• Client Secret

• Refresh Token

• Custom Report URL (Web Services Enabled)

• Additionally, OAuth must be enabled for these credentials.

Step 3-A: Copy the Client ID and Client Secret

The client ID and client secret are needed to provision REST to access Workday custom reports. (45 seconds)

Log in to the Workday tenant. In the Search field, type Register api client for integrations.

Select the Register API Client for Integrations task.

On the Register API client for Integrations page, in the Client Name field, enter the client name as “RippleMatch”.

Select the Non-Expiring Refresh Tokens option.

In the Scope (Functional Areas) field, select Tenant Non-Configurable under the list of Custom Objects.

Click OK.

The Client ID and Client Secret are displayed - Copy the Client Secret and Client ID.

Click Done.

Step 3-B: Generate a non-expiring refresh token

The non-expiring refresh token is needed to provision REST to access Workday custom reports. (1 minute)

Log in to Workday. In the Search field, type View API clients.

Select the View API Clients task.

On the View API Clients page, click the API Clients for Integrations tab.

Click the client you created.

Click the three dots next to the client name in the top left, and then click API Client > Manage Refresh Tokens for Integrations.

On the Manage Refresh Tokens for Integrations page, in the Workday Account field, enter the Workday account of a user with access to the custom report.
​
Set up the user as a service account instead of an actual Workday user to prevent permissions from being removed from the account due to a user change.

Click OK.

On the Delete or Regenerate Refresh Token page, select the Generate New Refresh Token option.

Click OK.

On the Successfully Regenerated Refresh Token Page, copy the refresh token.

Click Done.

Step 4: Create Custom Report

Search “Create Custom Report”

On the create report screen enter the following information:

• Report Name: RippleMatch Custom Questions (this can be anything)

• Report Type: Advanced

• Enabled as a Web Service: True (this checkbox only shows for Advanced report types)

• Data Source: Questionnaire Answers

  • NOTE: you can only access the Questionnaire Answers object when “Optimized for Performance” is disabled

Once you are in the report builder, add the following columns:

• NOTE: The order of the fields in the report is not critical, but the values in the “Column Heading Override XML Alias” are required to be exactly the same as below for the integration to function as expected. (Values are case sensitive)

Then under the Group Column Headings section below, add in the Business Objects selected in the above table:

• Questionnaire

• Question

• Question Item

• Questionnaire Answer

• Question Multiple Choice Answer

NOTE: The Group Column Heading XML Alias column does not need to be modified in the Group Column Headings table.

Next, select the Prompts tab and select “Populate Undefined Prompt Defaults”.

Then, press “OK” at the bottom of the page.

Once the report is created, you will be able to assign a specific questionnaire to the report and create a web service enabled url to serve the data. To do this

• Go to the 3 dot menu next to the Report Name

• Go to the bottom and select “Web Service”

• Click “View URLs”

   

  

Once you are on the “View URLs Web Service” modal, select the Questionnaire that is associated with roles in RippleMatch

• Recommended: For “Response Created on or After”, input a date within the past few weeks that is no more than 50k rows of data.

Once you select “OK” you will see a page with several different URLs. Scroll down toward the bottom of the page and copy the link labeled “JSON”. This link can be provided in the integration configuration settings in RippleMatch, or provided to the RippleMatch solutions team.

Step 4: Gathering Your Job IDs

While you're in Workday, navigate to one of your active roles and copy and save the Job ID, which will be found in the following format: R-#####.

Repeat Step 4 for each of your active roles. Save all of the Job IDs for a future step.

Step 5: Integrate with RippleMatch

Once the above steps have been completed, please reach out to your RippleMatch Solutions Architect to provide the below information. This information can be securely shared with RippleMatch using Doppler.

1. ISU Username & Password
2. Integrations & Recruiting WSDL
3. Tenant ID 
4. Applicant Source ID 
5. REST API Client ID
6. REST API Client Name
7. REST API Client Secret
8. REST API Refresh Token
9. Custom Report URL