Configure Integration Security for Payments

Permissions Required: Workday Security Administrator

To manage Integration Systems and Security Groups configurations, you'll need to be a member of the Security Administrator, Integration Administrator, and/or Implementers security group.

The naming conventions outlined below are for consistency and clarity, you may follow your own naming conventions as needed.

Create Integration System User

  1. Using the Workday search bar, navigate to the Create Integration System User task.

Search Create ISU.png

  1. Create a user named API_BankConnect.

    • Assign a secure, alphanumeric password (we do not support the following special characters:  &, ", ', < and >) — make a note of this password as it will be needed to enable your outbound connectivity in a future step.
    • Do not require a new password at next sign in.
Create ISU Modal.png

You may choose to define additional ISU settings from the Edit Workday Account task. We recommend excluding the ISU from UI sessions as an additional security measure.

Exempt ISU from Password Expiration Rules

  1. Using the Workday search bar, navigate to the Maintain Password Rules task.

maintain password rules.png

  1. In the System Users exempt from password expiration section (at the bottom of the page),add the ISU to the list of users exempt from password expiration.

Maintain PW Rules.png

Record ISU Username & Password

The ISU will be assigned to the API integration that delivers bank data to your Workday tenant; this password will be shared securely as part of your initial set-up. 

Please make note of the username and password you have assigned, you will need to share these with your onboarding team.

Create Security Group

  1. Using the Workday search bar, navigate to the Create Security Group task.

Search Create Security Group.png

  1. Create an Integration System Security Group (Unconstrained) type group named ISSG_API_BankConnect, then click OK.

Create Security Group Dialog.png

Assign ISU to the Security Group

  1. From the Edit Integration System Security Group task, assign the API_BankConnect user.

Assign ISU to ISSG.png

You can also add a comment about the purpose of this ISSG to help future Security Administrators understand the integration.

 

Assign Security Group Permissions

  1. Using the Workday search bar, navigate to the View Security Group task.

Search View Security Group.png

  1. Select the security group you want to assign permissions to.

View Security Group Dialog.png

  1. Navigate to Maintain Domain Permissions for Security Group from the group's related actions menu.

Maintain Permissions ISSG Rel Action.png

  1. Assign Integration Permissions to the security group; the following security policies should be added to the Integration Permissions:

Maintain Domain Security ISSG_IR+Pay.png

Put access Get access
Process: Bank Reconciliation
Process: Bank Statement
Process: Settlement
Set Up: Bank Entity 		Worker Data: Public Worker Reports
Worker Data: Staffing
Worker Data: Workers
 

Put access provides both Get and Put access. This ISU will have access to fetch and update Financial Institution, Bank Account, Bank Statement and Payments (Payment Messages and Payment Acknowledgements) data from your Workday tenant. The ISU will also enable user-linking by fetching a list of employees from your Workday tenant.

 

  1. Using the Workday search bar, navigate to the Activate Pending Security Policy Changes task.

Search Activate Pending Security.png

  1. Follow the prompts to activate the permissions you've just assigned. 

    • Add a Comment. Click OK. 

    • Review Domain Security Policies and select the Confirm checkbox. Click OK.

Activate Pending Security 2-steps.png

Create an Integration System

  1. Using the Workday search bar, navigate to the Create Integration System task.

Search Create IS.png

  1. Create an Integration System named BankConnectPayments using the Core Connector: Payments Outbound template, then click OK.

    Create Int Sys Modal.png

  2. After you have set the System Name and New Using Template, you will be navigated to this page. configure integration services.png

    • Click the actions menu and click the name of the Integration System that is linked. configure integration services arrow.png

  3. You will land on the View Integration System page. Click the action menu and select Configure Integration Attributes.coinfgure integration attributed arrow.png

  4. Configure the Integration System with the following settings, then click OK.Configure full with arrows.png

Required Payment Data Validation Omit
(this omits payments from the Settlement Run that do not validate allowing you to correct and re-submit them)
Output Format Webservice XML
Web Service Version Version 35 and later
Document Retention Policy A retention policy is recommended, you may set the length of this policy according to your own business practices.

  1. To configure an Integration Sequence Generator, click the actions menu on the Integration System and select Configure Integration Sequence Generators. Then follow the screenshot to configure. configure integeratino sequence.png

sequence.png

 

Add Workday Account (ISU) to the Integration System

  1. Navigate to Edit Workday Account from the integration system's related actions menu.

IS Related Actions Edit Workday Account.png
 

  1. Set API_BankConnect as the Workday Account, and click OK.

    Edit Account Int Sys.png

Enable Subscriptions

Depending on your Workday tenant setup, you may need to enable Integrations to send subscription notifications.

  1. Using the Workday search bar, navigate to the Edit Tenant Setup - Integrations task.

Search Edit Tenant Setup.png

  1. Within Integration Subscription Settings, make sure Disable Integration Subscriptions is not checked. Click OK.

Teant Setup Integrations.png

 

Add Event Subscription to Integration System

  1. Using the Workday search bar, navigate to the View Integration System task.

Search Integration System.png

  1. Select the integration system you want to add a subscription to.

    Select Integration System.png

  2. Navigate to Edit Subscriptions from the integration system's related actions menu

IS Related Actions Edit Subscription.png

  1. Select Subscribe to specific Transaction Types and choose Payment Release Event – Payment Release Event.Edit Subscription.png

  2. Add an External Endpoint will the following details, then click OK to save.

You will receive your [company] (aka "URL slug"), and [KEY-KEY-KEY-KEY] ("Activation Key") from your account team.

Use API Version v43.0
Notification URL https://connect.wd.koxa.io/notification/payment-message
Notification User Name [company]
Notification Password [KEY-KEY-KEY-KEY]