Overview

This integration connects Workday Recruiting with imper.ai to secure interviews throughout the hiring process. It enables protection and verification for interviews that are managed and scheduled directly within Workday, helping prevent impersonation and candidate fraud.

This guide walks through the full setup: create an Integration System User (ISU), grant it access through a security group, get the Recruiting WSDL URL, register an OAuth API client, and generate a non-expiring refresh token - then connect in imper.ai. imper.ai authenticates to Workday using OAuth, so it holds a revocable, scoped token instead of a stored password.

NOTE

The setup requires Workday admin access to complete the configuration steps. To connect and manage the Workday integration in imper.ai, users must have admin role.

---

Workday Integration Setup Overview

The setup process consists of 8 steps - Steps 1-7 are completed in Workday, and Step 8 in the imper.ai admin interface:

1. Create an Integration System User (ISU)

2. Create a security group

3. Grant permissions to the security group

4. Activate security policy changes

5. Get the Recruiting WSDL URL

6. Register the API client

7. Generate a refresh token

8. Connect Workday to imper.ai

Setup

Log in to your Workday tenant as an administrator and follow these steps to setup Workday:

Step 1: Create an Integration System User (ISU)

1. In the search bar, type**"Create Integration System User"** and select the task

Search for "Create Integration System User" task

2. In the “Create Integration System User” form, enter the following details:

   1. User Name: imperai_ISU (of any name you of yout choice)

   2. Password: Use a strong password (avoid special characters)

   3. Require New Password at Next Sign In: Uncheck

   4. Do Not Allow UI Sessions: mark as Checked

3. Click OK

   1. 

Create Integration System User Form

ISU Summary

4. Search for**“Maintain Password Rules”** and open the task.

   1. Add your ISU to the “System Users Exempt from Password Expiration” field to ensure the integration remains active and is not disrupted by password expiration.

Step 2: Create a Security Group

1. In the search bar, type "Create Security Group" and select the task

2. From the Type of Tenanted Security Group dropdown, select: Integration System Security Group (Unconstrained)

   1. Name it: imperai_SG (of any name you of yout choice)

   2. Click OK

   3. On the next screen (Edit Integration System Security Group), add your ISU (imperai_ISU) to the group

   4. Click OK

Create Security Group

Step 3: Grant Permissions to the Security Group

You'll use the "Maintain Permissions for Security Group" task to configure all domain permissions in a single screen.

3a. Open the Permissions Screen

1. In the Workday search bar, type**"Maintain Permissions for Security Group"** and select the task.

2. In the dialog that appears:

   1. Operation: Select "Maintain"

   2. Source Security Group: Search for and select imperai_SG (the group you created in Step 2)

   3. Click OK

Maintain Permissions for Security Group

3b. Add Domain Permissions

You will now see a screen with the Domain Security Policy Permissions section. This is where you add all the permissions imper.ai needs.

1. Scroll down to theIntegration Permissions section

2. For each domain in the table below, click the + (add row) button

3. Search for and select the domain name

4. Check the Get box (and Put box where indicated)

5. Follow the table below to set permissions. Once all 8 domains are added with the correct checkboxes, click OK to save

Domain Security Policy	Get	Put
Candidate Data: Job Application	✅	-
Candidate Data: Personal Information	✅	-
Candidate Data: Interview Schedule	✅	-
Candidate Data: Other Information	✅	-
Job Requisition Data	✅	-
Manage: Candidates	✅	-
Worker Data: Public Worker Reports	✅	-
Interview Integrations	✅	-

Step 4: Activate Security Policy Changes

This is critical - your permissions won't take effect until you activate them.

1. Search for "Activate Pending Security Policy Changes" and select the task.

2. Add a comment describing your changes (e.g., "Granted imper.ai integration permissions")

3. Check the Confirm checkbox

4. Click OK

Activate Security Policy Changes

Step 5: Get the Recruiting WSDL URL

1. Search for**"Public Web Services"** and open the report

2. Find Recruiting in the list

3. Hover over it → click the three dots (...) → select Web Service > View WSDL

4. On the page that opens, scroll to the very bottom

5. Copy the URL. it will look like: https://wd5-services1.myworkday.com/ccx/service/{tenant}/Recruiting

Step 6: Register the API Client

In the Workday search bar type Create API Client for Integrations and open the Register API Client for Integrations task.

Search for the Register API Client for Integrations task.

Set a Client Name, tick Non-Expiring Refresh Tokens, and set Scope (Functional Areas) to cover the domains you granted in Step 3 - use Integration, Pre-Hire Process, Recruiting, and Staffing. Leave Restricted to IP Ranges empty unless you allowlist imper.ai's egress IPs.

The Register API Client for Integrations form - note Non-Expiring Refresh Tokens and Scope (Functional Areas) are required.

Filled in: client name imper-api-key, Non-Expiring Refresh Tokens checked, and the four functional-area scopes.

On OK, Workday shows the resulting client with its Client Grant Type = Authorization Code Grant, Access Token Type = Bearer, and the Client ID and Client Secret. Copy both now - the secret is not shown again.

The registered client: Authorization Code Grant, Bearer, Non-Expiring Refresh Tokens = Yes, and the Client ID and Client Secret to copy.

IMPORTANT

Keep the secret safe. The Client Secret and refresh token are credentials. Store them in your secret manager and paste them straight into imper.ai - don't put them in tickets or chat.

Step 7: Generate a Refresh Token

Open the client (search View API Clients → your client), click the ⋯ related-actions menu → API Client → Manage Refresh Tokens for Integrations.

Related actions → API Client → Manage Refresh Tokens for Integrations.

Select the Workday Account - the ISU you created in Step 1 (for example integration-system-user-tl3) - and click OK.

Choose the ISU as the Workday Account the token is issued for.

On the Delete or Regenerate Refresh Token page, tick Generate New Refresh Token and click OK.

Tick Generate New Refresh Token. This also deletes any existing token for this client and user.

Successfully Regenerated Refresh Token then shows the token value, marked Non-Expiring = Yes. Copy it - like the secret, it's shown only once.

The generated non-expiring refresh token - copy this value for imper.ai.

Step 8: Connect Workday to imper.ai

1. Login to imper.ai as an admin user

2. Navigate to Integrations page

3. Search for Workday and click Connect

4. A dialog will open. Enter the following fields and click Connect:

   1. Client ID

   2. Client Secret

   3. Refresh Token

   4. WSDL URL

imper.ai admin console: Workday integration