Setting Up a Workday ISU for Auditoria AP Invoices

This guide provides step-by-step instructions for configuring your Workday environment to integrate with Auditoria AP Invoices.

You will:

• Create a dedicated Integration System User (ISU).

• Create and configure an Integration System Security Group (ISSG).

• Assign the required Domain Security Policies (including Workday Query Language/WQL access).

• Register an API client and generate a Refresh Token.

• Connect Auditoria AP Invoices to your Workday tenant.

These configurations ensure that Auditoria can securely read and (optionally) write AP invoice data in Workday, including vendor master, supplier invoices, and related financial information.

Audience

This article is intended for:

• Workday Administrators with:

  • Integration configuration access.

  • Security and Domain Security Policy management permissions.

  • API client registration and WQL access.

Coordination with your Auditoria Customer Success Representative is recommended during initial setup and whenever you modify security or integration scope.

Prerequisites

Before you begin, ensure the following:

• An active Auditoria subscription for AP Invoices.

• Workday administrator credentials.

• Ability to:

  • Create Integration System Users (ISU).

  • Create and manage Integration System Security Groups (ISSG).

  • Configure Domain Security Policies.

  • Access Workday Public Web Services.

  • Register API Clients for Integrations in Workday.

5. Update Business Process Security Policies for Functional Area

In addition to Domain Security Policies, you must ensure that your Auditoria security group (for example, ISSG_Auditoria) is allowed to participate in the appropriate Business Processes. This is required particularly when AP Invoices will create or update Supplier Invoices in Workday, and is recommended for consistent visibility for AP Helpdesk.

Follow these steps to update the relevant Business Process Security Policies:

1. In the Workday search bar, type Business Process Security Policies for Functional Area and press Enter.

   

2. Select Business Process Security Policies for Functional Area from the search results. Enter the following parameters and click OK:

   • Functional Area: Supplier Accounts
   • Business Process: Supplier Invoice Event

   

3. Scroll to the bottom of the configuration page and click Edit Permissions.

   

4. Locate the following Initiating Actions and update the Security Groups as appropriate:

   • Import Supplier Invoice (WS Background Process)

     

   • Submit Supplier Invoice (Web Service)

     

   Ensure your Auditoria security group (e.g. ISSG_Auditoria) and any other required groups are included.

5. Click OK to save and activate your changes.

6. Exempt the Auditoria ISU from the Business Document Attachment Validation

When Auditoria writes invoices to Workday, it uses a two-step process: the first API call writes the invoice data, and the second API call attaches the invoice document. If your Workday tenant has a custom validation that requires a business document attachment at the time of invoice creation, Workday triggers that validation before the second API call completes, causing a processing error.

To prevent this, you must configure the relevant custom validation in Workday to exempt the Auditoria ISU.

1. In the Workday search bar, type Maintain Custom Validation and press Enter.
2. Open the Maintain Custom Validation report.

3. In the left-side menu, locate and select Supplier Invoice. The validations associated with supplier invoices appear in the main panel.

To prevent this, you must configure the relevant custom validation in Workday to exempt the Auditoria ISU.

4. Using the search bar at the top of the Maintain Custom Validations page, search for one of the following validation names:

   • Business Document Attachment is missing
   • Supplier invoice attachment is required

   Note: The validation name may vary depending on your Workday configuration. Search for both terms if the first does not return a result.

5. Select the Actions menu (three-dot icon) next to the validation, then select Custom Validation > Edit.

6. On the validation edit screen, review the existing conditions under the Rule Conditions tab. 
7. Select the + (Add) icon at the top of the Rule Conditions table to add a new condition.

6. Click OK to save the validation.

10. Get Account Posting Rule Set

To configure Auditoria, you will need to provide the Account Posting Rule Set information from Workday.

Follow these steps to locate and copy the required Account Posting Rule Set ID:

1. In your Workday search bar, type View Account Posting Rule Set and press Enter.

   

2. In the pop-up window, select the appropriate Account Posting Rule Set that Auditoria should use (for example, "Standard Corporate Account Posting Rule"), and click OK.

   

3. On the next screen, locate the name of the selected Account Posting Rule Set at the top. Click the three vertical dots (ellipsis) next to the rule set name, hover over Integration IDs, then click View IDs.

   

4. Copy the Workday ID displayed in the Integration IDs section. This ID will be required during the system connection configuration in Auditoria.

   

Note: If you have any Segmented Security configured in Workday for the following business objects, please ensure that the ISU or the Security Group created for the Auditoria–Workday connection is also added to the same security group.

• Supplier
• Customers
• Customer Invoices
• Supplier Invoices
• Customer Payments
• Supplier Payments
• Purchase Orders
• Entity

Connect Auditoria SmartVendor (AP Invoices) to Workday ERP

After gathering your Workday connection details (hostname, tenant name, Integration System User credentials, API client credentials, and refresh token), you are ready to set up the connection within Auditoria.

Steps to Connect Auditoria to Workday

1. Access System Settings:
   • Log in to the Auditoria platform with administrative privileges.
   • Navigate to Administration > System Settings.
2. Add or Update Workday ERP Connection:
   • In the "Add New Connection" area of System Settings, select the Workday ERP option.
   • To update an existing connection, locate the Workday system tile and click Update.

3. Enter Required Connection Information:
   • On the ERP Settings page, fill in the following fields with your Workday integration details:
     • Instance Name: Enter a recognizable display name for this connection.
     • Tenant ID: Enter your Workday tenant name.
     • User ID: Enter the Integration System User (ISU) username.
     • User Password: Enter the ISU password.
     • Host Name: Enter the Workday service URL or host address.
     • Client ID: Enter the API Client ID.
     • Client Secret: Enter the API Client Secret.
     • Refresh Token: Enter the generated refresh token.
     • Additional report and configuration fields may be present. Complete these as required for your organization or leave as “-” if not needed.
4. Save and Test Connection:
   • Click Save to submit your settings.
   • The system may validate your credentials and confirm the connection status.
   • Once the setup is complete, proceed to sync entities if prompted or verify that the connection is active.

Notes:

• Fill out only the Workday connection fields needed for Auditoria AP Helpdesk functionality. Optional fields may be left blank or set to “-” as indicated on the screen.

• If you encounter authentication or connection issues, verify all credentials and confirm that the required permissions in Workday have been assigned and activated.

Best Practices

• Distinct, descriptive naming:

  • Example: ISU_Auditoria_APInvoices, ISSG_Auditoria_APInvoices, Auditoria_APInvoices_Client.

• Limit UI access for ISU:

  • Select Do Not Allow UI Sessions to restrict access to API/Web Services only.

• Review permissions regularly:

  • Update Workday permissions as AP Invoices data or workflows evolve.

• Secure credential storage:

  • Store ISU password, Client ID, Client Secret, and Refresh Token in an enterprise-grade vault.

• Coordinate with Auditoria:

  • Work with your Auditoria Customer Success Representative during initial setup and when making significant changes (e.g., enabling invoice write-back).

• Document changes and approvals:

  • Maintain a change log for security reviews and audits.

• Test incrementally:

  • After each major configuration (ISU, group, domain policies, API client, refresh token), test connectivity and data access from AP Invoices.

Troubleshooting

Glossary

• ISU (Integration System User):
  A Workday user account dedicated to integrations. UI access is typically disabled.

• ISSG (Integration System Security Group):
  A Workday security group used to control permissions for integration users.

• Domain Security Policy:
  Defines what operations (View, Get, Modify, Put, etc.) a security group can perform on a given business domain.

• API Client:
  OAuth 2.0 client registration in Workday. Provides the Client ID, Client Secret, and Refresh Token used by integrations.

• WQL (Workday Query Language):
  Workday’s query mechanism, used by Auditoria to read Workday data (including AP invoice data).

• AP Invoices:
  Auditoria functionality focused on automating Accounts Payable invoice processing, including extraction, validation, and (optionally) posting supplier invoices to Workday.

• Tenant:
  Your specific Workday environment (for example, acme-corp-prod), used in Workday URLs.

• Functional Areas:
  Logical groupings in Workday such as Suppliers, Supplier Accounts, Supplier Invoices, Common Financial Management, used to scope API client access.