Setting Up an Integration System User (ISU) for Auditoria AP Accruals

1. Get Your Workday Hostname and Tenant Name

To configure the Workday connection in Auditoria, you need your Workday hostname and tenant name.

1. Log in to Workday using your administrator account.

2. In the Workday search bar, type Public Web Services and press Enter.

   

3. In the results, filter the Web Services column to only show entries for Revenue Management.

   

4. Locate Revenue Management (Public) Web Service.

5. Click the ellipsis (three dots) next to it and select:
   Web Service > View WSDL.

   

6. In the WSDL file:

   • Search for the final occurrence of Revenue_Management.

   • Locate the endpoint URL, for example:
     https://wd1-impl-services1.workday.com/ccx/service/your-tenant-name/Revenue_Management/v37.0

   • From this URL:

     • Hostname: wd1-impl-services1.workday.com

     • Tenant Name: your-tenant-name

7. Copy both values. You will use them later in the Auditoria connection settings.

Note: The hostname and tenant name are required to configure the Workday ERP connection in Auditoria.

2. Create the Workday Integration System User (ISU) for Auditoria

Create a dedicated Integration System User that Auditoria will use for API/WQL access.

1. Log in to Workday as an administrator with ISU management permissions.

2. In the search bar, type Create Integration System User and press Enter.

   

3. On the Create Integration System User page, configure:

   • User Name (required):
     Use a descriptive name such as ISU_Auditoria or a variant specific to SmartVendor.

   • Generate Random Password (optional):

     • Check this box if you want Workday to auto-generate a password.

     • If selected, you do not enter a manual password.

   • New Password / New Password Verify (required if not generating random):

     • Enter a secure password that meets the Workday Password Rules (minimum length and complexity).

   • Require New Password at Next Sign In (optional):
     Typically not required for integration users, unless mandated by your security policy.

   • Session Timeout Minutes Enforced / Session Timeout Minutes (optional):

     • Configure session timeout according to your organization’s policies.

   • Do Not Allow UI Sessions (optional but recommended):

     • Check this to prevent the ISU from logging into the UI.

     • Recommended for integrations to limit access to API/Web Services only.

4. Click OK to create the ISU.

   

Best Practice: Use a unique ISU for Auditoria (do not reuse ISUs shared with other integrations) and store its credentials securely.

3. Create a Workday Security Group and Assign the ISU

Create an Integration System Security Group (Unconstrained) and assign your ISU to it.

1. In the Workday search bar, type Create Security Group and press Enter.

   

2. On the Create Security Group page:

   • Type of Tenanted Security Group:
     Select Integration System Security Group (Unconstrained).

   • Name:
     Enter a descriptive name, for example:
     ISSG_Auditoria.

3. Click OK.

   

4. On the Edit Integration System Security Group (Unconstrained) page:

   • In the Integration System Users section, add the ISU created in Step 2 (for example, ISU_Auditoria).

5. Click OK to save the security group.

   

Note: Use a dedicated security group for the Auditoria integration. Do not assign unrelated users to this group.

4. Assign Domain Security Policy Permissions for SmartVendor (AP Helpdesk)

To enable Auditoria to access the required data from your Workday tenant, you must assign the correct domain security policy permissions to the integration security group you created.

Steps to Assign Security Policy Permissions

1. Log in to your Workday console with administrative privileges.

2. Open Security Group Search:

   • Go to the Workday search bar.
   • Type "Security group" and select View Security Group from the search results.

   

3. Select the Auditoria security group:

   • In the prompt, enter the name of your group (for example, ISSG_Auditoria_SmartVendor12).
   • Click OK.

   

4. Open Domain Permissions for the Group:

   • On the Integration System Security Group (Unconstrained) overview page, select the Related Actions (three dots menu) next to the group name.
   • Choose Maintain Domain Permissions for Security Group.

   

5. Add Permissions:
   • In the Report/Task Permissions and Integration Permissions sections, add the required Domain Security Policies for each data source, using the operation/access level provided in the table below.
   • Use Modify, View, Get, or Put access level as specified.

6. Save and confirm your changes.

   • Click OK.
   • Remember to activate pending security policy changes using the appropriate Workday task.

   

Table 1. Security Permissions for AP Accruals

Notes:

Note 1: The hostname and tenant name are required to configure the Workday ERP connection in Auditoria.

Note 2: Your organization's requirements may differ; always confirm with your implementation team or Auditoria support if unsure which policies are needed.

If you have questions about specific domain security policies or data source configurations, consult your Workday administrator or Auditoria support representative.

To view all Domain Security Policy Permissions in detail, please download the Excel sheet from the attachment section at the end of this article.

5. Activate Pending Security Policy Changes

After adding or modifying domain permissions, you must activate pending security policy changes.

1. In the Workday search bar, type Activate Pending Security Policy Changes and press Enter.

   

2. On the Activate Pending Security Policy Changes page:

   • Enter a comment describing the change (for example, “Auditoria SmartVendor integration permissions”).

     

3. Review the Current Security Evaluation Moment and the Proposed Security Evaluation Moment.
4. If the details are correct, check the Confirm box to acknowledge the changes.

5. Click OK to apply the updates and activate the permissions.

   

Note: Security changes do not take effect until they are activated. Ensure you have permissions to perform this step.

If you have questions about which policy changes need to be activated, consult your Workday administrator or your implementation team.

6. Register API Client and Retrieve Client Credentials

Register a Workday API Client for Integrations to obtain the Client ID and Client Secret that Auditoria will use.

1. In the Workday search bar, type Register API Client for Integrations and press Enter.

   

2. On the registration form, configure:

   • Client Name (required): Use a clear name, for example: Auditoria_Client.
   • Enforce Customized Access Token Expiry (optional): Leave unchecked unless your integration requires custom access token expiration.
   • Refresh Token Timeout (in days) (optional): Default 0 Typically, it means no expiry when using non-expiring refresh tokens.
   • Non-Expiring Refresh Tokens (recommended):
     • Select this option for integration clients, unless your security policy requires token rotation.
   • Disabled (optional):
     • Leave unchecked. Use only if you intentionally want to disable the client.
   • Scope (Functional Areas) (required): Add all functional areas required for your integration use case, for example:
     • Integration 
     • Staffing
     • System
     • Workday Everywhere
     • Suppliers Accounts
     • Suppliers
   • Include Workday Owned Scope (optional): Leave unchecked unless explicitly required.
   • Locked Out due to Excessive Failed Signon Attempts (informational/optional): Leave unchecked; this field is for tracking if the client is locked out.
   • Restricted to IP Ranges (optional): Add allowed IP ranges if your organization enforces IP whitelisting; otherwise, leave blank.

3. Click OK to complete the registration.

   

4. After registration, Workday will display the Client ID and Client Secret.

   

Important: Record and store the Client ID and Client Secret in a secure password manager or vault. You will need them when configuring the Workday connection in Auditoria.

7. Generate Refresh Token with Updated Permissions

Generate a Refresh Token that ties the API client to your Auditoria ISU.

1. In the Workday search bar, type View API Client and press Enter.

2. Navigate to API Clients for Integrations, filter on the client name created above.

3. Filter the list to find the API client you just created (e.g., filter on Client Name containing Auditoria).

   

4. Click the ellipsis (three dots) next to your API client and select:
   Manage Refresh Tokens for Integrations.

   

5. In the Manage Refresh Tokens dialog:

   • Enter or select the ISU from Step 2 (for example, ISU_Auditoria).

   • Click OK.

     

6. On the next screen, enable Generate New Refresh Token and click OK.

   

7. Workday will display a Refresh Token.

   • Copy this token immediately and store it securely (you will not be able to see it again later).

     

Important: Keep the Client ID, Client Secret, and Refresh Token confidential.
These values are required to link your Workday tenant to your Auditoria SmartVendor tenant.

Note: If you have any Segmented Security configured in Workday for the following business objects, please ensure that the ISU or the Security Group created for the Auditoria–Workday connection is also added to the same security group.

• Supplier
• Customers
• Customer Invoices
• Supplier Invoices
• Customer Payments
• Supplier Payments
• Purchase Orders
• Entity