This article is specifically prepared for the integration of Workday with Sastrify, taking into account its particular steps involved in setting up the connection.


For the main knowledge base articles on ERP & Accounting integration, please refer to the following links:

Configuration Overview


The configuration consists of five steps:

  1. Initiate the integration from your Sastrify platform.

  2. Create a Workday Integration System User

  3. Create and register a Workday API Client

  4. Create a Workday Security Group

  5. Configure Security Group Policies

  6. Activate Security Group Policies


Step 1: Initiate the integration from your Sastrify platform


1. Go to Integrations > Organization & Spend > ERP & Accounting.


2. Find Workday and click the "Manage" button to open the setup page.



3. Click the "+ Add New" button located in the lower right corner of the page to create a new integration.


4. If needed, modify the name of the integration (for example, 'Workday 1'), then click the tick to confirm.


5. Click the "Connect" button to continue.



6. Review the summary of the entire process and click the 'Next' button. Follow the subsequent steps outlined in this guide to complete the process.


Step 2: Create a Workday Integration System User


To create an Integration System User in Workday:

  1. Log in to Workday using an account with administrator privileges.

  2. Follow the on-screen instructions to create the Integration System User.

  3. When finished, click Next.



Step 3: Create and Register a Workday API Client


Proceed to create and register a Workday API Client, by following the on-screen instructions:


Once created, you will be redirected to the Register API Client for Integrations summary dialog.

  1. Copy the Client ID and Client Secret, and paste them into the corresponding fields in the connection flow.



  2. In Workday, search for and select View API Clients.
  3. Copy the Workday REST API Endpoint and paste it into the Workday REST API Endpoint field in the connection flow.


  4. Click Next.


Then, associate the Integration System User with the API Client

  1. Open View API Clients.

  2. Go to the API Clients for Integrations tab.

  3. Select the API Client you created.

  4. Navigate to Related Actions > Manage Refresh Tokens for Integrations.



  5. Add the Integration System User as the Workday Account, then click OK.



  6. Select Generate New Refresh Token, then click OK.



  7. Copy the Refresh Token and paste it into the Refresh Token field in the connection flow. Then, click Next in the connection flow.


Step 4: Create a Workday Security Group


Create a dedicated Security Group to manage access for the Integration System User.

In Workday:

  1. Search for and select Create Security Group.

  2. Set Type of Tenanted Security Group to Integration System Security Group (Unconstrained).

  3. Copy the Security Group Name from the connection flow and paste it into the Name field, and then, click OK.



  4. Paste the Integration System User username into the Integration System Users field.

  5. Click OK, then Done. Return to the connection flow and click Next.


Step 5: Configure and Activate Security Group Policies


To configure the security group permissions:

  1. Search for and select Maintain Permissions for Security Group.

  2. Ensure Operation is set to Maintain.

  3. Paste the Security Group Name into the Source Security Group field and click OK.

  4. Keep the dialog open and click Next in the connection flow.



Below is a breakdown of the security policies required for a successful connection to Workday:



In the Domain Security Policy Permissions tab, add the following policies with View/Modify Access set to Get Only:

  1. Process: Ad Hoc Payment (NEW)

  2. Process: Journals – View

  3. Process: Supplier Invoice

  4. Reports: Supplier Payment

  5. Set Up: Company General

  6. Set Up: Supplier Accounts

  7. Set Up: Tax

  8. View: Organization Journals

  9. View: Supplier

  10. View: Supplier Invoice Request


Ignore any errors or alerts, then click OK and Done. Click Next in the connection flow.


Step 6: Activate Security Policies


To activate the changes:

  1. In Workday, search for and select Activate Pending Security Policy Changes.

  2. Copy the Comment from the connection flow and paste it into the Comment field. Then, click OK.

  3. Check Confirm, then click OK.



Lastly, return to the connection flow and click Complete. A confirmation message will indicate that Workday has been successfully connected.