ConfigBot For Workday - Api User Permissions Guide
Configuring API User Permissions in ConfigBot (Workday)
This guide explains how to assign the correct Workday permissions to a ConfigBot API user. This setup ensures ConfigBot can read or update configurations across multiple business areas such as Compensation, Organizations, and Job Structures.
Step 1: Create or Use an Integration User
- In Workday, navigate to Create Integration System User.
- Enter a name (e.g., CFG_ISU_ConfigBot).
- Set a secure password and uncheck "Require Password Change".
- Save the user.
Step 2: Assign the User to the Integration System Security Group (Unconstrained)
- Go to Create Security Group OR Edit Security Group (if using an existing one).
- Search for and open Integration System Security Group (Unconstrained).
- Add your integration user (e.g., CFG_ISU_ConfigBot) under Accounts.
- Save the change.
Step 3: Grant Required Domain Security Policies
Use the table below to assign the correct Operation (Get / Put) to each Domain Security Policy.
Functional Area | Domain Security Policy | Operation | Purpose |
Organizations and Roles | Manage: Location (inherits Location: View) | Get and Put | Enables Create/Update operations for Locations. |
Organizations and Roles | Manage: Organization Integration | Get Only | Read-only access to organization setup for validation. |
Jobs & Positions | Job Information | Get and Put | Needed to create/update Job Profiles & Positions. |
Core Compensation | Set Up: Compensation (includes Base and Plan, Benchmark Jobs, etc.) | Get and Put | Allows ConfigBot to modify compensation structure. |
Core Compensation | Set Up: Compensation Packages | Get and Put | Enables creation/modification of compensation bundles. |
Organizations and Roles | Create: Cost Center | Get and Put | Required for cost center creation via API. |
Organizations and Roles | Create: Region | Get and Put | Grants region setup privileges. |
Common Financial Management | Set Up: Company General | Get and Put | Required for updating company-level financial config. |
Integration | Integration Build | Get Only | Read-only access to integration metadata. |
System | Security Configuration | Get Only | Visibility into Workday security without modification. |
Organizations and Roles | Manage: Supervisory Organization | Get Only | Allows viewing organizational hierarchy. |
Step 4: Test Access
- Log in as the integration user or impersonate it using Switch User (if available).
- Perform a ConfigBot action such as:
- Generate Workbook
- Run Validation
- Start Configuration
- If access errors appear (e.g., "Insufficient Permissions for Domain XYZ"), locate the domain in the table and ensure Get or Put is assigned.
Final Outcome
After following this guide, your ConfigBot API user will:
✔️ Successfully retrieve configuration data
✔️ Apply updates where necessary (only where PUT is granted)
✔️ Operate independently of location/supervisory constraints (due to Unconstrained group membership)
Updated on: 10/18/2025
Thank you!