> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.configbot.ai/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# ConfigBot For Workday - Api User Permissions Guide

**Configuring API User Permissions in ConfigBot (Workday)**

This guide explains how to assign the correct Workday permissions to a ConfigBot API user. This setup ensures ConfigBot can read or update configurations across multiple business areas such as Compensation, Organizations, and Job Structures.


** Step 1: Create or Use an Integration User**

1. In Workday, navigate to **Create Integration System User**.
2. Enter a name (e.g., CFG_ISU_ConfigBot).
3. Set a secure **password** and **uncheck "Require Password Change"**.
4. Save the user.


** Step 2: Assign the User to the Integration System Security Group (Unconstrained)**
1. Go to **Create Security Group** OR **Edit Security Group** (if using an existing one).
2. Search for and open **Integration System Security Group (Unconstrained)**.
3. Add your integration user (e.g., CFG_ISU_ConfigBot) under **Accounts**.
4. Save the change.

**Step 3: Grant Required Domain Security Policies**
Use the table below to assign the correct **Operation** (Get / Put) to each **Domain Security Policy**.

| Functional Area | Domain Security Policy | Operation | Purpose |
| Organizations and Roles | Manage: Location (inherits Location: View) | Get and Put | Enables Create/Update operations for Locations. |
| Organizations and Roles | Manage: Organization Integration | Get Only | Read-only access to organization setup for validation. |
| Jobs & Positions | Job Information | Get and Put | Needed to create/update Job Profiles & Positions. |
| Core Compensation | Set Up: Compensation (includes Base and Plan, Benchmark Jobs, etc.) | Get and Put | Allows ConfigBot to modify compensation structure. |
| Core Compensation | Set Up: Compensation Packages | Get and Put | Enables creation/modification of compensation bundles. |
| Organizations and Roles | Create: Cost Center | Get and Put | Required for cost center creation via API. |
| Organizations and Roles | Create: Region | Get and Put | Grants region setup privileges. |
| Common Financial Management | Set Up: Company General | Get and Put | Required for updating company-level financial config. |
| Integration | Integration Build | Get Only | Read-only access to integration metadata. |
| System | Security Configuration | Get Only | Visibility into Workday security without modification. |
| Organizations and Roles | Manage: Supervisory Organization | Get Only | Allows viewing organizational hierarchy. |


**Step 4: Test Access**
1. Log in as the integration user or impersonate it using **Switch User** (if available).
2. Perform a **ConfigBot action** such as:
    * Generate Workbook
    * Run Validation
    * Start Configuration
3. If access errors appear (e.g., *"Insufficient Permissions for Domain XYZ"*), locate the domain in the table and ensure **Get or Put** is assigned.


**Final Outcome**
After following this guide, your ConfigBot API user will:
✔️ Successfully retrieve configuration data
✔️ Apply updates where necessary (only where **PUT** is granted)
✔️ Operate independently of location/supervisory constraints (due to **Unconstrained** group membership)