Skip to main content
The Workday integration makes your people data available in client work. Ask who manages a consultant, who is in a supervisory organisation, or who is on time off the week of a client workshop, and Hebno answers from Workday HCM with each worker record cited. The integration reads only. Hebno never writes to Workday and never reads compensation, payroll, bank details, national identifiers or performance data.

​
At a glance

​
Before you start

You need:
  • An owner or admin role in Hebno.
  • Your Workday tenant name and the Workday REST API Endpoint and Token Endpoint shown in the View API Clients task.
  • A Workday security administrator who can create an integration system user, a security group and an API client.
Set up the integration in Workday:
  1. Run Create Integration System User. Name it, for example ISU_Hebno, set a password, clear Require New Password at Next Sign In and select Do Not Allow UI Sessions.
  2. Run Create Security Group, choose Integration System Security Group (Unconstrained) and add the integration system user.
  3. Run Maintain Permissions for Security Group and grant Get access to the domains Worker Data: Public Worker Reports, Worker Data: Current Staffing Information and Worker Data: Time Off. Do not grant compensation, payroll, personal data or performance domains. Then run Activate Pending Security Policy Changes.
  4. Run Register API Client for Integrations, select Non-Expiring Refresh Tokens, and add the scopes below. Copy the client ID and client secret.
  5. Run Manage Refresh Tokens for Integrations for the integration system user and select Generate New Refresh Token. Copy the refresh token.
The security group’s domain permissions are the boundary for what Hebno can read. A domain without Get access returns no data for that area rather than an error, so check the group if a field is empty.

​
Connect Workday

1

Allow the integration

Open Admin → Connectors → Catalogue, find Workday under People and HR, and set it to Allow.
2

Connect the organisation

Select Connect, enter the tenant name, REST API endpoint, token endpoint, client ID, client secret and refresh token, then select Test connection. Hebno checks that it can read workers, organisations and time off.
3

Choose teams and data areas

Under Who can use it, choose All teams or pick teams. Under Data areas, choose what members can see. See Data areas.
The card shows Connected with the Workday tenant. Access is fixed to Read only. Members do not link their own Workday accounts: every read goes through the integration system user and your data areas.

​
Data areas

Data areas control what members of the allowed teams can see through the organisation connection. They apply on top of the integration system user’s security group in Workday.
Admin connector panel showing who can use it, access and data areas

An organisation connection with team access and data areas. Financial figures default to owners and admins.

To keep time off visible to resource managers only, open the Workday card in Admin → Connectors, select Time off and absence and choose the teams that should see it.

​
What Hebno reads

Chat reply citing a Workday worker profile

A Workday worker profile attached to a chat.

Reads are live. Hebno queries Workday when a request needs it and does not copy worker data into Hebno. Only what a reply used is stored with the conversation as its sources. Hebno never reads compensation, payroll, bank details, national identifiers, personal contact details, performance reviews, leave reasons or worker documents.
Excerpts a reply uses become part of the conversation. Anyone you share the conversation with can read them, including who is out and when.

​
Hebno reads only

Hebno does not write to Workday. It does not request or approve time off, start business processes, edit workers, or change supervisory organisations. To book a consultant once you know they are free, use a resourcing integration such as Float. Linking marks which Workday workers are on a project, so you can ask “who on the team is away?” without naming everyone.
  1. Open the project and select Brain.
  2. Under Linked records, select Link record, then Workday.
  3. Search by name or supervisory organisation, and select each worker. You can link a whole supervisory organisation instead.
In chats tagged to the project, Hebno starts with the linked workers for any availability or reporting line question. See Linked records.

​
Use Workday in chat

  • Attach: open the + menu, choose Sources → Workday, and pick a worker, a supervisory organisation or a time off period. Or type / and choose Workday.
  • Ask: name the person, organisation or period in your request. For example:
    Who in the retail pricing organisation is out between 16 and 20 November?
    List the Contoso project team with business titles, locations and managers.
    Who reports to Sarah Chen, and is anyone on time off next week?
  • Research runs show a Checking Workday step, with a chip for each worker and organisation it read.
  • Agents can read Workday on a schedule, for example a Monday list of who is out on each active project this week.

​
Troubleshooting