OAuth 2.0 Authentication

The following permissions are required for OAuth 2.0 Authentication Type:

1. Create the API Client.

   For more information on API Client creation, refer to Create API Client for Integration.

2. Ensure the Workday Account used for the API Client to generate the refresh token must be an integration user. For more information the permissions, refer to Base Configuration.

3. Add all of the following functional area under the API Client Integration used for OAuth 2.0:

   • Staffing

   • System

   • Organization and Roles

   • Integration

4. Fetch the COMMENT and DESCRIPTOR for which the following additional permissions are needed:

   Domain	Category	Permission
   Workday Query Language	Report/Task Permissions	Modify access
   Security Activation	Report/Task Permissions	Modify access
   Security Configuration	Report/Task Permissions	Modify access

5. To fetch the OrganizationRole group object, the following additional permissions are required for group aggregation:

   Domain	Category	Permission
   Security Administration	Report/Task Permissions	Modify access

   For more information, refer to Group Object: OrganizationRole.

6. The following additional permissions are needed to fetch the SECURITY_GROUPS group object:

   Domain	Category	Permission
   Workday Query Language	Report/Task Permissions	Modify access
   Security Activation	Report/Task Permissions	Modify access

7. To aggregate Implementers Accounts, the following additional permissions are needed:

   Domain	Category	Permission
   Workday Query Language	Report/Task Permissions	Modify access

8. To aggregate Integration System Accounts, the following additional permissions are needed:

   Domain	Category	Permission
   Workday Query Language	Report/Task Permissions	Modify access
   Security Activation	Report/Task Permissions	Modify access

9. To aggregate Integration System ID associated with integration user, the following permissions are needed:

   Domain	Category	Permission
   Integration Security	Report/Task Permissions	Put access

10. To manage Student Accounts, the following permissions are needed:

    Domain	Category	Permission
    Workday Query Language	Report/ Task Permissions	Get access
    Reports: Student Recruitment	Report/ Task Permissions	Get access
    Reports: Students	Report/ Task Permissions	Get access
    Integration Build	Integration Permissions	Get access