Overview

This integration connects Workday Recruiting with imper.ai to secure interviews throughout the hiring process. It enables protection and verification for interviews that are managed and scheduled directly within Workday, helping prevent impersonation and candidate fraud.

This guide walks through the full setup: create an Integration System User (ISU), grant it access through a security group, get the Recruiting WSDL URL, register an OAuth API client, and generate a non-expiring refresh token - then connect in imper.ai. imper.ai authenticates to Workday using OAuth, so it holds a revocable, scoped token instead of a stored password.

NOTE

The setup requires Workday admin access to complete the configuration steps. To connect and manage the Workday integration in imper.ai, users must have admin role.

---

Prerequisites

The Workday integration lets imper.ai read candidate and interview data. imper.ai learns that an interview has been scheduled from the calendar it is connected to, so the calendar integration is needed alongside this one.

Before you begin, ensure that:

• The imper.ai interview account is provisioned, created in Workday as a contingent worker, and enforced onto external interviews by the validation rules - see Setting Up the imper.ai Interview Account

• Your calendar is connected in imper.ai - Google Workspace, or Microsoft 365 / Outlook - with the permissions described in Calendar and Meeting Permissions below

• You have Workday administrator access

• You have admin role in the imper.ai console

---

Calendar and Meeting Permissions

Workday tells imper.ai which candidate is interviewing for which requisition. The calendar tells it when the interview is happening, and the meeting itself tells it who actually attended. Granting the permissions below before you start the Workday setup means verification works from the first interview.

Google Workspace

Approve the calendar scopes imper.ai requests during the connection flow. No further configuration is needed.

Microsoft 365 / Outlook

imper.ai requests three application permissions on your Azure / Microsoft Entra tenant:

• Calendars.ReadWrite - reads the scheduled interview and attaches the candidate's verification link to the event

• CallRecords.Read.All - reads the Teams call record after the interview, so imper.ai can confirm who actually joined the meeting and flag an interview attended by someone other than the verified candidate

• User.ReadBasic.All - reads basic profile information (display name and email) for the users on the interview, so imper.ai can tell an interviewer from the candidate

All three are granted by an administrator through the standard Microsoft Entra consent flow, and all three apply tenant-wide when granted that way.

Scoping calendar access to a security group

If tenant-wide calendar access is more than your organization can grant, Calendars.ReadWrite can instead be limited to the mailboxes of a security group that you control - so imper.ai sees your recruiters' and interviewers' calendars and no one else's:

➡ Scoping Microsoft 365 Calendar Access to a Security Group

Adding an interviewer to that group grants access; removing them revokes it. Choose one approach or the other - Microsoft treats the two grants as additive, so a tenant-wide grant left in place overrides the group restriction.

NOTE

Scoping applies to Calendars.ReadWrite only. CallRecords.Read.All and User.ReadBasic.All are tenant-wide by nature and cannot be narrowed to a group, so attendance validation requires both tenant-wide grants. Skip them if you do not need attendance validation - the rest of the interview flow is unaffected.

---

Workday Integration Setup Overview

The setup process consists of 8 steps - Steps 1-7 are completed in Workday, and Step 8 in the imper.ai admin interface:

1. Create an Integration System User (ISU)

2. Create a security group

3. Grant permissions to the security group

4. Activate security policy changes

5. Get the Recruiting WSDL URL

6. Register the API client

7. Generate a refresh token

8. Connect Workday to imper.ai

Setup

Log in to your Workday tenant as an administrator and follow these steps to setup Workday:

Step 1: Create an Integration System User (ISU)

1. In the search bar, type**"Create Integration System User"** and select the task

Search for "Create Integration System User" task

2. In the “Create Integration System User” form, enter the following details:

   1. User Name: imperai_ISU (of any name you of yout choice)

   2. Password: Use a strong password (avoid special characters)

   3. Require New Password at Next Sign In: Uncheck

   4. Do Not Allow UI Sessions: mark as Checked

3. Click OK

   1. 

Create Integration System User Form

ISU Summary

4. Search for**“Maintain Password Rules”** and open the task.

   1. Add your ISU to the “System Users Exempt from Password Expiration” field to ensure the integration remains active and is not disrupted by password expiration.

Step 2: Create a Security Group

1. In the search bar, type "Create Security Group" and select the task

2. From the Type of Tenanted Security Group dropdown, select: Integration System Security Group (Unconstrained)

   1. Name it: imperai_SG (of any name you of yout choice)

   2. Click OK

   3. On the next screen (Edit Integration System Security Group), add your ISU (imperai_ISU) to the group

   4. Click OK

Create Security Group

Step 3: Grant Permissions to the Security Group

You'll use the "Maintain Permissions for Security Group" task to configure all domain permissions in a single screen.

3a. Open the Permissions Screen

1. In the Workday search bar, type**"Maintain Permissions for Security Group"** and select the task.

2. In the dialog that appears:

   1. Operation: Select "Maintain"

   2. Source Security Group: Search for and select imperai_SG (the group you created in Step 2)

   3. Click OK

Maintain Permissions for Security Group

3b. Add Domain Permissions

You will now see a screen with the Domain Security Policy Permissions section. This is where you add all the permissions imper.ai needs.

1. Scroll down to theIntegration Permissions section

2. For each domain in the table below, click the + (add row) button

3. Search for and select the domain name

4. Check the Get box (and Put box where indicated)

5. Follow the table below to set permissions. Once all 8 domains are added with the correct checkboxes, click OK to save

Domain Security Policy	Get	Put
Candidate Data: Job Application	✅	-
Candidate Data: Personal Information	✅	-
Candidate Data: Interview Schedule	✅	-
Candidate Data: Other Information	✅	-
Job Requisition Data	✅	-
Manage: Candidates	✅	-
Worker Data: Public Worker Reports	✅	-
Interview Integrations	✅	-

Step 4: Activate Security Policy Changes

This is critical - your permissions won't take effect until you activate them.

1. Search for "Activate Pending Security Policy Changes" and select the task.

2. Add a comment describing your changes (e.g., "Granted imper.ai integration permissions")

3. Check the Confirm checkbox

4. Click OK

Activate Security Policy Changes

Step 5: Get the Recruiting WSDL URL

1. Search for**"Public Web Services"** and open the report

2. Find Recruiting in the list

3. Hover over it → click the three dots (...) → select Web Service > View WSDL

4. On the page that opens, scroll to the very bottom

5. Copy the URL. it will look like: https://wd5-services1.myworkday.com/ccx/service/{tenant}/Recruiting

Step 6: Register the API Client

In the Workday search bar type Create API Client for Integrations and open the Register API Client for Integrations task.

Search for the Register API Client for Integrations task.

Set a Client Name, tick Non-Expiring Refresh Tokens, and set Scope (Functional Areas) to cover the domains you granted in Step 3 - use Integration, Pre-Hire Process, Recruiting, and Staffing. Leave Restricted to IP Ranges empty unless you allowlist imper.ai's egress IPs.

The Register API Client for Integrations form - note Non-Expiring Refresh Tokens and Scope (Functional Areas) are required.

Filled in: client name imper-api-key, Non-Expiring Refresh Tokens checked, and the four functional-area scopes.

On OK, Workday shows the resulting client with its Client Grant Type = Authorization Code Grant, Access Token Type = Bearer, and the Client ID and Client Secret. Copy both now - the secret is not shown again.

The registered client: Authorization Code Grant, Bearer, Non-Expiring Refresh Tokens = Yes, and the Client ID and Client Secret to copy.

IMPORTANT

Keep the secret safe. The Client Secret and refresh token are credentials. Store them in your secret manager and paste them straight into imper.ai - don't put them in tickets or chat.

Step 7: Generate a Refresh Token

Open the client (search View API Clients → your client), click the ⋯ related-actions menu → API Client → Manage Refresh Tokens for Integrations.

Related actions → API Client → Manage Refresh Tokens for Integrations.

Select the Workday Account - the ISU you created in Step 1 (for example integration-system-user-tl3) - and click OK.

Choose the ISU as the Workday Account the token is issued for.

On the Delete or Regenerate Refresh Token page, tick Generate New Refresh Token and click OK.

Tick Generate New Refresh Token. This also deletes any existing token for this client and user.

Successfully Regenerated Refresh Token then shows the token value, marked Non-Expiring = Yes. Copy it - like the secret, it's shown only once.

The generated non-expiring refresh token - copy this value for imper.ai.

Step 8: Connect Workday to imper.ai

1. Login to imper.ai as an admin user

2. Navigate to Integrations page

3. Search for Workday and click Connect

4. A dialog will open. Enter the following fields and click Connect:

   1. Client ID

   2. Client Secret

   3. Refresh Token

   4. WSDL URL

imper.ai admin console: Workday integration