Configure Workday for AI agent imports

To import Workday Agent System of Record (ASOR) AI agents from your Workday tenant, you must set up an OAuth 2.0 API client and retrieve the client credentials and token endpoint.

After you've completed these configurations, follow the steps in Enable AI agent imports for an app.

Enable functional areas and domain security policies in Workday

Ensure that your Workday admin account has the required data visibility permissions.

  1. In your Workday tenant, open the Maintain Functional Areas task and verify that the following settings are enabled:
    • System
    • Agent System of Record
  2. Verify that your target admin's security group has Get and Put access to these security policies:

    Manage: Agents, Setup: Agents, and Agent Management Hub (Functional Area: Agent System of Record)

  3. Run the Activate Pending Security Policy Changes task to apply your changes.

Register an OAuth 2.0 API client in Workday

  1. Sign in to your Workday tenant with admin privileges.
  2. In the search bar, enter and select the Register API Client task.

  3. Configure the following registration parameters:

    • Client Name: Enter a unique identifier (for example, Okta AI Agent Provider).
    • Client Grant Type: Select Authorization Code Grant.
    • Access Token Type: Select Bearer.
    • Redirection URI: Enter the following callback URL, replacing {domain} with your Okta org's root URL: 
      {domain}/oauth2/v1/sts/callback
    • Non-Expiring Refresh Tokens: Select this checkbox.
  4. Locate the Scope (Functional Areas) field and select the following scopes from the prompt list:
    • System
    • Agent System of Record
  5. Click OK. The screen displays your Client ID, Client Secret, and Token Endpoint.
  6. Copy and record your credentials from the screen immediately.