Workday: companies or departments return 403 while employees work

If GET /hris/employees works for a Workday connection but GET /hris/companies or GET /hris/departments returns 403 Forbidden, the connection itself is fine. The Workday integration user is missing one security permission.

• Employees load normally.

• Companies and departments (and accounting subsidiaries) return 403. The Workday error usually reads The task submitted is not authorized.

Each Apideck resource reads a different Workday web service, and Workday secures each one with its own security domain:

• Employees use Get_Workers, which is covered by the Worker Data: and Person Data: domains.

• Companies and departments use Get_Organizations, which needs the Manage: Organization Integration domain.

If the integration user's security group has the worker domains but not that one, you get this split: employees work, companies and departments don't.

This is done by a Workday security administrator in the customer's tenant:

1. Open the task Maintain Permissions for Security Group.

2. Choose the operation Maintain and select the Integration System Security Group that contains the Apideck integration user.

3. Add the domain Manage: Organization Integration with Get access, and save.

4. Run the task Activate Pending Security Policy Changes. This step is easy to miss. Workday doesn't apply permission changes until they're activated.

One grant fixes companies, departments and subsidiaries together.

Fix it in every tenant. Security settings belong to each Workday tenant, so a grant made in an implementation or sandbox tenant has to be made again in production.

Workday can show you exactly which domain secures an operation, and which groups already have it:

1. Search for Sec Sec Item and open View Security for Securable Item.

2. Enter Get_Organizations and click View Security on the matching row.

3. The result shows the securing domain and the security groups that hold it. If the integration security group isn't listed, that's the gap.

You can do the same for any other resource that returns 403, using its operation name.

• Workday connection guide (full list of domains for each resource)

• Workday: How to use the Proxy API for HRIS SOAP requests