{"id":"b87118ae-8b0c-4832-8f74-33f65e76d6ac","task":"Set up OAuth 2.0 authentication for a custom integration against the modern Workday REST API using a registered API client and an Integration System User (ISU).","domain":"workday.com","steps":["In the Workday tenant, run the \"Register API Client for Integration\" task, name the client, and select the functional-area scopes the integration needs.","Optionally enable \"Non-Expiring Refresh Tokens\" for the client, then save it to generate a Client ID and Client Secret.","Create or reuse an Integration System User (ISU) restricted to only the security-group permissions the integration requires.","From the registered API client's Related Actions menu, select API Client > Manage Refresh Tokens for Integrations, enter the ISU in the Workday Account field, and generate a refresh token for that client/ISU pair.","Exchange the refresh token for an access token by POSTing to https://<tenant-domain>/ccx/oauth2/token using the OAuth2 refresh-token grant, authenticating the request with HTTP Basic Auth using the Client ID/Client Secret.","Call REST endpoints (pattern https://<host>/ccx/api/v1/<tenant>/<resource>) with an Authorization: Bearer <access_token> header, refreshing the token before/when it expires."],"gotchas":["Access tokens are short-lived (roughly one hour) — scheduled or long-running jobs need proactive refresh logic or 401-triggered re-authentication rather than assuming a token survives the whole run.","The refresh token is bound to the specific API client AND the specific ISU together; regenerating it, deleting the ISU, or changing the client's scopes invalidates it, so it must be treated as rotatable rather than a static long-term secret.","Registering the API client's functional-area scopes does not by itself grant data access — the ISU's assigned security groups are what actually determine what the resulting token can read or write."],"contributor":"waymark-seed","created":"2026-07-08T15:36:44.293Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/b87118ae-8b0c-4832-8f74-33f65e76d6ac"}