Connect your Workday ATS to Lavalier to sync roles, candidates, résumés, and interviews.
Before You Start
- Owner permissions in Lavalier
- Admin access in Workday to create an integration system user, grant security permissions, and register an API client
First you'll configure Workday — an integration system user, a security group, and an API client. Then you'll paste four values into Lavalier.
Part 1: Set Up Workday
Create an Integration System User
Purpose: Creates the account Lavalier signs in as.
Log into Workday as an admin, then search for and select the Create Integration System User task.
Add your integration system user name and password, check Do Not Allow UI Sessions, and select OK. Example name:
LavalierIntegrationUserLeave all other defaults and select Done.
Create a Security Group
Purpose: Creates the security group that will hold Lavalier's permissions, and attaches your new user to it.
Search for and select the Create Security Group task.
Select Integration System Security Group (unconstrained), name your security group, and select OK. Example name:
Lavalier Integration ISSGFrom the Integration System User dropdown on the next screen, select the user you created, then select OK. The comment is optional.
Select Done.
Add Permissions to Your Security Group
Purpose: Grants your security group read access to the recruiting data Lavalier syncs, plus write access on the few records Lavalier updates.
Search for and select the Maintain Permissions for Security Group task.
In Security Group, search for and select the group you created, then select OK.
On the Domain Security Policy Permissions tab, select the ⊕ button at the top left of the table to add a row. Using the dropdowns, fill in one row for each line below:
| View/Modify Access | Domain Security Policy |
|---|---|
| Get and Put | Candidate Data: Job Application |
| Get and Put | Prospects |
| Get and Put | Move Candidate to Linked Requisition |
| Get Only | Candidate Data: Interview Schedule |
| Get Only | Candidate Data: Attachments |
| Get Only | Candidate Data: Questionnaires |
| Get Only | Candidate Data: Questionnaire Total Score |
| Get Only | Job Requisition Data |
| Get Only | Worker Data: Public Worker Reports |
| Get Only | Interview Integrations |
| Get Only | Integration Build |
| Get Only | Special OX Web Services |
| Get Only | Manage: Organization Integration |
| Get Only | Manage: Location |
| View Only | Workday Query Language |
- Select OK, then Done. Workday fills in the functional areas and inherited policies itself, and the alerts clear once you activate the changes further down.
Candidate Data: Job Application also covers the policies that inherit from it, including interview feedback, language skills, and job requisitions for recruiting. You don't add those separately.
Add Permitted Business Processes
Purpose: Lets Lavalier read the job application business process, which is where application and interview activity lives.
Search for and select the Edit Business Process Security Policy task.
In Business Process Type, search for and select Job Application, then select OK.
Under Who Can Do Actions on Entire Business Process, find the View All action and add your security group to its Security Groups list.
Select OK.
Activate Pending Security Changes
Purpose: Workday holds security edits until you activate them, so nothing above takes effect until this runs.
Search for and select the Activate Pending Security Policy Changes task.
Type a short description of your changes in Comment and select OK.
Review the changes, check Confirm, and select OK.
Register the Lavalier API Client
Purpose: Creates the OAuth client Lavalier authenticates with, and produces the first two values you'll paste into Lavalier.
Search for and select the Register API Client for Integrations task.
Type a memorable Client Name. Example:
Lavalier IntegrationCheck Non-Expiring Refresh Tokens so you don't have to reconnect later.
In Scope (Functional Areas), search for and select all six: Integration, Organizations and Roles, Pre-Hire Process, Recruiting, Staffing, and System.
Leave all other defaults and select OK.
On the confirmation screen, copy the Client Secret somewhere safe. Workday shows it only once, and there's no way to retrieve it later without generating a new one.
Select OK.
Create a Refresh Token
Purpose: Produces the token that lets Lavalier sign in as your integration system user.
Search for and select the View API Clients task.
Open the API Clients for Integrations tab and select your new client by name.
Select the … menu beside the client name in the header, hover over API Client, and choose Manage Refresh Tokens for Integrations.
Select the integration system user you created, then select OK.
Check Generate New Refresh Token and select OK.
Copy the Refresh Token from the table.
While you're on the View API Clients report, collect the last two values:
- API Client ID — at the bottom of your API client's detail page.
- Token Endpoint URL — it looks like
https://wd5-services1.myworkday.com/ccx/oauth2/your_tenant/token. Lavalier reads your services host and tenant straight from this URL, so you don't enter them separately.
Part 2: Connect Workday to Lavalier
You should now have four values from Workday: API Client ID, API Client Secret, Refresh Token, and Token Endpoint URL.
In Lavalier, go to Settings → Integrations
Find Workday and click Connect
In the Connect Workday dialog, enter:
- API Client ID
- API Client Secret
- Refresh Token
- Workday OAuth token endpoint URL
- Workday UI Base URL — labeled optional, but enter it: your Workday web address, like
https://wd5.myworkday.com/your_tenant. Otherwise Lavalier guesses, and Open in Workday links may not match.
Click Connect
Lavalier verifies your credentials and starts syncing. You'll see Connected - Syncing up to date information... while it works, then Importing résumés… [x] of [y] as it pulls résumés, and finally Connected - Last synced [time] once it's done.
What Happens Next
Once connected, Lavalier syncs from Workday:
- Roles — from your open job requisitions, including title, department, location, work type, and the requisition ID
- Candidates — including names, contact details, location, profile links, and their current title and company as parsed from their Workday résumé
- Applications — mapped to the matching role, with their Workday stage and disposition
- Résumés — imported automatically to each candidate's profile
- Interviews — one per scheduled Workday interview session, with the scheduled time, meeting details, and panel. Interviewers who aren't in Lavalier yet are invited automatically
What doesn't sync
A few things are held back on purpose, so don't be thrown if you can't find them:
- Candidates still in application review — someone whose applications are all sitting in Review or Assessment stays in Workday until they reach an interviewing stage.
- Sessions Workday hasn't finished scheduling — if you pick a date in Workday but never set a time, Workday records the session at midnight and Lavalier treats it as not yet scheduled. Use Workday's Schedule button to give each session a real time, and it arrives on the next sync.
- Sessions already in the past — a first sync deliberately skips Workday's interview history, so no one gets an invite for a conversation that already happened.
- Sessions on an application that's done interviewing — once an application moves to reference, background, offer, employment agreement, hired, rejected, or declined, Lavalier stops creating new interviews for it. Interviews that already exist are untouched.
With the UI Base URL set, synced candidates, roles, and interviews each get an Open in Workday link that jumps straight to the matching record in your tenant.
Check the Integrations page any time to see sync status and progress.
What's next?
With Workday connected, you can:
- Customize Interview Stages for a Role — Shape the stage structure on your synced roles
- Prepare Interview Questions — Add questions to each stage
- Create and Schedule Interviews — Start interviewing your synced candidates
Troubleshooting
Lavalier says "Workday rejected the API client credentials"
The full message is: "Workday rejected the API client credentials. Verify the client ID and secret, generate a new refresh token, and try again."
Workday didn't accept the credentials themselves. Re-check the API Client ID and API Client Secret for typos or trailing spaces, then generate a fresh refresh token in Manage Refresh Tokens for Integrations and try again. Refresh tokens can be revoked or expire, so a token that worked before may simply need replacing.
Lavalier says "Workday accepted the credentials but denied access"
The full message is: "Workday accepted the credentials but denied access. Verify the API client's Functional Areas and the associated ISU's domain permissions, activate any pending security policy changes, and try again."
Your credentials are valid, but the API client isn't authorized for the data Lavalier needs. In Workday, check the Functional Areas granted to the API client and the domain security policy permissions on the integration system user it acts as. If you've just changed a security policy, remember to activate pending security policy changes — Workday won't honor them until you do.
Lavalier says "Couldn't reach Workday's token endpoint"
The full message is: "Couldn't reach Workday's token endpoint. Verify the Token Endpoint URL and network access, then try again."
Lavalier couldn't get a response from the URL you entered. Confirm the Token Endpoint URL is copied exactly from Workday's View API Clients report, and that the host is reachable.
Lavalier says "Unable to connect"
The full message is: "Unable to connect. Verify the API client ID, secret, refresh token, and Workday tenant." Work through all four values — the tenant comes from the token endpoint URL, so a wrong tenant usually means the URL was copied from the wrong place.
I see "Reconnect required to resume syncing"
Your refresh token is no longer valid, so syncing has paused. Generate a new refresh token in Workday's Manage Refresh Tokens for Integrations, then open Settings → Integrations → Workday → Settings, paste the new token, and click Connect. You don't need to re-enter your API Client Secret — leave the dots in place.
My stage changes in Lavalier aren't showing up in Workday
Solution: Workday doesn't manage interview stages, so Workday-synced roles start with your account's default Lavalier stages and stay fully editable — add, rename, reorder, and remove them just like on a role you built by hand. Moving a candidate between stages stays in Lavalier, and you'll see "Stage changes won't sync to Workday and stay in Lavalier." above your pipeline.
I can't edit a candidate's title, company, or location
Solution: For candidates synced from Workday, the title, company, and location fields are read-only in Lavalier. Current title and company are derived from the candidate's Workday résumé, and location is a structured Workday address, so neither can be written back safely. To change them, update the candidate in Workday and the changes will sync to Lavalier.
I can only add one email address and one phone number
Solution: Workday stores a single email and a single phone number per candidate, so Lavalier matches that limit on Workday-synced candidates to keep the two systems in step.
I can't edit a role's Work Type
Solution: For roles synced from Workday, Work Type comes from the requisition's Time Type. Clicking it opens a dialog—"You need to do that in Workday"—with a button to open the role in Workday. Location and department behave the same way.
Worth knowing: Lavalier imports a role's details once, when the role first syncs. Changing Work Type, location, or department in Workday after that won't update the role in Lavalier.
I can't cancel or edit a Workday interview
Solution: Interviews synced from Workday are managed in Workday. When you try to cancel or edit one, you'll see a dialog—"This interview is managed by Workday. Open the candidate in Workday to make changes."—with a button to open the candidate directly in Workday. The date, time, role, and stage all have to change in Workday.
Two things you can still do here: set a phone number for the interview, and—when Workday's session lists more than one interviewer Lavalier recognizes—pick which of them owns it in Lavalier. Once someone picks, the choice sticks and the picker goes away.
"Merge with…" is greyed out on a Workday candidate
Solution: Merging isn't available for Workday-linked candidates yet. The menu item stays visible with the tooltip "Merging candidates integrated with Workday is not supported yet."
I can't move a candidate whose application is archived in Workday
Solution: Workday owns archive state. You'll see "You need to do that in Workday" with the message "This application is archived in Workday. To change its stage or move it back into the pipeline, reopen it in Workday — Lavalier will pick up the change on the next sync." Reopen the application in Workday and it'll come back into your Lavalier pipeline on the next sync.
I see "Interviewer is in a Separate Lavalier Team"
Solution: The interviewer Workday assigned already has a Lavalier account on a different team, so Lavalier can't invite them to yours. Open the candidate in Workday and assign a different interviewer.
Error: "You already have [ATS] connected. Disconnect it first to connect Workday."
Solution: You can only have one ATS connected to Lavalier at a time. Disconnect your existing ATS from Settings → Integrations, then try again.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article