Skip to main content

Set up Workday Prism Analytics

TL;DR

:::warning Who can do this? You need a Workday administrator to complete these steps in your Workday tenant.

Connect
Who can do this?

You need a Workday administrator to complete these steps in your Workday tenant.

Atlan authenticates to Workday Prism Analytics as an OAuth 2.0 API client backed by a dedicated Integration System User (ISU). Setting this up involves three parts:

  1. Create an Integration System User (ISU) for Atlan.
  2. Register an API client for integrations and generate a refresh token for that ISU.
  3. Grant the ISU the security groups it needs to read Prism tables and Data Change Tasks.
info

Workday's Prism Analytics permission model is stricter than most of its other REST APIs. A single Integration System Security Group isn't enough—you also need a dedicated Prism Access Security Group that wraps it. The steps below reflect the configuration that has been verified to work; step names and domain security policies may vary slightly by Workday tenant version.

Create your Workday integration system user​

To create a dedicated Workday account for Atlan:

  1. Access the Create Integration System User task.
  2. Enter a User Name, for example ISU_Atlan_Prism_Analytics.
  3. Keep Session Timeout Minutes at 0 to prevent the session from expiring mid-extraction.
  4. Select the Do Not Allow UI Sessions checkbox. This prevents the ISU from being used to sign in to Workday through the UI.
  5. Click OK and then Done.

Create and grant your integration system security group​

The Integration System Security Group (ISSG) is what makes the ISU usable by an integration, and carries the generic Integration and Prism connectivity grants Atlan needs.

  1. Access the Create Security Group task.

  2. For Type of Security Group to Create, select Integration System Security Group (Unconstrained).

  3. Provide a name, for example ISSG Atlan Prism Analytics.

  4. For Integration System Users, add the ISU you just created.

  5. Click OK and then Done.

  6. Access the Domain Security Policies for Securable Item Type (or Maintain Permissions for Security Group) task for the new security group, and grant it access to the following Domain Security Policies:

    Domain Security PolicyFunctional areaAccess to grant
    Integration SubscriptionsIntegrationView Only, Get Only, View and Modify, Get and Put
    Integration ReportsIntegrationView Only, Get Only, View and Modify, Get and Put
    Integration ConfigureIntegrationView Only, Get Only, View and Modify, Get and Put
    Integration EventIntegrationView Only, Get Only, View and Modify, Get and Put
    Integration DebugIntegrationView Only, Get Only, View and Modify, Get and Put
    Integration ProcessIntegrationView Only, Get Only, View and Modify, Get and Put
    Integration SecurityIntegrationView Only, Get Only, View and Modify, Get and Put
    Integration BuildIntegrationView Only, Get Only, View and Modify, Get and Put
    Prism: Manage File ContainersPrism AnalyticsView Only, Get Only, View and Modify, Get and Put
    Prism: Manage ConnectionPrism AnalyticsView Only, Get Only, View and Modify, Get and Put
    info

    Grant all four of these access levels to every policy in the table, even though Atlan only ever issues read (Get) calls. This isn't called out in Workday's own documentation, but was found to be necessary during the development of this connector: Prism Analytics' permissioning requires the write-capable tiers (View and Modify, Get and Put) in addition to View Only and Get Only; a narrower, read-only grant has been observed to fail GET /dataChanges calls.

  7. Run the Activate Pending Security Policy Changes task, enter a reason for the audit, and confirm—this applies the permission changes across the tenant.

Create and grant your Prism access security group​

Prism Analytics table-level access is gated by a separate security group type. Create this in addition to the ISSG you just created, and nest that ISSG inside it.

  1. Access the Create Security Group task again.

  2. For Type of Security Group to Create, select Prism Access Security Group.

  3. Provide a name, for example Prism Analytics User (PRISM Access).

  4. For Unconstrained Security Groups, add the ISSG you created in the previous section (for example, ISSG Atlan Prism Analytics). This is what makes the ISU's permissions here inherit down from the ISSG.

  5. Click OK and then Done.

  6. Grant this security group access to the following Domain Security Policies:

    Domain Security PolicyFunctional areaAccess to grant
    Prism Datasets: CreatePrism AnalyticsView Only, Get Only
    Prism Datasets: ManagePrism AnalyticsView Only, Get Only
    Prism Datasets: PublishPrism AnalyticsView Only, Get Only
    Prism Datasets: Owner ManagePrism AnalyticsView Only, Get Only
    Prism: Delete Table DataPrism AnalyticsView Only, Get Only
    Prism: Update Table DataPrism AnalyticsView Only, Get Only
    Prism: Truncate Table DataPrism AnalyticsView Only, Get Only
    Prism: Select Table DataPrism AnalyticsView Only, Get Only
    Prism: Insert Table DataPrism AnalyticsView Only, Get Only
    Prism: Tables CreatePrism AnalyticsView Only, Get Only
    Prism: Tables Manage SchemaPrism AnalyticsView Only, Get Only
    Prism: Manage Relax SharingPrism AnalyticsView Only, Get Only
    Prism: Manage Data SourcePrism AnalyticsView Only, Get Only
    Prism: Tables ManagePrism AnalyticsView and Modify, Get and Put
    Prism: Tables Owner ManagePrism AnalyticsView and Modify, Get and Put
    warning

    Prism: Tables Manage and Prism: Tables Owner Manage don't offer a read-only access tier in Workday at all—View and Modify and Get and Put are the only grants available for these two policies, even though Atlan never writes to Prism table data.

  7. Run Activate Pending Security Policy Changes again to apply these changes.

Register your Workday API client​

  1. Access the Register API Client for Integrations task.

  2. Enter a Client Name, for example Atlan Integration Client.

  3. Leave Non-Expiring Refresh Tokens selected (Workday selects this by default) so Atlan's refresh token doesn't expire.

  4. For Scope (Functional Areas), select at minimum:

    • Integration
    • Prism Analytics
    • System
    • Tenant Non-Configurable

    Also select any other functional area (for example, Accounting Center or Analytical Framework) that owns the specific Prism datasets or Data Change Tasks you want to catalog—Workday scopes API access by functional area, so a scope that isn't selected here makes its data invisible to the client even if the ISU otherwise has permission.

  5. Select the Include Workday Owned Scope checkbox.

  6. Click OK to register the client.

  7. Copy the Client ID and Client Secret and store them securely—the secret can't be retrieved again once you navigate away from this page. If you lose it, use the Generate New API Client Secret task.

Generate your refresh token​

  1. From the API client you just registered, use the related action API Client > Manage Refresh Tokens for Integrations.
  2. For Workday Account, select the Integration System User you created earlier (for example, ISU_Atlan_Prism_Analytics).
  3. If a refresh token already exists, select Confirm Delete to remove it.
  4. Select Generate New Refresh Token, and copy the generated token.

You now have the four values Atlan needs to authenticate: Client ID, Client Secret, Refresh Token, and your Workday Tenant name.

Find your data center host​

You need your Workday tenant's data center host to configure the connection in Atlan.

To identify it:

  1. In Workday, access the View API Clients or any REST API integration task for your tenant.
  2. Note the host portion of the tenant's REST API endpoint, for example wd2-impl-services1.workday.com. This is the value Atlan calls the Base URL.

Both the host and your tenant name are also visible in the URL of your Workday tenant.