## Set up Workday Prism Analytics

URL: https://docs.atlan.com/apps/connectors/business-intelligence/workday-prism-analytics/how-tos/set-up-workday-prism-analytics

> :::warning Who can do this? You need a Workday administrator to complete these steps in your Workday tenant.

:::warning Who can do this?
 You need a Workday administrator to complete these steps in your Workday tenant.
:::

Atlan authenticates to Workday Prism Analytics as an OAuth 2.0 API client backed by a dedicated Integration System User (ISU). Setting this up involves three parts:

1. Create an Integration System User (ISU) for Atlan.
2. Register an API client for integrations and generate a refresh token for that ISU.
3. Grant the ISU the security groups it needs to read Prism tables and Data Change Tasks.

:::info
Workday's Prism Analytics permission model is stricter than most of its other REST APIs. A single Integration System Security Group isn't enough—you also need a dedicated **Prism Access Security Group** that wraps it. The steps below reflect the configuration that has been verified to work; step names and domain security policies may vary slightly by Workday tenant version.
:::

## Create your Workday integration system user

To create a dedicated Workday account for Atlan:

1. Access the **Create Integration System User** task.
2. Enter a **User Name**, for example `ISU_Atlan_Prism_Analytics`.
3. Keep **Session Timeout Minutes** at `0` to prevent the session from expiring mid-extraction.
4. Select the `Do Not Allow UI Sessions` checkbox. This prevents the ISU from being used to sign in to Workday through the UI.
5. Click **OK** and then **Done**.

## Create and grant your integration system security group

The Integration System Security Group (ISSG) is what makes the ISU usable by an integration, and carries the generic Integration and Prism connectivity grants Atlan needs.

1. Access the **Create Security Group** task.
2. For _Type of Security Group to Create_, select **Integration System Security Group (Unconstrained)**.
3. Provide a name, for example `ISSG Atlan Prism Analytics`.
4. For _Integration System Users_, add the ISU you just created.
5. Click **OK** and then **Done**.
6. Access the **Domain Security Policies for Securable Item Type** (or **Maintain Permissions for Security Group**) task for the new security group, and grant it access to the following Domain Security Policies:

 | Domain Security Policy | Functional area | Access to grant |
 | --- | --- | --- |
 | Integration Subscriptions | Integration | View Only, Get Only, View and Modify, Get and Put |
 | Integration Reports | Integration | View Only, Get Only, View and Modify, Get and Put |
 | Integration Configure | Integration | View Only, Get Only, View and Modify, Get and Put |
 | Integration Event | Integration | View Only, Get Only, View and Modify, Get and Put |
 | Integration Debug | Integration | View Only, Get Only, View and Modify, Get and Put |
 | Integration Process | Integration | View Only, Get Only, View and Modify, Get and Put |
 | Integration Security | Integration | View Only, Get Only, View and Modify, Get and Put |
 | Integration Build | Integration | View Only, Get Only, View and Modify, Get and Put |
 | Prism: Manage File Containers | Prism Analytics | View Only, Get Only, View and Modify, Get and Put |
 | Prism: Manage Connection | Prism Analytics | View Only, Get Only, View and Modify, Get and Put |

 :::info
 Grant all four of these access levels to every policy in the table, even though Atlan only ever issues read (`Get`) calls. This isn't called out in Workday's own documentation, but was found to be necessary during the development of this connector: Prism Analytics' permissioning requires the write-capable tiers (**View and Modify**, **Get and Put**) in addition to **View Only** and **Get Only**; a narrower, read-only grant has been observed to fail `GET /dataChanges` calls.
 :::

7. Run the **Activate Pending Security Policy Changes** task, enter a reason for the audit, and confirm—this applies the permission changes across the tenant.

## Create and grant your Prism access security group

Prism Analytics table-level access is gated by a separate security group type. Create this **in addition to** the ISSG you just created, and nest that ISSG inside it.

1. Access the **Create Security Group** task again.
2. For _Type of Security Group to Create_, select **Prism Access Security Group**.
3. Provide a name, for example `Prism Analytics User (PRISM Access)`.
4. For _Unconstrained Security Groups_, add the ISSG you created in the previous section (for example, `ISSG Atlan Prism Analytics`). This is what makes the ISU's permissions here inherit down from the ISSG.
5. Click **OK** and then **Done**.
6. Grant this security group access to the following Domain Security Policies:

 | Domain Security Policy | Functional area | Access to grant |
 | --- | --- | --- |
 | Prism Datasets: Create | Prism Analytics | View Only, Get Only |
 | Prism Datasets: Manage | Prism Analytics | View Only, Get Only |
 | Prism Datasets: Publish | Prism Analytics | View Only, Get Only |
 | Prism Datasets: Owner Manage | Prism Analytics | View Only, Get Only |
 | Prism: Delete Table Data | Prism Analytics | View Only, Get Only |
 | Prism: Update Table Data | Prism Analytics | View Only, Get Only |
 | Prism: Truncate Table Data | Prism Analytics | View Only, Get Only |
 | Prism: Select Table Data | Prism Analytics | View Only, Get Only |
 | Prism: Insert Table Data | Prism Analytics | View Only, Get Only |
 | Prism: Tables Create | Prism Analytics | View Only, Get Only |
 | Prism: Tables Manage Schema | Prism Analytics | View Only, Get Only |
 | Prism: Manage Relax Sharing | Prism Analytics | View Only, Get Only |
 | Prism: Manage Data Source | Prism Analytics | View Only, Get Only |
 | Prism: Tables Manage | Prism Analytics | View and Modify, Get and Put |
 | Prism: Tables Owner Manage | Prism Analytics | View and Modify, Get and Put |

 :::warning
 `Prism: Tables Manage` and `Prism: Tables Owner Manage` don't offer a read-only access tier in Workday at all—**View and Modify** and **Get and Put** are the only grants available for these two policies, even though Atlan never writes to Prism table data.
 :::

7. Run **Activate Pending Security Policy Changes** again to apply these changes.

## Register your Workday API client

1. Access the **Register API Client for Integrations** task.
2. Enter a **Client Name**, for example `Atlan Integration Client`.
3. Leave **Non-Expiring Refresh Tokens** selected (Workday selects this by default) so Atlan's refresh token doesn't expire.
4. For _Scope (Functional Areas)_, select at minimum:
 - **Integration**
 - **Prism Analytics**
 - **System**
 - **Tenant Non-Configurable**

 Also select any other functional area (for example, **Accounting Center** or **Analytical Framework**) that owns the specific Prism datasets or Data Change Tasks you want to catalog—Workday scopes API access by functional area, so a scope that isn't selected here makes its data invisible to the client even if the ISU otherwise has permission.

5. Select the **Include Workday Owned Scope** checkbox.
6. Click **OK** to register the client.
7. Copy the **Client ID** and **Client Secret** and store them securely—the secret can't be retrieved again once you navigate away from this page. If you lose it, use the **Generate New API Client Secret** task.

## Generate your refresh token

1. From the API client you just registered, use the related action **API Client > Manage Refresh Tokens for Integrations**.
2. For _Workday Account_, select the Integration System User you created earlier (for example, `ISU_Atlan_Prism_Analytics`).
3. If a refresh token already exists, select **Confirm Delete** to remove it.
4. Select **Generate New Refresh Token**, and copy the generated token.

You now have the four values Atlan needs to authenticate: **Client ID**, **Client Secret**, **Refresh Token**, and your Workday **Tenant** name.

## Find your data center host

You need your Workday tenant's data center host to configure the connection in Atlan.

To identify it:

1. In Workday, access the **View API Clients** or any REST API integration task for your tenant.
2. Note the host portion of the tenant's REST API endpoint, for example `wd2-impl-services1.workday.com`. This is the value Atlan calls the _Base URL_.

Both the host and your tenant name are also visible in the URL of your Workday tenant.

---