Add Workday actions

When Workday actions are turned on, end users can ask the assistant to create time off requests.

For example, a user could enter "schedule time off for next wed" into your app. The assistant asks for additional details if necessary, and then asks the user to confirm the time off request.

The assistant can read and edit the following Workday fields through actions:

Field	Description
Start date	Required. First day of the time off request, inclusive.
End date	Required. Last day of the time off request, inclusive.
Type	Type of time off requested. Defaults to vacation.
Description	Description of the time off request.

Set up authentication and permissions in Workday

Before turning on Workday actions, a Workday administrator must authorize and set up a Workday connector for actions. This is required to connect your Workday integration and allow read and write permission for actions.

In Workday, enter Register API Client task into the search bar and select that task. The Register API Client form appears.
Enter a name for your new client.
For the client grant type, select Authorization Code Grant.
For the address token type, select Bearer.
Enter a refresh token timeout in days.
Enter the following redirect URI: https://vertexaisearch.cloud.google.com/oauth-redirect
Select the following scopes:
- Staffing
- Time Off and Leave
Click OK.
Workday shows the details of your new client. Save the following information:
- Client ID
- Client secret
- Authorization endpoint
Next to the client name, click the three-dot icon (...) and select Manage Refresh Tokens for Integrations.
Enter an authorized Workday account and click OK.
On the Delete or Regenerate Refresh Token page, select Generate New Refresh Token and click OK.
Take note of the refresh token.

Configure a Workday action

Before you begin, make sure that a Workday administrator has completed the steps in Set up authentication and permissions in Workday and provided you with the following:

Client ID
Client secret
Authorization endpoint URI

Configure Workday actions in the Google Cloud console

Google recommends that you create actions through the Google Cloud console. To add actions to your app using the console, do the following:

In the Agentspace, go to the Agentspace page.
Go to your app.
In the navigation menu, click Actions.
For Workday, click Connect.
Select a Workday instance.
If prompted, enter authorization information for your connector. This is only required if the instance has not been configured for an action yet.
Select which actions to enable.
Click Finish setup. Your action is displayed on the Actions page.

Configure Workday actions using the API

Google recommends that you create actions through the Agentspace. If you need to create actions using the API, do the following:

Create a workday connector:

SERVER=https://discoveryengine.googleapis.com

curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-H "X-GFE-SSL: yes" \
-H "X-Goog-User-Project: PROJECT_NUMBER" \
"$SERVER/v1alpha/projects/PROJECT_NUMBER/locations/global:setUpDataConnector" \
-d '{
  "collectionId": "PROJECT_NUMBER",
  "collectionDisplayName": "YOUR_COLLECTION_DISPLAY_NAME",
  "dataConnector": {
    "dataSource": "workday",
    "params": {
      "client_id": "{client id from workday oauth 2.0 app}",
      "client_secret": "{client id from workday oauth 2.0 app}",
      "refresh_token": "{refresh token from workday oauth 2.0 app}",
      "tenant": "{tenant from workday oauth 2.0 app}"
    },
    "refreshInterval": "{ >1800 }s",
    "entities": [
      {
        "entityName": "{workers/customers/jobs/organizations}"
      },
      {
        "entityName": "{workers/customers/jobs/organizations}" // Optional, you can build up to 4 different entities
      }
    ],
    "syncMode": "PERIODIC",
    "destinationConfigs": [
      {
        "key": "host",
        "destinations": [
          {
            "host": "destination-config"
          }
        ]
      }
    ],
  }
}'

Update the connector to include the action configurations created that you created:

PROJECT_NUMBER={YOUR PROJECT_NUMBER}
COLLECTION_ID="{YOUR COLLECTION ID}

curl -X PATCH \
  -H "Authorization: Bearer $(gcloud auth print-access-token --project "${PROJECT_NUMBER}")" \
  -H "Content-Type: application/json" \
  -H "X-Goog-User-Project: ${PROJECT_NUMBER}" \
  "$SERVER/v1alpha/projects/${PROJECT_NUMBER}/locations/global/collections/${COLLECTION_ID}/dataConnector?update_mask=action_config" \
  -d '{
    "name": "projects/${PROJECT_NUMBER}/locations/global/collections/${COLLECTION_ID}/dataConnector",
    "action_config": {
      "is_action_configured": true,
      "action_params": {
        ""client_id": "{client id from workday action oauth 2.0 app}",
        "client_secret": "{client secret from workday action oauth 2.0 app}",
        "auth_uri": "{Authorization endpoint from workdy action oauth 2.0 app}"
      }
    }
  }'

Enable Workday actions for your assistant:

SERVER=https://discoveryengine.googleapis.com
PROJECT_NUMBER={YOUR PROJECT_NUMBER}
ENGINE_ID="{YOUR ENGINE ID}"
CONNECTOR_ID="{THE CONNECTOR'S COLLECTION ID YOU GENERATED IN PREVIOUS STEP}"

curl -X PATCH \
  -H "Authorization: Bearer $(gcloud auth print-access-token --project "${PROJECT_NUMBER}")" \
  -H "Content-Type: application/json" \
  -H "X-Goog-User-Project: ${PROJECT_NUMBER}" \
  "$SERVER/v1alpha/projects/${PROJECT_NUMBER}/locations/global/collections/default_collection/engines/${ENGINE_ID}/assistants/default_assistant?update_mask=enabledActions" \
  -d '{
    "name": "projects/'"${PROJECT_NUMBER}"'/locations/global/collections/default_collection/engines/'"${ENGINE_ID}"'/assistants/default_assistant",
    "enabledActions": {
      "projects/'"${PROJECT_NUMBER}"'/locations/global/collections/'"${CONNECTOR_ID}"'/dataConnector": {
        "actionInfo": [
          {
            "actionName": "request_time_off",
            "actionDisplayName": "Request time off"
          }
        ]
      }
    }
  }'

After you add actions, the assistant can perform those actions on behalf of your end users in the app. The first time a user asks the assistant to perform a Workday action, they are asked to authorize access to their Workday account. To use the assistant, users must have Agentspace Enterprise Plus licenses.