REST API 403 Forbidden: Integration System User Lacks Security Access
The error 403 Forbidden
What it means
The REST API call reached Workday and authenticated fine, but the account calling it does not have a security group granting access to that resource, so Workday returns 403 instead of returning data. This is different from a 401, which means the credentials themselves were rejected.
Troubleshooting
- Confirm the call is actually failing with 403, not 401 - 403 means auth succeeded but authorization did not.
- Identify the Integration System User (ISU) tied to the API client and check which security groups it belongs to.
- Compare those groups against the domain security policy that protects the resource you are calling (e.g. Worktag maintenance, a specific Business Process, a custom report).
- Test the same call logged in as an admin account (via Postman or API Explorer) to confirm it is a security gap and not an endpoint or method mismatch.
⚡ Quick fix
Add the calling ISU's security group to the domain security policy that grants access to the resource, then re-test the call.
✓ Permanent fix
Build a checklist of required security-group grants per integration during setup, and re-validate ISU permissions whenever a new endpoint or resource is added to an existing integration.
Was this helpful?