---
nav: wcp_docs
parent_url: /wcp_docs/
title: Workday Graph API Authentication and Security
layout: subsection
---

## <a id="section_1"></a>OAuth Authentication

The [Graph API endpoint](/wcp_docs/flw1653707569144.html) that submits queries and mutations uses the same OAuth authentication framework used by Workday REST services. Similar to REST API requests submitted from Extend pages and orchestrations, Graph API requests are directed through the centralized API Gateway, which routes the requests to the correct tenant. Configure the Graph API endpoint authentication in the same manner that you would configure a REST endpoint authentication in an Extend page or orchestration. For Extend pages, see [Declare Authentication Types in the SMD](/wcp_docs/nyw1530545468565.html) and [Define Endpoint Authentication in the PMD](/wcp_docs/yea1530546235609.html). For orchestrations, see [Create Orchestration Credentials](/wcp_docs/GUID-d93db6e9-f07a-4e89-9ad0-2070f54c3286.html) and [Concept: Data Operations Components in Extend Apps](/wcp_docs/GUID-93c511ea-b595-4e25-b2b8-9071c8bae439.html).

## <a id="section_n4h_k2t_wvb"></a>Security

Graph API uses the same Workday security configuration model used by Workday REST APIs. Configure Graph API users with <b>Read/Modify</b> permissions to access these domains:

-   <i>Graph API Descriptor</i>. This security domain is a system domain that grants everyone access to the `descriptor` fields in the schema. The <i>Graph API Descriptor</i> security domain doesn't govern access to underlying data services; we recommend leaving its default configuration.
-   <i>Workday Graph API Applications</i>. This security domain provides access to Workday Graph API. An easy configuration is to assign All Users to the Workday Graph API Applications domain.
-   The domains that control access to business objects specified in a query or mutation.

    The schema documentation lists the security domains in the <b>Secured by:</b> section of:

    -   Query field and data source descriptions.
    -   Mutation operation descriptions.

    When you edit the security policy permissions for the domain that secures a Graph API schema element, add a <b>Report/Task</b> permission for the security groups. Select the proper permission for each security group:

    -   View for queries.

        Ensure that the security policy for the data source is active and has the proper permissions.

    -   Modify for mutations.

        For mutations that submit a business process, ensure that the security policy for the initiating action of the business process has proper permissions.


    Example: A user can access a worker's original hire date in the schema if the user has access to both the Workday Graph API Applications and Worker Data: Current Staffing Information domains.

    <b>Note:</b> The default queries in the <b>Query</b> panel of the Graph API Explorer use the `indexedAllWorkers` data source. Ensure that you've enabled and configured the <i>Indexed Data Source: Workers</i> security policy.