---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, Workday AI Gateway, AI Gateway]
nav: wcp_docs
parent_url: /wcp_docs/
title: Get User OAuth Token for WQL Permissions
layout: subsection
---

### Prerequisites

Security:

-   <i>Workday Query Language</i> domain in the System functional area.


### Context

A given user OAuth token enables the [Generate WQL REST API](/wcp_docs/GUID-e50a3478-d091-4f09-87f9-d96d77bb6a71-enHYPHENus.html) to apply proper security before including Workday IDs of instance fields in the generated WQL statement. This user OAuth token provides appropriate access to Workday data via WQL. This token is separate from the authentication token that allows access to the Generate WQL REST API call.

### Steps

1.  Register a WQL API client in your tenant using the <b>Register API Client for Integrations</b> task.

    See [Administrator Guide: Register API Clients for Integrations](https://doc.workday.com/admin-guide/en-us/authentication-and-security/authentication/oauth/dan1370797831458.html).

    <b>Note:</b> When you register the API client for WQL, select <b>System</b> from the <b>Scope (Functional Areas)</b> prompt.

2.  Save the generated client ID and client secret.

    Get the base64 encoded value of the concatenated `<client ID>:<client secret>` string.

3.  Get a refresh token using the <b>View API Clients</b> report.
    1.  Access the <b>View API Clients</b> report.
    2.  On the <b>API Client for Integrations</b> tab, in the <b>API Client</b> column, select the WQL API client you registered.
    3.  On the related actions menu, select <b>API Client</b> &gt; <b>Manage Refresh Tokens for Integrations</b>.
    4.  Select the Workday account who will be calling the Generate WQL REST API.
    5.  On <b>Delete or Regenerate Refresh Token</b>, select <b>Generate New Refresh Token</b>, and click <b>OK</b>.
    6.  On <b>Successfully Regenerated Refresh Token</b>, copy the generated refresh token and save it for the token endpoint.

4.  Call the tenant `token` endpoint.

    -   URL: Copy the full Token Endpoint URL from the <b>View API Clients</b> report.

        Example: <i>https://mywdaytenant.com/ccx/oauth2/mytenant/token</i>

    -   HTTP method: `GET`
    -   HTTP header: Authorization: `Basic` <base64_encoded_client_id:client_secret>
    -   HTTP header: Content-type: `application/x-www-form-urlencoded`
    -   Request body

        -   `grant_type` - Specify `refresh_token`.
        -   `refresh_token` - The generated refresh token from the <b>View API Clients</b> report.




### Example

This sample request calls the `token` endpoint.

```
curl --request GET \
--url https://myworkdaysuv.com/oauth2/super/token \
--header 'Authorization: Basic <base64_encoded_client_id:client_secret>' \
--header 'content-type: application/x-www-form-urlencoded' \
--data grant_type=refresh_token \
--data refresh_token=<wql_api_client_refresh_token>
 
```

Sample response:

```
{
"access_token": "<generated_access_token>",
"token_type": "Bearer",
"refresh_token": "<generated_refresh_token>"
}
 
```

### Next Steps

<a id="postreq_1"></a>
Copy the <generated_access_token> from the `token` endpoint response to the `user_oauth_token` field in the request body for the Generate WQL REST API.

### Related Information

[Concept: Workday Query Language (WQL)](/wcp_docs/GUID-6546152a-bcf0-447d-8d64-230f9e2ac291-enHYPHENus.html)