---
category: [Administration & Integrations, Administration & Integrations/Workday API, Platform and Product Extensions, Platform and Product Extensions/Integration]
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Concept: Workday REST API Security
layout: subsection
---

<a id="section_aqc_jf1_lwb"></a>
Workday REST APIs use OAuth and the Workday configurable security model to secure interactive transactions in end-user applications. REST APIs act on behalf of the individual using the client. The user's security profile affects the REST API access to Workday resources.

## <a id="section_cm3_jf1_lwb"></a>Security Policies

Workday secures each REST API endpoint to a domain or business process security policy. Each endpoint can access only the domains and business processes that the current user can access.

The domain security policies control who can view and modify Workday data through the REST APIs. For each Workday REST API invoked by your application, configure the appropriate domain security policies. When you edit the security policy permissions for the domain that secures the REST API, add a <b>Report/Task</b> permission for the security groups. Select the proper permission for each security group:

-   <b>View</b> for the GET method.
-   <b>Modify</b> for the POST, PUT, PATCH, DELETE methods.


<b>Note:</b> Workday REST APIs require the <b>Report/Task Permissions</b> in the security policy, whether the user is an ISU or an individual user. The <b>Integration Permissions</b> only apply to Workday SOAP web services.

The business process security policies control which security groups have permission to perform business process actions.

If the current user can't access the domain or business process, the REST API returns an error. Example: The `GET /supervisoryOrganizations` REST API returns only the organizations that the user has authorization to access.

If your app calls a REST API sub-resource, ensure that the user has access to the parent resource. Example: If the app calls the `POST /workers/employee_123/requestTimeOff` sub-resource in the Absence Management REST service, ensure that the user has permissions to access <i>workers/employee_123</i>.

The endpoint descriptions in the [REST API Explorer on the Developer Site](https://developer.workday.com/rest-api-explorer) or [Workday REST Services Directory](https://community.workday.com/sites/default/files/file-hosting/restapi/index.html) include the domains that secure the endpoints. The endpoint descriptions also include the scope, which is the corresponding Workday functional area.

### Related Information

[Administrator Guide: Setup Considerations: Configurable Security](https://doc.workday.com/admin-guide/en-us/authentication-and-security/configurable-security/configurable-security-basics/hvd1584721688659.html?toc=2.0.0)