# Workday RaaS 403 "not authorized" when the agent's integration user lost a security group

## TL;DR

The integration user's security group assignment changed, and Workday started 403ing its report calls. Re-grant the security group (or the underlying domain permissions), and monitor the integration user's group membership. Permission drift is the usual cause of 'it worked yesterday'.

```text
403 Forbidden: "not authorized" (Workday RaaS, integration user lost security group)
```

## Steps

1. Confirm the drift: compare the integration user's current security groups against the known-good set.
   Expected: The missing group is identified.

2. Re-grant the security group or have the Workday admin restore it.
   Expected: Calls succeed again.

3. Find what removed it: an automated deprovisioning, a role change, or a tenant config push.
   Expected: The cause is known.

4. Monitor the integration user's group membership with a periodic check.
   Expected: The next drift pages before it breaks the sync.

5. Document the required groups as code or config so rebuilds restore them.
   Expected: The permission set is reproducible.

## When to use

- Workday RaaS 403s on previously working calls
- the integration user's groups changed
- after tenant updates or deprovisioning runs

## When not to use

- it never worked (then the groups were never right; configure from scratch)
- the 403 is on a specific report (check the report's own permissions)
- the credentials expired (that is a 401, not a 403)

## Tool compatibility

- Workday RaaS
- security group administration

## Variant phrasings

- "workday 403 not authorized integration user"
- "workday security group lost"
- "workday raas forbidden"

## Why it happens

Workday permissions flow through security groups, and integration users are subject to the same lifecycle as humans: role changes, automated cleanups, and tenant refreshes all move group memberships. The agent's calls did not change; the user's permissions did. 'It worked yesterday' almost always means drift.

## Edge cases

- tenant refreshes from production can wipe test-tenant group assignments; reapply after refresh
- the monitor should check effective permissions, not just group names
- document the groups outside Workday; the tenant is not its own backup

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3ONYO2oHIhpi2WM3CtJcBg