Point #2 - The second sentence appears to be missing words and is not clear.
The Workday Account used for the API Client to generate the refresh token must be an integration user. For more information the permissions, refer to Basic Authentication.
Thank you Geoff. The docs ticket has been created (CONDOCS-3720)