Deltek and ADP integration

What moves between them

The main flow runs from ADP into Deltek Vantagepoint. After each payroll run, ml-connector reads ADP's general ledger documents and posts the labor cost entries into Vantagepoint as journal entries, mapped to the matching GL accounts and organizations. Worker records flow the same direction so the Vantagepoint employee hub reflects ADP hires, terminations, and rehires. Cost centers and departments are aligned so payroll allocations land on valid Vantagepoint organizations. ADP GL documents are read-only, so ml-connector never writes financial entries back into payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted and presents the ADP client certificate at the TLS layer on every request, re-calling the ADP token endpoint when a call returns 401. On the Deltek side it accepts the full tenant deltekfirst.com URL, database name, and password-grant credentials per customer, refreshes the bearer token before it expires, and requires the API user to have accounting and administrator roles so journal entries are allowed to post. ADP GL documents read after each run become balanced journal entries in Vantagepoint, with ADP cost centers mapped to Vantagepoint organizations and GL accounts first so every line references a dimension that already exists. Because Vantagepoint has no signed webhook and Costpoint is pull-only, ml-connector polls ADP GL documents and worker data on a schedule tied to your payroll calendar, using page-based paging on the Deltek side. Vantagepoint has no idempotency key, so ml-connector checks for an existing entry before posting to avoid duplicates, backs off and retries when ADP returns HTTP 429, and tracks the ADP certificate expiry so a renewal does not become an outage.

A real-world example

A mid-sized architecture and engineering firm with around 250 staff runs Deltek Vantagepoint for project accounting, billing, and finance, and uses ADP Workforce Now for payroll across three studios. Before the integration, accounting exported the payroll register from ADP every pay period and typed the labor totals into Vantagepoint by hand as a journal entry, then spent the first days of month-end close reconciling headcount against the labor accounts in the ledger. With Deltek and ADP connected, each payroll run's GL document posts into Vantagepoint automatically, allocated to the organization for each studio, and worker changes keep both systems aligned. Close starts with the labor accounts already reconciled, and the manual re-keying is gone.

What you can do

• •Post ADP payroll general ledger documents into Deltek Vantagepoint as journal entries after every pay run.
• •Keep the Vantagepoint employee hub aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers and departments to Vantagepoint organizations and GL accounts so payroll lands on valid dimensions.
• •Authenticate ADP with OAuth2 and its required mutual TLS certificate, and Deltek with its tenant URL and password-grant token.
• •Poll on a schedule tied to your payroll calendar, with duplicate checks, retries, error replay, and a full audit trail on every record.

Questions

Which direction does data move between Deltek and ADP?

The main flow is ADP into Deltek Vantagepoint. Payroll GL documents and worker records move from ADP into Vantagepoint, while cost centers and departments are aligned so allocations match. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

Does ADP's mutual TLS certificate need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call, in addition to OAuth2 client credentials, and the handshake fails without it. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.

How does the integration handle Deltek's password-grant auth and lack of signed webhooks?

ml-connector accepts the full Vantagepoint tenant URL, database, and password-grant credentials per customer, and the API user needs accounting and administrator roles for journal entries to post. Because Vantagepoint webhooks carry no HMAC signature and Costpoint is pull-only, reads run on a schedule tied to your payroll calendar rather than relying on a push, with a duplicate check before each post since Vantagepoint has no idempotency key.