Deltek and SAP Ariba integration

What moves between them

The main flow runs from SAP Ariba into Deltek. ml-connector submits Ariba reporting jobs for purchase orders and invoice headers, downloads the results, and posts them into Deltek as project commitments and AP invoices, mapped to the matching Deltek firms, projects, and GL accounts. Supplier records move in both directions so the Deltek firm master and the Ariba supplier list stay aligned, using the Supplier Data API to read and update supplier and registration status. Accounting dimensions such as cost centers and GL accounts ride on Ariba document lines and are mapped to Deltek organizations and accounts. SAP Ariba has no GL account API, so the ledger stays in Deltek and ml-connector never writes journal entries back into Ariba.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the SAP Ariba side it requests an OAuth2 client-credentials token, refreshes it before its one-hour expiry, and sends the apiKey header and realm query parameter on every call, since missing either returns a 401. On the Deltek side it accepts the full tenant URL per customer, requests an OAuth2 password-grant token after Allow Password Grant Type is enabled, and refreshes the bearer token when a call returns 401. Because Ariba bulk data is job-based, it submits a reporting job filtered by an updated-date window, polls for completion, and pages the result with pageToken, keeping a high-water-mark timestamp so the next run only reads new documents. Firms and accounts are mapped first, so every posted AP invoice references a Deltek firm, project, and GL account that already exists. Deltek has no idempotency key header, so before posting ml-connector queries Deltek by invoice number and dedupes on a BullMQ jobId to avoid double-booking a re-read document. Ariba enforces strict per-API rate limits and a one-year job window, so ml-connector reads the X-RateLimit-Remaining-minute header, backs off before a 429, and splits a multi-year backfill into annual chunks. Because Vantagepoint webhooks are workflow-driven with no signature and Costpoint is pull-only, Deltek is read by polling rather than push. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized engineering and architecture firm with roughly 400 staff runs Deltek Vantagepoint for project accounting, AP, and the general ledger, and uses SAP Ariba for procurement and supplier onboarding across several offices. Before the integration, a clerk pulled purchase order and invoice reports out of Ariba each week and re-keyed them into Deltek as project commitments and vendor invoices, which left commitments lagging real spend, introduced typos in account and project codes, and let the vendor and supplier lists drift apart. With Deltek and SAP Ariba connected, each Ariba reporting job's purchase orders and invoices flow into Deltek allocated to the right project and GL account, supplier records stay aligned in both systems, and the ledger stays the single source of truth. Project managers see committed costs in near real time and month-end close starts from reconciled numbers.

What you can do

• •Post SAP Ariba purchase orders and invoice headers into Deltek as project commitments and AP invoices against the right firms and projects.
• •Keep the Deltek firm master and the SAP Ariba supplier list aligned using the Supplier Data API in both directions.
• •Map SAP Ariba accounting dimensions on document lines to Deltek GL accounts and organizations so spend lands on valid codes.
• •Authenticate SAP Ariba with OAuth2 plus the apiKey header and realm parameter, and Deltek with its tenant-specific password-grant token.
• •Submit and poll Ariba reporting jobs on a schedule, with invoice-number and jobId dedup, rate-limit backoff, retries, and a full audit trail on every record.

Questions

Which direction does data move between Deltek and SAP Ariba?

The main flow is SAP Ariba into Deltek. Purchase orders and invoice headers move from Ariba into Deltek as project commitments and AP invoices, while supplier records are aligned in both directions through the Supplier Data API. SAP Ariba has no dedicated GL account API, so the chart of accounts stays in Deltek and ml-connector never writes journal entries back into Ariba.

How does the integration pull procurement data out of SAP Ariba?

Most Ariba bulk data is not available from a simple GET endpoint. ml-connector submits an Operational Reporting job filtered by an updated-date window, polls for completion, and downloads the result in pages using the pageToken cursor. It keeps a high-water-mark timestamp between runs and splits any backfill longer than Ariba's one-year window into annual chunks.

How does ml-connector bridge the two different authentication schemes?

SAP Ariba requires an OAuth2 bearer token plus a static apiKey header on every call, with the realm passed as a query parameter, and missing any of these returns a 401. Deltek Vantagepoint uses OAuth2 password grant against a per-company tenant URL. ml-connector stores both credential sets encrypted, refreshes each bearer token before its roughly one-hour expiry, and presents the right headers and parameters to each system on every request.