Deltek and BambooHR integration

What moves between them

The flow runs from BambooHR into Deltek Vantagepoint. ml-connector reads employee records, job-information rows, and compensation rows from BambooHR and writes them to the Vantagepoint employee hub: first and last name and work email map to the employee name and email, department and division map to the Vantagepoint department and organization, hire date and termination date map to the matching hub fields, and BambooHR pay rates can populate Vantagepoint cost and bill rates where the firm wants them. New employees create a hub record, updates patch the existing one, and a termination in BambooHR sets the termination date in Deltek. BambooHR holds no vendors, invoices, or GL accounts, so nothing financial moves, and Deltek does not write people data back into BambooHR, which stays the system of record.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the BambooHR side it runs OAuth 2.0 against the customer's own subdomain for both the authorize and token URLs, since BambooHR has no global token endpoint, and refreshes the one-hour access token with the offline_access refresh token. It verifies each webhook with a timing-safe SHA-256 HMAC check over the raw body plus the X-BambooHR-Timestamp header, then calls GET /api/v1/employees/{id} with an explicit fields list to pull the current values, because the webhook payload only names the employee and the changed fields. On the Deltek side it accepts the full tenant deltekfirst.com URL, database name, and password-grant credentials per customer, requires the Allow Password Grant Type setting and an API user with employee and accounting role permissions, and refreshes the bearer token before it expires. Departments are mapped to Vantagepoint organizations first, so every employee references a dimension that already exists. Because Vantagepoint has no idempotency key, ml-connector matches on the BambooHR employee id stored against the Vantagepoint employee number and checks for an existing hub record before writing, so a re-delivered webhook patches rather than duplicates. A scheduled page-based poll of BambooHR backfills anything a webhook missed, and a BambooHR 503 with a Retry-After header is honored rather than hammered. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A 300-person architecture and engineering firm runs Deltek Vantagepoint for project accounting, billing, and resource planning, and uses BambooHR as the HR system of record for hires, departments, and pay. Before the integration, an operations coordinator copied each new hire, transfer, and termination from BambooHR into the Vantagepoint employee hub by hand, which meant project managers staffed work against people who were missing or stale in Deltek, and bill and cost rates lagged behind raises. With Deltek and BambooHR connected, each BambooHR change fires a webhook, the affected employee is re-read in full, and the record is created or updated in Vantagepoint with the right department and organization. New staff are bookable on projects the same day, terminations close out cleanly, and the manual copying is gone.

What you can do

• •Create and update Deltek Vantagepoint employee hub records from BambooHR hires, transfers, and terminations.
• •Map BambooHR department and division to Vantagepoint department and organization so people land on valid dimensions.
• •Populate Vantagepoint cost and bill rates from BambooHR compensation history where the firm chooses to.
• •Bridge BambooHR per-subdomain OAuth 2.0 to Deltek's tenant URL and OAuth 2.0 password-grant token.
• •Verify BambooHR SHA-256 HMAC webhooks, re-read the full employee, and de-duplicate before each write, with retries and a full audit trail.

Questions

Which direction does data move between Deltek and BambooHR?

The flow runs one way, from BambooHR into Deltek Vantagepoint. Employee, job-information, and compensation changes move into the Vantagepoint employee hub, where department and division map to the Deltek organization. BambooHR has no vendors, invoices, or GL accounts, so nothing financial moves, and Deltek does not write people data back, so BambooHR stays the system of record.

How does the integration handle BambooHR webhooks?

BambooHR pushes employee.created, employee.updated, and employee.deleted events signed with SHA-256 HMAC, but the payload only names the employee and the changed fields. ml-connector verifies the signature with a timing-safe comparison over the raw body plus the timestamp header, then calls GET /api/v1/employees/{id} with an explicit fields list to fetch the current record. That full record is what gets written into the Vantagepoint employee hub.

How does ml-connector avoid duplicate employees in Deltek?

Deltek Vantagepoint has no idempotency key on its REST API, so ml-connector stores the BambooHR employee id against the matching Vantagepoint employee number and checks for an existing hub record before writing. A re-delivered webhook or a backfill poll then patches the existing employee rather than creating a second one. A scheduled page-based poll of BambooHR also backfills any change a webhook missed.