Deltek and Basware integration

What moves between them

Master data moves from Deltek into Basware. ml-connector reads Deltek firms, GL accounts, organizations, and projects and imports them into Basware as vendors, accounts, and coding dimensions so the coding panel always reflects current values. Invoices move the other way: once an invoice is coded and approved in Basware it is ready for transfer, and ml-connector reads it from accountingDocuments and posts it into the Deltek AP invoice module against the matching vendor, GL account, and project. After the invoice posts in Deltek, a transfer acknowledgement is sent back to Basware. Payment confirmation, once a payment posts in Deltek, can also be reported back into Basware so its status stays accurate.

How ml-connector handles it

ml-connector stores both credential sets encrypted. It sends the Basware client id and secret as Basic auth to mint the bearer token, requests a fresh one when it expires since there is no refresh token, and uses the correct regional base URL for the customer instance. On the Deltek side it accepts the full tenant URL and database per customer and refreshes the OAuth2 token when a call returns 401. Deltek master data is mapped first so every Basware coding line references a vendor and GL account that already exists. Approved invoices are picked up from Basware webhooks, each verified with HMAC-SHA256 from the X-BWAPI-Signature-256 header with the body read as UTF-8 and the timestamp checked to block replays; a scheduled poll backfills anything a webhook missed. Because Deltek has no idempotency key, ml-connector checks for an existing AP invoice by number before posting, and once posted it sends a transfer acknowledgement to Basware. Basware silently skips re-imported master records that are unchanged, and rejects rapid repeat updates to the same purchase order, so imports are batched and backed off on 429 or 503.

A real-world example

A mid-sized architecture and engineering firm of about three hundred staff runs Deltek Vantagepoint for project accounting and uses Basware to capture and approve supplier invoices. Before the integration, the AP team exported a vendor and GL account list from Deltek into Basware by hand whenever the chart of accounts changed, and after each invoice was approved in Basware they re-keyed the header and coding into Deltek's AP module, which caused posting errors when a coder picked an account that no longer existed. With Deltek and Basware connected, vendors, accounts, and projects sync into Basware automatically so coders only see valid values, and every approved invoice posts straight into Deltek against the right vendor and account. The manual export and the re-keying step are both gone.

What you can do

• •Import Deltek firms, GL accounts, organizations, and projects into Basware as vendors, accounts, and coding dimensions.
• •Post coded and approved Basware invoices back into Deltek's AP invoice module against the matching vendor and account.
• •Verify every Basware invoice webhook with HMAC-SHA256 and acknowledge the transfer once the invoice posts in Deltek.
• •Bridge Basware OAuth2 client credentials with the Deltek tenant login and refresh both tokens before they expire.
• •Check for an existing Deltek AP invoice by number before posting, since Deltek has no idempotency key, with a full audit trail on every record.

Questions

Which direction does data move between Deltek and Basware?

Master data moves from Deltek into Basware, and invoices move from Basware into Deltek. ml-connector imports Deltek vendors, GL accounts, organizations, and projects into Basware so coders pick valid values, then reads each approved invoice from Basware and posts it into Deltek's AP invoice module. Payment confirmation can be reported back into Basware once a payment posts in Deltek.

How does the integration handle authentication on each side?

Basware uses OAuth2 client credentials, where ml-connector sends the client id and secret as Basic auth to request a one hour bearer token and mints a fresh one at expiry, because the client credentials flow has no refresh token. Deltek uses an OAuth2 password grant against the customer tenant URL, which must have the password grant enabled, and ml-connector refreshes that token when a call returns 401. Both credential sets are stored encrypted, and the correct Basware region is selected per instance.

How are duplicate invoices and stale coding values prevented?

Deltek has no idempotency key, so ml-connector checks for an existing AP invoice by number before posting and acknowledges the transfer back to Basware once it succeeds. To keep coding accurate, Deltek GL accounts, organizations, and projects are imported into Basware first so every coding line references a value that already exists. Basware also silently skips unchanged master records on re-import, so only real changes are sent.