Deltek and Cleo integration

What moves between them

Documents move in both directions, mapped to their X12 transaction. Outbound from Deltek Vantagepoint, ml-connector reads new AR invoices billed to clients and renders them as 810 files, then uploads each to the correct Cleo folder for routing to the trading partner. Inbound from Cleo, it polls the mailbox folders for supplier 810 invoices a partner sent, downloads the files, and writes them into Vantagepoint as AP invoices against the matching firm, project, and GL account. Cadence is a polling schedule you set, since Cleo outbound push needs CIC Studio setup by the customer's Cleo admin, and Vantagepoint webhooks carry no signature.

How ml-connector handles it

ml-connector stores both credential sets encrypted and exchanges the Cleo username and password for a bearer token through the password grant, refreshing on a 401 and re-authenticating if the refresh also fails. On the Deltek side it accepts the full tenant deltekfirst.com URL, database name, and password-grant credentials per customer, refreshes the bearer token before it expires, and requires the API user to have accounting and administrator roles so AP invoices are allowed to post. Each Vantagepoint AR invoice is mapped to a valid 810 before any file moves, and an inbound 810 is parsed into an AP invoice with its firm, project, amount, and GL account resolved first so every line references a record that already exists in Vantagepoint. Because Cleo has no idempotency key and a re-uploaded file creates a duplicate, every upload gets a unique filename with a timestamp and inbound files are tracked by name so the same file is not imported again; Vantagepoint also has no idempotency header, so ml-connector checks for an existing invoice by number before posting. Cleo rate-limits at about five requests per second per API path and returns HTTP 429 over the limit, so reads back off with jitter and retry, and failed records are kept with a full audit trail for replay. If the Cleo account has TOTP two-factor enabled, a dedicated service account without 2FA is recommended, since a machine cannot supply a fresh code on every call.

A real-world example

A mid-sized engineering consultancy with around 200 staff runs Deltek Vantagepoint for project accounting and billing, and its largest public-sector clients require invoices delivered as EDI through a Cleo Integration Cloud mailbox. Before the integration, a billing clerk exported each finished Vantagepoint invoice and rekeyed it into the partner's EDI format by hand, and typed inbound subcontractor invoices from a Cleo folder into Vantagepoint as AP invoices one at a time, which was slow and caused rejections when a number was mistyped. With Deltek and Cleo connected, posted Vantagepoint invoices flow out as 810 files to each client mailbox and inbound supplier 810 files become Vantagepoint AP invoices automatically. Invoices reach clients the day they post, the rekeying is gone, and EDI rejections drop.

What you can do

• •Render Deltek Vantagepoint AR invoices as X12 810 files and upload them to the Cleo trading-partner mailbox.
• •Turn inbound supplier 810 files from Cleo folders into Vantagepoint AP invoices against the matching firm and project.
• •Map each Vantagepoint entity to its EDI transaction so documents leave and arrive in a format the partner accepts.
• •Bridge Cleo's OAuth2 password grant and tenant subdomain with Deltek's tenant URL and password-grant token.
• •Give every file a unique timestamped name and check invoices by number so no document is processed twice, with full audit and replay.

Questions

Which direction does data move between Deltek and Cleo?

Both directions, each mapped to an EDI transaction. Deltek Vantagepoint AR invoices go out through Cleo as X12 810 files for routing to a client, and inbound supplier 810 invoices that Cleo received are pulled into Vantagepoint as AP invoices. The cadence is a polling schedule you set, since Cleo outbound push needs Cleo admin setup and Vantagepoint webhooks carry no signature.

Cleo has no invoice or purchase order endpoint, so how does the connection work?

Cleo is integration middleware, not a finance system, so invoices and POs are not native REST objects. Its REST API manages folders and files, and business documents move through it as X12 EDI. ml-connector maps each Vantagepoint record to its EDI transaction, then uploads the file to the right Cleo folder to send and polls folders to retrieve what a partner sent.

How does the integration avoid duplicate documents and handle Deltek's password-grant auth?

Cleo has no idempotency key, and re-uploading a file creates a duplicate, so ml-connector gives every upload a unique timestamped filename and tracks inbound files by name so none is imported twice. On the Deltek side it stores the full Vantagepoint tenant URL, database, and password-grant credentials per customer, and the API user needs accounting and administrator roles for AP invoices to post; since Vantagepoint has no idempotency header, ml-connector checks for an existing invoice by number before posting.