Deltek and Deel integration

What moves between them

The main flow runs from Deel into Deltek Vantagepoint. ml-connector reads Deel-fee invoices and contractor payment invoices from Deel and posts them into Vantagepoint as AP invoices and journal entries, mapped to the matching GL accounts, projects, and organizations. Contract and worker records flow the same direction so the Vantagepoint employee hub reflects Deel new hires, role and pay changes, and terminations. Deel cost centers, read from the contract expand, are aligned to Vantagepoint projects and organizations so each posted line lands on a valid dimension. Deel is the system of record for workforce data and its invoices are read-only, so ml-connector never writes financial entries or people data back into Deel.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Deel side it sends the Bearer organization token, which does not expire, on every request, and the token must carry accounting:read, contracts:read, and people:read scopes for the reads this pair needs; an OAuth2 setup instead sends both the Authorization header and the x-client-id header and refreshes the thirty-day access token before it lapses. It verifies each Deel webhook with a timing-safe HMAC-SHA256 check, computed over the literal string POST followed by the raw request body exactly as Deel signs it, using the x-deel-hmac-label header to select the right key during rotation, then re-reads the affected contract, invoice, or worker so it posts the full current record. On the Deltek side it accepts the full tenant deltekfirst.com URL, database name, and password-grant credentials per customer, requires the Allow Password Grant Type setting and an API user with accounting and administrator roles, and refreshes the bearer token before it expires. Deel cost centers are mapped to Vantagepoint projects and organizations first, so every posted line references a dimension that already exists, and GL account references pulled from the Deel invoice payload map to Vantagepoint GL accounts. Because Vantagepoint has no idempotency key, ml-connector stores the Deel invoice id against the Vantagepoint AP invoice and checks for an existing record before posting, so a re-delivered webhook patches rather than duplicates; Deel writes, when used, carry an Idempotency-Key for the same reason. A scheduled page-based poll backfills anything a webhook missed, a Deel 429 with a Retry-After header is honored with backoff rather than hammered, and every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A 220-person digital consultancy runs Deltek Vantagepoint for project accounting, billing, and resource planning, and uses Deel to engage contractors and run payroll across a dozen countries. Before the integration, finance downloaded each Deel platform-fee invoice and the monthly contractor payment statements, then typed the totals into Vantagepoint by hand as AP invoices and journal entries, splitting them across projects from a spreadsheet. New contractors were often missing from the Vantagepoint employee hub when project managers went to staff work. With Deltek and Deel connected, each Deel-fee invoice and contractor payment posts into Vantagepoint automatically, allocated to the right project and GL account, and contract changes keep the employee hub current. Month-end close starts with those costs already booked, and the manual re-keying is gone.

What you can do

• •Post Deel-fee invoices and contractor payment invoices into Deltek Vantagepoint as AP invoices and journal entries.
• •Keep the Vantagepoint employee hub aligned with Deel contract starts, role and pay changes, and terminations.
• •Map Deel cost centers and embedded GL references to Vantagepoint projects, organizations, and GL accounts.
• •Bridge Deel's Bearer organization token, or OAuth2 with x-client-id, to Deltek's tenant URL and password-grant token.
• •Verify Deel HMAC-SHA256 webhooks, re-read the full record, and de-duplicate before each post, with retries and a full audit trail.

Questions

Which direction does data move between Deltek and Deel?

The main flow is Deel into Deltek Vantagepoint. Deel-fee invoices and contractor payment invoices post into Vantagepoint as AP invoices and journal entries, and contract and worker changes keep the Vantagepoint employee hub current. Deel invoices are read-only and Deel stays the system of record for workforce data, so ml-connector does not write financial entries or people data back into Deel.

How does the integration handle Deel's signed webhooks?

Deel pushes contract and HRIS employee lifecycle events signed with HMAC-SHA256 in the x-deel-signature header. ml-connector verifies each one with a timing-safe comparison computed over the literal string POST followed by the raw request body, before any JSON parsing, and uses the x-deel-hmac-label header to pick the correct key during rotation. Only after the signature checks out does it re-read the affected contract, invoice, or worker and post the full current record into Deltek.

Can Deel provide vendor or purchase order data for Deltek?

No. Deel is a workforce platform with no vendor master, purchase orders, or product items, so this connection is built around what Deel does expose: its own fee invoices, contractor payment invoices, contracts, and people records. Those invoices become AP invoices and journal entries in Vantagepoint, and GL account dimensions are read from the embedded references in the Deel invoice payload since Deel has no standalone GL account endpoint.