Deltek and JAGGAER integration

What moves between them

Master data flows from Deltek into JAGGAER, and transactions flow from JAGGAER back into Deltek. ml-connector reads firms marked as vendors and the GL accounts from Deltek and writes them into JAGGAER as suppliers and coding accounts, so buyers raise requisitions against valid records. It also feeds active projects so spend can be tagged to the right engagement. In the other direction it reads approved invoices and purchase orders from JAGGAER and posts them into Deltek as AP invoices against the matching vendor, project, and GL account. The general ledger and chart of accounts stay authoritative in Deltek, so ml-connector only reads accounts into JAGGAER and never writes ledger structure back.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Deltek side it requests a password-grant token from the tenant /api/token endpoint, supplying the consumer key, secret, database, and API user, and refreshes it using the refresh token before the hour expires. On the JAGGAER side it requests a client-credentials token from the hardcoded Keycloak realm J1p-integrations and refreshes it on the shorter token lifetime. It accepts the full instance URL for each system as a credential, since neither vendor publishes a shared host. Suppliers and GL accounts are mapped first, so every JAGGAER invoice line resolves to a Deltek vendor, project, and account that already exists. Because JAGGAER is treated as pull-only and Deltek webhooks are workflow-scoped with no signature, both sides are read by page-based polling on a schedule you set. Neither API documents an idempotency header, so ml-connector dedups JAGGAER invoices on the supplier invoice number and queries Deltek by invoice number before posting, which avoids double-booking a re-read record. Deltek AP invoices may enter an approval workflow, so a flow can post them as drafts where the customer requires sign-off. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A 400-person architecture and engineering firm runs Deltek Vantagepoint for project accounting and the general ledger, and adopts JAGGAER to give project managers a controlled way to raise purchase orders and route supplier invoices for approval. Before the integration, an AP clerk rekeyed every approved JAGGAER invoice into Deltek as an AP voucher and manually maintained the supplier list in both systems, which slowed project billing and let the vendor masters drift apart. With Deltek and JAGGAER connected, the Deltek vendor and GL-account masters feed JAGGAER automatically, approved invoices and purchase orders flow back into Deltek coded to the right project and account, and the supplier records stay aligned. The rekeying step disappears and project costs post in the period they belong to.

What you can do

• •Push Deltek vendor firms and GL accounts into JAGGAER so procurement codes spend against valid records.
• •Post approved JAGGAER invoices into Deltek as AP invoices, matched to the right vendor, project, and account.
• •Carry JAGGAER purchase orders into Deltek so PO-to-voucher matching lines up across both systems.
• •Bridge the Deltek OAuth password-grant token and the JAGGAER Keycloak client-credentials token, with the tenant URL held for each side.
• •Poll on a schedule with supplier-invoice-number dedup, retries, and a full audit trail on every record.

Questions

Which direction does data move between Deltek and JAGGAER?

Both directions, by record type. Vendor firms and GL accounts move from Deltek into JAGGAER as suppliers and coding accounts, and approved invoices and purchase orders move from JAGGAER back into Deltek as AP invoices. The chart of accounts stays authoritative in Deltek, so ml-connector only reads accounts into JAGGAER and never writes ledger structure back.

How does the integration handle the two different OAuth schemes?

Deltek Vantagepoint uses an OAuth 2.0 password grant against the tenant /api/token endpoint and JAGGAER uses OAuth 2.0 client credentials against a Keycloak realm named J1p-integrations. ml-connector stores both credential sets encrypted, requests and refreshes each token on its own lifetime, and presents the right bearer token to each system. It also holds the tenant-specific URL for each side, since neither vendor publishes a shared host.

Does JAGGAER push invoices, or does ml-connector poll for them?

ml-connector polls. JAGGAER mentions an event-driven push mode but does not document it publicly, so it is treated as pull-only until JAGGAER professional services configures events, and Deltek webhooks are limited to workflow record-save events with no signature to verify. Because neither API documents an idempotency header, ml-connector dedups JAGGAER invoices on the supplier invoice number and checks Deltek by invoice number before posting.