Deltek and Rippling integration

What moves between them

The main flow runs from Rippling into Deltek. Worker lifecycle changes flow first, so the Deltek Vantagepoint employee hub reflects Rippling hires, terminations, and rehires, matched on a stable key such as work email or employee number. After each payroll run, ml-connector reads the run data, compensation, and Rippling accounting dimensions and posts the labor cost into Deltek as journal entries, allocated to the matching GL accounts and organizations. Reference data such as departments, legal entities, and cost dimensions is aligned so every journal line references a Deltek account and organization that already exists. Rippling holds no AP invoices or vendors, so the integration moves people and payroll data only, not procurement records.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Rippling side it holds either an API key or an OAuth bearer token and refreshes the OAuth token before it expires, and on the Deltek side it accepts the full tenant URL per customer, since Deltek publishes no shared base address, then runs the password grant and refreshes the bearer token when a call returns 401. Because Rippling webhooks are App Shop only and Deltek webhooks carry no signature, the default mode is polling: Rippling workers and payroll runs are read on a schedule tied to your pay calendar, filtered by update time, and Deltek is queried by record key before any write to avoid duplicates, since neither side offers an idempotency key for these writes. Departments and accounting dimensions are mapped to Deltek organizations and accounting codes first, so every payroll journal line lands on a valid account. The integration checks Rippling responses for redacted compensation fields and skips lines it cannot value rather than posting a wrong amount. Both APIs return HTTP 429 when throttled with no Retry-After, so ml-connector backs off with exponential delay, and every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A 180-person architecture and engineering firm runs Deltek Vantagepoint for project accounting and uses Rippling for HR and payroll across three offices. Before the integration, an accountant exported the payroll register from Rippling every pay period and re-entered the labor totals into Deltek by hand, then spent the first days of month-end close reconciling project headcount in Deltek against the active roster in Rippling. With Deltek and Rippling connected, each payroll run posts into Deltek as a journal entry allocated by office and project dimension, and worker changes keep the employee hub aligned. Close starts with labor already booked to the right projects, and the manual re-keying step is gone.

What you can do

• •Keep the Deltek Vantagepoint employee hub aligned with Rippling hires, terminations, and rehires.
• •Post Rippling payroll runs into Deltek as journal entries against the correct GL accounts and organizations.
• •Map Rippling departments, legal entities, and accounting dimensions to Deltek organizations and accounting codes.
• •Authenticate Rippling with an API key or OAuth and run the Deltek tenant password grant, refreshing both tokens.
• •Poll Rippling on your pay calendar, skip redacted compensation, and replay any failed posting from the audit trail.

Questions

Which direction does data move between Deltek and Rippling?

The main flow is Rippling into Deltek. Worker records and payroll journal entries move from Rippling into Deltek, while departments and accounting dimensions are aligned so postings land on valid accounts. Rippling has no AP invoices, vendors, or chart of accounts, so ml-connector moves people and payroll data only and does not pull procurement records that Rippling does not hold.

Does the integration rely on webhooks or polling?

It uses polling by default. Rippling only delivers webhooks to App Shop listings, and Deltek Vantagepoint webhooks carry no HMAC signature to verify, so ml-connector reads Rippling workers and payroll runs on a schedule tied to your pay calendar, filtered by update time. Where an App Shop webhook is available it can also receive Rippling lifecycle events.

How does ml-connector handle the two different logins?

It stores both credential sets encrypted and bridges them on every request. On the Rippling side it presents an API key or OAuth bearer token and refreshes the OAuth token before it expires. On the Deltek side it accepts the full tenant URL per customer, runs the OAuth password grant, and refreshes the bearer token when a call returns 401.