Deltek and Slack integration

What moves between them

Most data moves from Deltek into Slack as notifications. When a Deltek workflow webhook fires on an AP invoice or expense report save, or when a scheduled poll picks up new transactions, ml-connector posts a message to the configured Slack channel reporting the vendor or employee, the project, the amount, and the approval status. A smaller flow moves from Slack into Deltek: when a user uploads an invoice PDF to a watched channel, the file_shared event triggers ml-connector to download the file and attach it to the matching Deltek AP invoice or project, and an approver can advance a pending AP invoice approval by adding an agreed reaction to its Slack message. Cadence is event-driven on the Slack side, webhook plus scheduled poll on the Deltek side. ml-connector treats Deltek as the system of record and never mirrors the ledger into Slack.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Deltek side it accepts the full tenant URL per customer, since Deltek publishes no shared base address, runs the OAuth2 password grant against that tenant token endpoint, and refreshes the 3600-second access token with the refresh_token before it expires. Because Vantagepoint webhooks carry no HMAC signature, ml-connector authenticates inbound Deltek calls with the basic auth or key fields configured on the webhook and pairs each notification with a scheduled poll, since webhook arguments are a name-value payload with no fixed schema. On the Slack side it calls the Web API with the xoxb- bot token and verifies every inbound Events API request by recomputing the HMAC-SHA256 signature over v0:timestamp:body with the signing secret, rejecting any request whose timestamp is older than five minutes, and answering the url_verification challenge when the Request URL is set. The bot must already be a member of a channel to read it, so ml-connector joins or is invited to the watched channels first. Deltek has no native idempotency key, so before creating or attaching anything ml-connector queries by invoice number to avoid duplicates, and it maps each Deltek vendor and project to the channel and message it should appear in. Slack rate limits return HTTP 429 with Retry-After and chat.postMessage is capped at one message per second per channel, so notifications are paced. Inbound Slack events are acknowledged within the three-second window and processed on a queue, deduplicated by Slack event_id, and every action carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A 150-person architecture and engineering firm runs Deltek Vantagepoint for projects, billing, and accounting, and runs day-to-day work in Slack. Before the integration, incoming subconsultant invoices were emailed around, someone logged into Vantagepoint to enter each one and attach the PDF, and project managers had no visibility into whether an AP invoice tied to their project had been approved until they chased accounting. With Deltek and Slack connected, a project coordinator drops the invoice PDF into a project channel and ml-connector attaches it to the matching Deltek AP invoice, while every AP invoice and expense report save is posted back to that channel as it happens. A manager approves the posting with a reaction, the team sees the status the moment it changes, and the email handoffs disappear.

What you can do

• •Post Deltek AP invoice and expense report save events to a Slack channel as each one is saved.
• •Route invoice PDFs dropped into a watched Slack channel onto the matching Deltek AP invoice or project.
• •Let an approver advance a pending Deltek AP invoice approval by adding an agreed reaction to its Slack message.
• •Bridge the Deltek OAuth2 password-grant bearer token and its hourly refresh with the non-expiring Slack bot token, verifying every inbound event with the signing secret.
• •Pair Deltek workflow webhooks with a scheduled poll while acknowledging Slack events within three seconds, with event_id dedup and a full audit trail on every action.

Questions

Which direction does data move between Deltek and Slack?

Most of it moves from Deltek into Slack as notifications, where ml-connector posts a message when an AP invoice or expense report is saved. A smaller flow moves the other way, where an invoice PDF dropped into a watched Slack channel is attached to the matching Deltek AP invoice and an agreed reaction can advance a pending approval. Deltek stays the system of record, so ml-connector never mirrors the general ledger into Slack.

Can Slack store AP invoices or general ledger postings from Deltek?

No. Slack is a communication platform with no native invoice, ledger, vendor, or account objects, so it cannot hold accounting records. What it does well is carry messages, files, and reactions, so ml-connector uses it as the notification and approval layer: invoice and expense events appear as messages and invoice PDFs come in as files, while Deltek Vantagepoint remains the system of record.

How does the integration handle Deltek's unsigned webhooks and Slack's signed events?

Vantagepoint webhooks carry no HMAC signature, so ml-connector authenticates them with the basic auth or key fields configured on the webhook and pairs each one with a scheduled poll, because the workflow payload has no fixed schema. Slack instead pushes signed events, so each inbound request is verified by recomputing the HMAC-SHA256 signature with the signing secret, rejected if its timestamp is over five minutes old, and acknowledged within three seconds before processing on a queue. Slack deliveries are deduplicated by event_id and the Deltek access token is refreshed before its 3600-second expiry.