Deltek and UKG integration

What moves between them

The main flow runs from UKG Pro into Deltek Vantagepoint. After each pay run, ml-connector reads UKG Pro third-party pay distributions and posts the labor cost as journal entries into Deltek Vantagepoint, mapped to the matching GL accounts and organizations. Employee records flow the same direction so the Deltek employee hub reflects UKG hires, terminations, and rehires. Cost centers and departments are aligned so payroll allocations land on valid Deltek organizations and accounts. UKG Pro has no journal entry, vendor, or AP object, so ml-connector treats it as the payroll source and never writes financial documents back into UKG.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the UKG side it sends HTTP Basic auth together with the customer API key header and the user API key header on every request, since omitting either returns a silent 401, and it reads against the tenant-specific hostname the customer supplies because there is no universal UKG base URL. On the Deltek side it requests an OAuth 2.0 password-grant token against the company deltekfirst.com URL and refreshes it before the hourly expiry. Because UKG Pro has no journal endpoint, the labor journal lines are reconstructed from the third-party pay GL distributions, with UKG cost centers mapped to Deltek organizations and accounts first so every line references a dimension that already exists. Employee loads use the two-pass fetch UKG requires, paging the employee-ids list then fanning out for full profiles, and the changed-employees delta endpoint is polled for ongoing updates. Deltek has no native idempotency key, so ml-connector checks for an existing journal before posting and dedupes on a BullMQ jobId to avoid double-booking a re-read pay run. UKG Webhooks can trigger employee syncs, verified by HMAC-SHA256, but the 14-day retention means a delta poll always backstops them. Both sides return HTTP 429 under load, so ml-connector backs off with jitter, and every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A professional services firm with around 250 employees runs Deltek Vantagepoint for project accounting and resource planning across several offices, and uses UKG Pro for HR and payroll. Before the integration, accounting exported the payroll register from UKG every pay period and keyed the labor totals into Deltek by hand, then spent the first days of month-end close chasing differences between HR headcount and the labor accounts in the project ledger. With Deltek and UKG connected, each pay run's GL distribution posts into Deltek Vantagepoint automatically as journal entries, allocated to the organization for each office, and employee changes keep both systems aligned. Close starts with the labor accounts already reconciled, and the manual re-keying step is gone.

What you can do

• •Post UKG Pro payroll pay distributions into Deltek Vantagepoint as journal entries after every pay run, allocated to the correct organizations.
• •Keep the Deltek employee hub aligned with UKG Pro hires, terminations, and rehires using the changed-employees delta.
• •Map UKG cost centers and departments to Deltek GL accounts and organizations so payroll lands on valid dimensions.
• •Authenticate UKG with HTTP Basic auth and its two required API keys, and Deltek with its tenant password-grant token.
• •Poll on a schedule tied to your payroll calendar, with jobId dedup, retries, and a full audit trail on every record.

Questions

Which direction does data move between Deltek and UKG?

The main flow is UKG into Deltek. Payroll pay distributions and employee records move from UKG Pro into Deltek Vantagepoint as journal entries and employee hub updates, while cost centers and departments are aligned so allocations match. UKG Pro has no journal entry, vendor, or AP object, so ml-connector treats it as the payroll source and does not write financial documents back into UKG.

How does the integration build journal entries if UKG has no GL endpoint?

UKG Pro does not expose journal entries or a chart of accounts over REST. Its third-party pay data does carry GL account numbers, segments, debit and credit amounts, and cost centers, so ml-connector reconstructs the labor journal lines from those distributions. The lines are mapped to Deltek GL accounts and organizations first, so each one posts against a dimension that already exists.

How does the integration handle UKG's two API keys and Deltek's tenant login?

UKG core REST requires HTTP Basic auth plus both a customer API key header and a user API key header, and omitting either returns a silent 401, so ml-connector always sends all three against the tenant-specific hostname. Deltek uses an OAuth 2.0 password-grant token against the company deltekfirst.com URL, which ml-connector refreshes before its hourly expiry. Because UKG webhook events expire after 14 days, a scheduled delta poll always backstops them.