Deltek and Workday HCM integration

What moves between them

Worker, organization, and cost center records flow from Workday HCM into Deltek so the Employees hub and accounting codes reflect Workday hires, terminations, and structure changes. Project labor and AP journal entries flow the other direction, from Deltek into the Workday HCM general ledger through the Submit_Accounting_Journal SOAP operation, mapped to the matching Workday ledger accounts and cost centers. Reference data such as cost centers and organizations is aligned so every posted journal line references a ledger account and worktag that already exists in Workday. Because neither system pushes events, ml-connector reads each side on a schedule, with worker reads driven by the Workday Get_Workers updated-since filter and full extraction used where a delta filter is not available.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Workday HCM side it holds the OAuth2 client ID, client secret, and long-lived refresh token for REST worker reads, and the ISU username and password for SOAP finance calls, refreshing the 60-minute access token when a call returns 401. On the Deltek side it accepts the full tenant deltekfirst.com URL and database name per customer and exchanges the OAuth2 password-grant credentials for a bearer token. Workday organizations and cost centers are mapped to Deltek organizations and accounting codes first, so every journal line posted into Workday references a ledger account and worktag that already exists. Because neither side offers webhooks, it polls on a schedule and uses date-range filters where Workday supports them; Get_Supplier_Invoices has no delta filter, so full extraction and local diff is used there. Workday Submit operations have no idempotency key, so ml-connector checks for an existing journal by its external reference before posting, and Deltek likewise requires a duplicate check before POSTing an AP invoice. It backs off on Workday HTTP 429 with the Retry-After header, applies conservative backoff against Deltek's per-tenant instance, and respects any AP invoice approval workflow configured in Vantagepoint. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized engineering and consulting firm of around 600 staff runs Deltek Vantagepoint for project accounting and billing, and Workday HCM as its system of record for people, organizations, and the corporate ledger. Before the integration, HR maintained the worker roster in Workday while finance separately re-keyed new hires and leavers into the Deltek Employees hub, and at each close someone exported project labor totals and entered the journals into Workday by hand, then reconciled differences between the two ledgers. With Deltek and Workday HCM connected, worker and organization changes flow into Deltek automatically, and each period's project and AP journals post into the Workday general ledger against the right cost centers. The duplicate employee maintenance disappears and month-end close starts with the labor and expense accounts already aligned.

What you can do

• •Sync Workday HCM workers and organizations into the Deltek Employees hub so hires and terminations stay current.
• •Post Deltek project and AP journal entries into the Workday HCM general ledger through the Submit_Accounting_Journal SOAP operation.
• •Map Workday cost centers and organizations to Deltek accounting codes so every journal line lands on a valid ledger account.
• •Bridge Workday OAuth2 refresh-token and ISU WS-Security logins with Deltek's tenant OAuth2 password grant.
• •Poll on a schedule with Retry-After backoff and a duplicate check, since neither system offers webhooks or idempotency keys.

Questions

Which direction does data move between Deltek and Workday HCM?

Worker, organization, and cost center data moves from Workday HCM into Deltek so the Employees hub and accounting codes stay current. Deltek project and AP journal entries move the other way, into the Workday HCM general ledger through the Submit_Accounting_Journal SOAP operation. Reference data such as cost centers is aligned so journal lines land on valid ledger accounts on both sides.

Does Workday HCM support webhooks, or does ml-connector poll?

Workday HCM has no native webhooks, and Deltek Vantagepoint only offers workflow-driven callbacks with no signature, so ml-connector polls both systems on a schedule you set. It uses Workday updated-since filters where they exist, such as Get_Workers, and falls back to full extraction with a local diff for operations like Get_Supplier_Invoices that have no delta filter. It backs off on Workday HTTP 429 responses using the Retry-After header.

How are the two different authentication methods handled?

ml-connector stores all credentials encrypted and bridges them per call. For Workday HCM it uses an OAuth2 refresh token for REST worker reads and an Integration System User over WS-Security for SOAP finance operations, refreshing the 60-minute access token on a 401. For Deltek it exchanges the OAuth2 password-grant client ID, secret, username, and password for a bearer token against the customer's tenant deltekfirst.com URL.