Epicor Kinetic and Deel integration

What moves between them

The main flow is Deel into Epicor Kinetic. After each payroll run, ml-connector reads Deel invoices, worker-invoices, and payslips, extracts the payroll GL postings and cost allocations, and posts them into Epicor Kinetic's general ledger against the matching GL accounts and cost centers. Worker and contractor records flow the same direction so Epicor headcount and cost tracking reflect Deel hires, contract starts, and terminations. Reference data such as cost centers is aligned in both directions so payroll lines land on valid Epicor GL accounts. Full audit trails and replay capability allow corrected records to post if a GL entry fails.

How ml-connector handles it

ml-connector stores Deel API tokens or OAuth2 refresh tokens encrypted and refreshes access tokens when a call returns 401. On the Epicor Kinetic side, it constructs tenant-specific URLs, combines OAuth2 bearer tokens with required API key headers, and polls using OData filters on SyncDate or UpdatedOn fields to retrieve only changed records since the last run. Deel webhooks are validated using HMAC-SHA256 signature verification before processing events. Because Epicor Kinetic has no outbound webhooks, payroll polling is scheduled to run after your payroll calendar, and cost center and GL account mappings are validated before any GL posting is attempted. Epicor's two-step write pattern (GetNew followed by UpdateMaster) is used for payroll entries, and deduplication relies on business object uniqueness constraints and idempotency at the mapper level since Epicor Kinetic does not support idempotency headers. Deel's Idempotency-Key header is used on payroll input writes to ensure single-use token semantics. Bearer tokens from both systems are cached and refreshed on expiry to avoid transaction failures mid-run.

A real-world example

A mid-sized professional services firm with staff in three countries runs Epicor Kinetic for finance and project accounting, and uses Deel for global payroll, EOR, and contractor invoices. Before the integration, the finance team manually extracted payroll totals from Deel every pay period, split costs by project and office in a spreadsheet, and posted the labor GL entries into Epicor by hand. This created a two-week lag between payroll and GL closure and frequent month-end reconciliation errors. With Epicor Kinetic and Deel connected, Deel's payroll run triggers automatic GL posting into Epicor Kinetic by cost center, and worker records stay synchronized so actual headcount always matches the labor accounts in the ledger. Month-end close now starts with payroll GL already correct, and the manual cost-splitting step is gone.

What you can do

• •Post Deel payroll summaries into Epicor Kinetic's general ledger by cost center after each payroll run, with full GL account mapping and audit trail.
• •Keep Epicor Kinetic headcount aligned with Deel worker hires, contract starts, and terminations in real time via webhooks.
• •Map Deel cost centers, projects, and worker allocations to Epicor Kinetic GL accounts so payroll lands on the correct accounts.
• •Authenticate Epicor Kinetic with OAuth2 bearer tokens combined with required API key headers, and Deel with API tokens or OAuth2 refresh.
• •Poll Epicor Kinetic on a payroll schedule with OData date filters, receive Deel payroll events via webhook verification, and replay failed GL posts.

Questions

Which direction does data flow between Epicor Kinetic and Deel?

The main flow is Deel into Epicor Kinetic. Payroll GL documents, invoices, and worker records move from Deel into Epicor Kinetic, while cost centers and GL account mappings are aligned so payroll lines land on valid accounts. Epicor Kinetic is the system of record for GL postings; Deel is the source for payroll and worker events.

How does the integration handle Epicor Kinetic's requirement for API key headers in addition to OAuth2 tokens?

ml-connector stores the API key separately and includes it in the x-api-key header on every call to Epicor Kinetic alongside the OAuth2 bearer token. Tokens are refreshed on expiry, and API keys are rotated through the Epicor tenant admin panel without requiring code changes.

Why does the integration poll Epicor Kinetic instead of waiting for a push?

Epicor Kinetic has no native outbound webhooks or event push mechanism. ml-connector polls using OData filters on date fields to retrieve only changed records since the last run, scheduled to align with your payroll calendar and Deel's payroll completion time so GL posting happens as soon as the payroll is ready.