Workday Financial Management and Deel integration

What moves between them

Deel worker invoices and payroll cost allocations flow into Workday Financial Management on a schedule you set, typically aligned with your payroll cycles. ml-connector reads Deel's invoice and payslip data via REST webhooks or polling, maps each worker's costs to the corresponding Workday GL accounts and cost centers, and writes the payroll journal entries into Workday's general ledger using the SOAP API. Reference data such as cost centers and employee worktags are maintained in both directions so payroll expenses land on valid Workday dimensions. The flow is primarily one direction (Deel to Workday) because Workday's GL entries are typically read-only for payroll purposes.

How ml-connector handles it

ml-connector manages two different authentication paths: OAuth2 refresh tokens for Deel's REST API (refreshing on each 30-day expiry) and WS-Security UsernameToken for Workday's SOAP interface (embedding credentials in every request). On the Deel side, ml-connector can subscribe to real-time webhook events for contract changes and employee terminations, or poll the invoice and payslip endpoints on your preferred schedule. When using webhooks, ml-connector verifies the HMAC-SHA256 signature against the raw request body before parsing JSON. On the Workday side, ml-connector constructs journal entry payloads with GL account references and cost center worktags, then submits them via the SOAP Financial_Management service at your tenant-specific URL. Because Deel embeds GL account data in invoice payloads rather than exposing it as a standalone master, ml-connector uses the cost center and department information in payroll records to look up the matching Workday GL account. Rate limits on Deel return HTTP 429 with a Retry-After header; ml-connector backs off and retries. Every payroll posting carries a full audit trail and can be replayed if a downstream GL write fails.

A real-world example

A global services company with teams in five countries uses Deel for multi-country payroll and compliance, and Workday Financial Management for consolidated accounting and general ledger reporting. Before the integration, the finance team received payroll summaries from Deel each month and re-entered labor costs into Workday by hand, allocating each region's expense to the correct cost center. Month-end close required a manual reconciliation between Deel's payroll totals and Workday's GL labor accounts, and corrections to either system meant rework in the other. With Deel and Workday Financial Management connected, each payroll cycle's invoice and cost distribution flow directly into the GL, automatically allocated to the cost center for each region. Month-end close starts with labor accounts reconciled, and the manual re-entry and reconciliation steps are eliminated.

What you can do

• •Map Deel worker invoices and payroll costs into Workday Financial Management GL accounts and cost centers on each payroll cycle.
• •Authenticate Deel with OAuth2 Bearer tokens and Workday with WS-Security or REST OAuth2, managing token expiry automatically.
• •Receive real-time employee terminations and contract changes from Deel webhooks, or poll on a schedule aligned with your payroll calendar.
• •Sync cost center and department worktags between Deel and Workday so payroll expenses land on valid GL dimensions.
• •Verify Deel webhook signatures with HMAC-SHA256, handle HTTP 429 rate limits with backoff and retries, and maintain a full audit trail on every GL posting.

Questions

Which direction does payroll data flow between Deel and Workday Financial Management?

The main flow is from Deel into Workday Financial Management. Worker invoices, payslips, and cost allocations move from Deel into Workday's general ledger, while cost centers and GL account mappings are aligned to ensure payroll expenses land on valid GL dimensions. Workday's GL entries are typically read-only for payroll, so ml-connector does not write back into Deel.

Does the integration use Deel's webhooks or polling?

ml-connector can use both. For real-time updates to employee contracts and terminations, it subscribes to Deel's webhooks and verifies signatures with HMAC-SHA256. For invoice and payslip data, it can poll the Deel REST API on a schedule you set, typically aligned with your payroll cycle. Polling intervals are recommended at 15 to 60 minutes to balance freshness and load.

How does ml-connector handle the different authentication methods between Deel and Workday?

ml-connector manages two separate authentication flows. On the Deel side, it exchanges OAuth2 refresh tokens for 30-day access tokens, refreshing automatically as they expire. On the Workday side, it supports both SOAP with WS-Security UsernameToken (credentials embedded in every request) and REST with OAuth2 refresh-token flow. Both sets of credentials are stored encrypted and rotated independently.