API Release Notes, July 2023

New This Month

Annual SSL Certificate Renewal

To ensure the ongoing security of our products and services, the concursolutions.com and api.concursolutions.com SSL certificates are updated on an annual basis. The current certificates will expire on September 29, 2023 (.concursolutions.com) and September 10, 2023 (.api.concursolutions.com). SAP Concur plans to issue new certificates at 11PM PDT on August 24, 2023.

Clients who have not pinned the expiring certificate do not need to take any action as their expiring certificate will be renewed automatically. Most clients do not pin the certificate.

Clients who have pinned the expiring certificate must update to the new certificate before the new certificate is issued at 11PM PDT on August 24, 2023.

Clients who have pinned the certificate and who do not update it with the new certificate by 11PM PDT on August 24, 2023, will experience disruption to SAP Concur products and services.

To avoid disruption of service, clients who pin their security certificates must pin both the RSA and ECDSA certificates. The new certificates can be accessed from the following web pages:

Identity v4.1 Search Guide Available

And additional guide has been added to elaborate on the Identity v4.1 APIs search and filter functionality. The guide is available here

Identity v4.1 Available

Identity v4.1 includes additional search functionality that enables clients to filter identity data based on user attributes, as well as the previous create and update functionally of the API. Search functionality allows the use of attributes, logical operators, and grouping operators to refine search results specific to their business needs. For further information, please see the Identity v4.1 documentation. An implementation guide will follow.

Decommission of User v1 Password Endpoint

The decommission of the User v1 password endpoint will occur on July 28th, 2023. Clients that have not yet moved to the Concur Request v4 APIs will have until July 28th, 2023 to make the required changes. After the decommission date, the endpoint will no longer be available in Production, in accordance also with the SAP Concur API Lifecycle & Deprecation Policy.

Decommissioning of Password Provisioning

Beginning August 2nd, 2023, password provisioning for user accounts will not be supported. Any passwords provisioned through flat file, XLS, or the User v1 API will be ignored. New users will be directed to the “Forgot Password” link for their initial login.

Preferred Name Available for Provisioning APIs (User Provisioning v4, Identity v4, & User v1)

We recognize that some employees may desire an alternative name by which they are addressed. This preferred name can be different from their legal name. We are updating our product to display preferred first name when provisioned (when allowed by country specific laws). Users may update their preferred name through the profile settings page.

Using the attribute displayName the name of the user, suitable for public display (givenName + familyName) when nickName is provisioned, nickName replaces givenName.

Reject Functionality Added to Expense v4

Expense v4 now provides the ability to reject a specific expense on a report. This will trigger the system to split the expense report into two separate reports – the existing report with the approved expenses, and a second report with the rejected expenses.

This functionality is provided by a new attribute isExpenseRejected, and can be set to true (to reject the expense), or false using the PATCH endpoint.

Additional Endpoint Added to Reports v4

A new endpoint has been added to the Reports v4 API. This enables an application built using SAP Concur APIs to POST a report.

Ongoing: Decommission of Password Provisioning via File Import

The decommission of password provisioning via file import will occur on October 1st, 2023. This will affect flat file imports, XLS imports, and the User v1 API. Please work with your SAP Concur representative if you have any questions.

Ongoing

Decommission of Existing Concur Request APIs (v1.0, v3.0, v3.1)

The decommission of the v1.0, v3.0, and v3.1 APIs is planned to conclude soon. Users that have not yet migrated to the Concur Request v4 APIs are strongly encouraged to make the required developments. Decommission is now ongoing since June 1st, 2021 and the legacy Concur Request APIs (v1.0, v3.0, v3.1) will only be supported on a limited case-by-case basis. A new decommission date will be defined and the legacy Concur Request APIs (v1.0, v3.0, v3.1) will no longer be available into Production, in accordance with the SAP Concur API Lifecycle & Deprecation Policy.

API Timeline for v1.0, v3.0, v3.1:

Deprecation – March 1, 2020 – May 31, 2021
Decommission – Since June 01, 2021

The Concur Request APIs v1.0, v3.0 and v3.1 only support the previous authentication method, which is not best security practice and does not meet the OAuth2 standards. In addition, the previous versions of the Concur Request APIs provided limited possibilities for moving a Request through the approval workflow, as well as managing custom simple & connected list fields. These issues are resolved with the new Concur Request v4 APIs.

In addition, SAP has run a backward compatibility project between the current Concur Request APIs and the new Concur Request v4 APIs (not iso-compatibility) in order to have the vast majority of use cases managed in the previous versions also be managed in the Concur Request v4 APIs.

Please work with your Concur representative to move from your current legacy Concur Request APIs (v1.0, v3.0, v3.1) towards the Request v4 APIs.

Move from the Travel Request External Validation Callout v1 to the Event Subscription Service (ESS)

The Travel Request External Validation Callout v1 API was designed to work with the Concur Request v1 API that is in the process of being decommissioned. Users relying on the Travel Request External Validation Callout v1 are strongly recommended to move to the Event Subscription Services (ESS) in order to subscribe to the Request events.

Please work with your organization to move from Travel Request External Validation Callout v1 to Event Subscription Services (ESS).

For new users willing to take advantage of the Concur Request External Validation Workflow Feature, please work with your Concur representative to rely on the Concur Event Subscription Service and configure the Concur Request Workflow accordingly.

Deprecations

APIs are being deprecated in accordance with the SAP Concur API Lifecycle & Deprecation Policy.

Date	API	Details
06/2023	Deprecation of Launch External URL Callout v1	The Launch External URL V1 API is deprecated as of June 16th, 2023. Decommission will follow.
12/2022	Deprecation and Decommission of Vendor v3	Vendor v3 is being deprecated and decommissioned, users will have until November 30, 2023 to migrate to the latest version of the API.
11/2022	Deprecation of User v1	Effective November 10th, 2022, the User v1 API has been deprecated. This has been replaced by User Provisioning Service v4. Decommission has been extended and will conclude on May 31st, 2024.
11/2022	Deprecation of User v3	Effective November 10th, 2022, the User v1 API has been deprecated. This has been replaced by User Provisioning Service v4. Decommission has been extended and will conclude on May 31st, 2024.
10/2022	Deprecation of Cash Advance v4	Effective October 1st, 2022, the Cash Advance v4 API is deprecated. This has been replaced by the release of Cash Advance v4.1. Decommission will follow on October 2, 2023.
10/2022	Deprecation of Hotel Service v2	Effective October 14th, 2022, the Hotel Service v2 API is deprecated. This has been replaced by the release of Hotel Service v4. Decommission will follow on October 16, 2023.
04/2021	Bulk User v3.1 API	We have deprecated the Bulk User v3.1 API for the US and EMEA data centers. This API is replaced by Identity v4. Decommission will follow. Bulk User v3.1 will remain available for China data centers.
01/2021	List v3 API	Effective April 16, 2021, we have deprecated the List v3 API. This API is replaced by the List v4 API. List v3 is planned to be retired in a future release.
01/2021	List Item v3 API	Effective April 16, 2021, we have deprecated the List Item v3 API. This API is replaced by the List Item v4 API. List Item v3 is planned to be retired in a future release. Please migrate to the List Item v4 API as soon as possible.
06/2020	Travel Profile Notification v1 API	We are deprecating the Travel Profile Notification v1 APIs due to low usage.
01/2020	List v1 API	We will be retiring the List v1 API in a future release. This API is replaced by the List v4 API.

Planned Changes

Date	API	Planned Change
06/2023	Managed List	We will be releasing additional functionality to our list services with Managed Lists. A Managed List is a list in which all modifications to the list are restricted to a single app ID.
06/2023	Payroll Integration Available Without Integration with Concur Solutions (ICS)	Payroll fields will be available through the Financial Integration Service (FIS) API. This allows users of the FIS API (partner apps or customers with custom integrations) to also use the API for payroll integration.
05/2023	Get Cost Objects Request v4 API	This endpoint will allow external callers to view a Request’s approver related cost objects within a cost object approval workflow.
04/2023	Get Cost Object for Approver v4 API	Externalizing this endpoint allows external callers to view a report’s approver related cost objects within a cost object approval workflow.
04/2023	Approve Report, Send Back Report, and Recall Report v4 APIs	These APIs will replace the expense report workflow action v1.1 API. These v4 expense report workflow APIs are functionally similar to their v1 Post an Expense Report Workflow Action counterparts but will be available as separate actions.
02/03/23	New Itinerary v4 API Endpoint for List of Trips with Travel Dates in a Specified Date Range	We will be introducing a new endpoint for the Itinerary v4 API to provide a list of company trips with travel dates in a specified date range. This additional functionality will provide customers and partners with a scalable, performant, and self-serve way to retrieve a list of trips with travel dates in a specified range as they onboard companies.