API Release Notes, July 2026

New This Month

Preview: SSL Certificate Renewal for *.concursolutions.com, usg.concursolutions.com, and usg.api.concursolutions.com

In August 2026, SAP Concur will renew the security certificates for *.concursolutions.com and Concur Cloud for Public Sector (usg.concursolutions.com and usg.api.concursolutions.com). In most cases, certificate renewal is automatic and transparent, and no action is required.

Due to industry-wide changes implemented by our Certificate Authority, DigiCert, the maximum validity period for publicly trusted TLS certificates has been reduced to 199 days. As a result, SAP Concur certificates will be renewed more frequently than in previous years.

Important: As validity periods continue to shorten — to 199 days in 2026, 100 days in 2027, and 47 days in 2029 — SAP Concur will no longer be able to provide advance announcements for certificate renewals. Certificates will be rotated more frequently and automatically. Changes to Intermediate or Root CA certificates will still be announced in advance.

SAP Concur will issue new certificates on the following schedule:

As part of this renewal, the Client Authentication extended key usage will be removed from usg.concursolutions.com and usg.api.concursolutions.com certificates. This extension was not used as these certificates function as TLS server certificates for server authentication only. Its removal does not impact service functionality.

Note: This change is part of broader security improvements across the industry and has no impact on the security, availability, or trust of SAP Concur services.

Certificate Pinning Guidance

Clients who have not pinned the expiring certificate do not need to take any action. Most clients do not pin the certificate.

Note: Certificate pinning is not recommended, and you do so at your own risk. If your implementation requires certificate pinning, pin the Intermediate or Root CA certificate instead of the leaf/end-entity certificate. Pinning the leaf certificate will result in frequent service disruptions as renewal cycles become shorter.

For full details, including certificate download links, testing instructions, and feature activation, refer to Concur Shared Release Notes:

• SSL Certificates Renewal for US2, EU2, and APJ1
• SSL Certificate Renewal for Concur Cloud for Public Sector

Additional information about the 199-day certificate validity period is available in the documentation provided by DigiCert.

Preview: Additions to Guest Information and Shop Requests in Hotel Service v4

Middle Name in Guest Information

The Reservation request will support an optional middle name as part of guest information.

Example request:

"guests": [
    {
      "firstname": "Blake",
      "middleName": "Jordan",
      "lastname": "Smith",
      "address": {
        "addressLines": [
          "910 Mainland Street"
        ],
        "city": "Vancouver",
        "stateName": "British Columbia",
        "countryCode": "CA",
        "postalCode": "V5K 0A1"

Custom Fields Added to Shop Request

Custom fields — such as Org Unit or Employee ID — are stored in user profiles and can be shared with supporting vendors. Currently, these custom fields are only sent in the Reservation request. This change will also send them in the Search and Rates requests. Vendors with shared custom fields enabled will automatically receive them in all three requests once implemented.

Example request:

   }
  ],
  "numGuests": 1,
  "guestCountryCode": "CA",
  "searchSessionToken": "b41168ba-7ee1-4b68-9934-47f5c55337d6",
  "customFields": [
    {
      "name": "OrgUnit",
      "value": "Travel Agents"

Now Available: Legal Entity v4.1

With the Legal Entity v4.1 API, customers and partners can manage legal entity profiles within their company structure using SCIM standards. New public endpoints support creating, retrieving, updating, replacing, and searching legal entities, with authentication via Bearer token and company context provided through JWT or companyId query parameter.

Ongoing

Important! Upcoming Shutdown of Request V1, V3, and V3.1

Effective Date: August 5, 2026

As previously announced, the Concur Request APIs v1.0, v3.0, and v3.1 have been decommissioned. These versions will be retired and no longer accessible as of August 5, 2026. Customers currently using these versions must migrate to the successor API, Request API V4, to ensure uninterrupted functionality. Please reach out to your Concur representative for more information.

Updated: Decommissioning of Launch External URL V1

Effective Date: June 23, 2026

The Launch External URL V1 callout API, deprecated in June 2023, was shut down and no longer accessible upon decommissioning on June 23, 2026. To ensure continued functionality and reliability, all customers must migrate to Launch External URL V4, which provides full functional equivalence with no known gaps. Please reach out to your SAP Concur representative for more information.

Previews

In general, this table lists items that will be shipping in the next 30-60 days. For a broader view of features that are coming, please see our Road Map Explorer.

Deprecations and Decommissions

APIs are being deprecated or decommissioned in accordance with the SAP Concur API Lifecycle & Deprecation Policy.