Skip to main content

​
About SAP Concur

SAP Concur is a travel, expense, and invoice management platform. Serval’s Concur integration connects to your company’s Concur tenant with a company-level OAuth connection and calls the Concur APIs on demand from workflow steps - there are no background jobs or scheduled imports. Authentication: Company-level OAuth 2.0. An administrator generates a one-time company request token in the Concur admin console; Serval exchanges it once for long-lived OAuth tokens and refreshes them automatically from then on. No individual user signs in, so the connection is unaffected by SSO or MFA and does not depend on any one admin’s account. Data sync: On demand only. Serval contacts your Concur data center exclusively when a workflow step or health check runs.

​
What the SAP Concur integration enables

Anything defined in the SAP Concur APIs v3.0/v3.1 Web Services, the v4 Request and List APIs, and the v4 SCIM Identity API can be accessed through Serval, subject to the scopes granted to your Concur application. Serval deliberately ships no deprecated Concur endpoints - superseded v3 APIs (Requests, Users, Lists, Locations) are covered by their v4 successors instead.

​
Get your credentials

You need four values from Concur: your geolocation (API data-center hostname), a Client ID and Client Secret from a Concur OAuth application, and your Company UUID plus a company request token generated by an administrator. Concur’s authentication guide covers the flow in detail; SAP also publishes a step-by-step tutorial that walks through the same screens.
1

Sign in to Concur as an administrator

Open your SAP Concur admin panel and sign in with an administrator account.
2

Create (or locate) an OAuth application

Go to the OAuth 2.0 Application Management screen and click Create New App. Fill in the required fields and add the grants and scopes your workflows will need. Submit, then copy the generated Client ID and Client Secret somewhere safe.
3

Generate a company request token

Go to the Company Request Token screen, enter your application’s App ID, and click Submit. Concur shows your Company UUID and a company request token - copy both immediately.
4

Note your geolocation

This is the API hostname for the data center that hosts your company, for example us.api.concursolutions.com (US) or eu.api.concursolutions.com (EU). If you are unsure, your Concur administrator or SAP contact can confirm it.
The company request token expires 24 hours after it is generated and is consumed on first use. Generate it right before you connect in Serval; if it expires first, simply generate a new one from the same screen.
Grant the application the identity read scopes (for the v4 Identity API) and expense read scopes so Serval’s connection health checks can pass, plus whatever additional scopes your workflows need. If your application cannot generate a company request token, ask SAP Concur support to enable the company-level (request token) grant for it.

​
Connect in Serval

1

Add the SAP Concur integration

In Serval, add a new connection and choose SAP Concur.
2

Enter the Geolocation (required)

The API hostname for your data center, matching the placeholder us.api.concursolutions.com. You can paste either the bare hostname or a full URL - Serval strips the scheme and any path for you. The value must be a concursolutions.com hostname; anything else fails with “Geolocation must be a SAP Concur data center host”.
3

Enter the Client ID and Client Secret (required)

The OAuth2 credentials from your Concur application. The secret is entered in a password field; when you reopen the form later it appears masked, with a control to replace it.
4

Enter the Company UUID (required)

The Company UUID shown alongside the request token in the Concur admin console.
5

Enter the Request Token

The company request token generated in the previous section. It is required when first connecting (and when re-authenticating later); it is used exactly once, to obtain Serval’s long-lived OAuth tokens, and is never stored.
6

Save the connection

Serval immediately exchanges the request token with Concur when you save. If anything is wrong you get an error at this point: “Could not authenticate with SAP Concur. Verify the geolocation, Client ID, Client Secret, Company UUID, and request token (request tokens expire 24 hours after they are generated).”
When editing an existing connection, leave the Request Token field blank to keep the current tokens - it is only needed again if you re-authenticate. Changing the Geolocation, Client ID, or Company UUID requires a fresh request token, because the stored tokens are bound to those values; saving such a change without one fails with “Request Token is required to change the geolocation, Client ID, or Company UUID.”

​
Verifying the connection

The SAP Concur integration ships three health checks. Run them right after connecting. Test Concur Connection - authenticates and calls the v4 Identity API. This check is license-agnostic, so it passes regardless of which Concur modules (Expense, Travel, Invoice) your tenant licenses.
  • Success: “Successfully authenticated with SAP Concur”
  • Failure: “Unable to connect to SAP Concur. Verify the geolocation, Client ID, Client Secret, Company UUID, and request token are correct.”
List Expense Reports - lists recent expense reports through the v3 Expense API to verify read access.
  • Success: “Successfully retrieved expense reports from SAP Concur”
  • Failure: “Unable to list expense reports from SAP Concur.”
List Users - lists a page of users from the v4 Identity API to verify directory read access.
  • Success: “Successfully retrieved users from SAP Concur”
  • Failure: “Unable to list users from SAP Concur.”
A mix of green and red checks usually means missing scopes or an unlicensed module, not a broken connection. The identity checks need the application’s identity read scopes; the expense check needs expense read scopes and an Expense-licensed tenant. Add the missing scope to the application in Concur - scope changes may require a re-authentication with a fresh request token.

​
Gotchas and troubleshooting

Concur request tokens are valid for 24 hours and are consumed when Serval exchanges them. This is normal: after connecting, Serval holds an access token (about one hour) and a refresh token (about six months) and rotates them automatically. You only need a new request token to re-authenticate - for example after changing identity fields or if the connection is unused for longer than the refresh token’s lifetime.
Concur refresh tokens last about six months. If the integration makes no Concur calls for longer than that, the stored tokens expire and workflows fail until you re-authenticate: generate a new company request token in Concur and enter it in the connection settings.
Access is exactly the grants and scopes on your Concur OAuth application. If a workflow gets permission errors from Concur, add the scope to the application in the OAuth 2.0 Application Management screen, then re-authenticate with a fresh request token so the new scopes take effect.
Every Concur company is assigned to a data center, and API calls must go to that host. Serval stores the geolocation Concur itself reports when the connection is created, so calls are routed correctly even if you entered a more generic host. If your company is migrated to a different data center, update the connection (with a fresh request token).
Serval attaches OAuth credentials and tokens exclusively to requests bound for *.concursolutions.com hosts. Requests to any other destination never receive the credential, and the connection form rejects non-Concur hostnames outright.
Concur v3 list results are paginated with a limit and a next-page link. A single workflow step returns only one page, so workflows that need everything must loop until there are no more pages. If a workflow seems to be “missing” records, pagination is the usual cause.
Need help? Contact support@serval.com for assistance with your SAP Concur integration.