APIs

Please refer to the SAP Concur Developer Centre Release Notes for complete details, available 18 June, 2021.

Car

Concur Travel currently allows travellers to filter by car type on the search results page, within the off and on-airport car rental workflows.

Every rental car offer is connected to a four-letter code (ACRISS) that indicates the car category, car type, transmission type and fuel type. Concur Travel previously used a self-defined list of car types/classes that represented a mixture of these four criteria, based on historical usage.

Targeted for this release, a revised hard-coded car class list is applied to the search result matrix. Each car category displayed in the filtered search results is connected to the equivalent first ACRISS code letter, which reflects existing car categories.

As the car images previously displayed in the search results are not a correct indicator of the car category, these will be removed.

This change improves car rental search usability.

Flight

In February 2020, SAP Concur and CIBT (CIBTvisas) launched a new integration method through the SAP Concur App Centre, where the new CIBT app is available. The legacy integration method with CIBT is still supported during a transition period, but SAP Concur will eventually retire the Legacy Batch File protocol integration method, targeted for 01 August, 2021.

With the new integration through the SAP Concur App Centre, the CIBT service is available for additional countries. Travellers whose profiles are associated with a Concur Travel configuration based in Denmark, Finland, Ireland, Norway or Sweden can now benefit from CIBT’s visa services.

CIBT has integrated with the SAP Concur Itinerary API and Travel Profile API and has released an App Centre Connector to facilitate the continuous, real-time flow of itineraries to better serve clients and travellers.

CIBT will be able to support clients and travellers in more countries and with a more stable, scalable integration. The new integration method also reduces the configuration effort for admin users in Concur Travel.

Concur Travel now supports a new version of seat maps using the Travelport Universal API platform.

SAP Concur is currently running a pilot with pre-selected customers and TMCs. The pilot is targeted for completion by the end of the second quarter. If no further issues are discovered, the new seat map experience could be generally available to all Travelport customers in early July. An updated release timeline will be provided in the July release notes, potentially as an after-the-fact notification.

The new seat map user experience is accurate and reliable, and it considers the customer’s Frequent Flyer status and the fare type selected. The old seat maps did not account for either of these.

The new seat map provides an improved seat selection success rate as we now have a better understanding of seat availability. The new seat map experience will be available for more than 90 airlines via Apollo and Worldspan, and more than 140 airlines via Galileo.

Ground

Concur Travel currently provides travellers with the capability to purchase Park ‘N Fly off-airport parking near certain airports at a discounted rate at the time of booking.

This feature was provided to offer a cost-effective alternative to on-airport parking at many airports in the United States.

For the June release, this feature is decommissioned for the following reasons:

• Continued pre-pandemic declines in usage of Park ‘N Fly booked via Concur Travel, combined with requirements to maintain the service and necessary functional updates (such as airport locations due to permanent Park ‘N Fly location closings), makes future investment in this feature uneconomical.
• Other discounted off-airport parking options are available to travellers in addition to the Park ‘N Fly product. A generic parking solution that is limited to US locations does not fully reflect all offerings and capabilities across the global off-airport parking landscape.
• e-Receipts are not supported (requires manual reimbursement process for travellers).

Security

SAP is adopting the Domain-based Message Authentication (DMARC) e-mail security protocol for all e-mail sent from SAP. As a result, the e-mail addresses for some e-mail sent from SAP Concur organisations will no longer be sent from the @sap.com root domain but will instead be sent from a subdomain of sap.com, such as @example.sap.com where “example” is the subdomain.

If your organisation maintains an allow list for e-mail addresses, update your allow list to include e-mail from the following domains. This will ensure that you receive e-mails sent from the sap.com root domain and its subdomains:

• @info.sap.com
• @mail.sap.com
• @*sap.com

DMARC compliance provides better security for e-mails sent from SAP to its customers.

Miscellaneous

SAP Concur support for Hash-Based Message Authentication Code (HMAC) is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel are currently assisting customers who use HMAC to migrate to SAP Concur SAML v2 SSO (SAML v2).

SAP Concur provides a Single Sign-On self-service option that enables client admins to setup their SAML v2 connections without involving an SAP Concur support representative.

This change provides better security and improved support for users logging in to SAP Concur products and services.

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

• Key file is available in client’s root folder.
• Key ID 40AC5D35.
• RSA 4096-bit signing and encryption subkey.
• Key expires every 2 years.
• Client is responsible for replacing the key before it expires.
• • Next expiry date: 4 September, 2022.
  • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date.

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• mft-us.concursolutions.com
• vs.concursolutions.com
• st-eu.concursolutions.com
• mft-eu.concursolutions.com

The rotating public PGP key provides greater security for file transfers.

This release note is intended for the technical staff responsible for file migrations with SAP Concur solutions. For our customers and suppliers participating in data exchange, SAP Concur solutions is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and 31 July 2021. After they are migrated to the more efficient process, clients will see the following improvement:

• With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur solutions will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

These changes provide greater security and efficiency for file transfers.

As part of our overall cloud platform strategy, SAP is implementing a more consistent naming convention for the URLs used to connect to SAP Concur solutions, based on data centre. Users will continue to be able to access www.concursolutions.com and will be routed automatically to the correct URL or single sign-on (SSO) as part of their sign-in process.

No customer data is planned to leave the North America or EMEA regional data centre to which it is assigned at any time before, during or after this change.

This change supports future URL consistency across all global regions, and a central URL that redirects users to the appropriate data centre.

Administration

Since 2018, we have moved most of our e-mail notifications service to a new cloud platform. Because of this transition, companies who filter inbound e-mail based on the sending IP address must add new IP addresses to their Safe Sender list. This ensures that their users are able to receive e-mail from SAP Concur.

In 2021, we plan to move e-mails sent from Concur Travel for all customers to our e-mail notifications service running on a new cloud platform. Additionally, on the EMEA data centre (DC) only, we plan to make an IP address update for all SAP Concur solutions. To ensure your organisation is prepared, we recommend making any changes by 1 July, 2021.

Initially, this transition affected only companies using Concur Expense. Now, e-mail from Concur Travel will also use the new e-mail infrastructure.

Customers on the North America Data Centre using Concur Expense have already added the IP addresses to their allow-list and are not affected.

Customers on the North America Data Centre using Concur Travel without Concur Expense will be affected by this change if they filter incoming e-mail based on IP addresses.

All customers on the EMEA Data Centre filtering incoming e-mail based on IP addresses are affected by the change. This includes customers that are using Concur Expense and have previously added IP addresses to their Safe Sender list. SAP Concur is including additional IP addresses from which e-mails will be sent.

This new service improves stability and security. It significantly speeds up the time to process and dispatch e-mails.

Flight

Concur Travel will decommission the Search both primary GDS and the Southwest direct connect feature for customers that have both the GDS and Southwest Direct Connect (WNDC) enabled. Since the feature was built prior to the industry-standard branded fares concept, extensive code changes would be required to update this feature to work as expected with branded fares. SAP Concur has made the decision to decommission this feature to ensure Southwest branded fares continue to be searchable and bookable in Concur Travel.

Targeted for 26 July 2021, the related settings will be disabled and removed for all customers. This means that after this update occurs, customers will see Southwest content only from the direct connect.

This change will simplify the set-up for how Southwest Airlines’ flights and fares are sourced in Concur Travel when the direct connect is enabled. Customers will also see a reduction in scans to the GDS since these scans will no longer take place.

Profile

The XML Profile Sync, which is used to synchronise Concur Travel user profile data with TMC partners, will no longer be available, and this is targeted for the end of 2021. We advise all partners to engage with SAP Concur representatives to adopt the Travel Profile v2 API for managing Travel User profiles.

The XML Profile Sync was officially decommissioned in 2016 due to instability and other issues. The Travel Profile v2 API was built to replace this legacy synchronisation process. It has now reached such a level of stability and maturity that there is no longer any reason to maintain multiple profile sync options.

Travel Operations / Technical Essentials

In order for Concur Travel to process offline bookings and updates to online bookings, specific information must be present in the PNR. Today, all of the following are required pieces of information:

1. Company ID (CLIQCID)
2. Travel Configuration ID (CLIQCONFIGID)
3. Login ID (CLIQUSER)

However, while all of these have been required historically, SAP Concur did not always reject PNRs when required fields were missing. With this update, these requirements will be enforced. Any Sabre, Amadeus or Worldspan PNRs missing required information will be rejected and placed in the error queue. Galileo and Apollo PNRs missing required information will be rejected.

Concur Travel uses the Travel Configuration ID to match trips to the correct configuration. This information will also be used to identify Compleat-integrated customers. Without it, Concur Travel/Compleat integration features will not be available.

TripLink

Targeted for 22 July 2021, the capability of forwarding confirmation e-mails to plans@concur.com will be retired. The same functionality will continue to be available with plans@tripit.com. Users must have their TripIt and Concur Travel accounts linked so that the confirmation e-mails sent to plans@tripit.com are automatically synced to Concur Travel.

SAP Concur is retiring support for plans@concur.com because a richer service is provided through TripIt Pro. Forwarding travel plans to plans@tripit.com will not only provide the same functionality as plans@concur.com, but it will also improve traveller satisfaction when they use TripIt, a popular travel app and perk for business travellers.

Accessibility

SAP implements changes to better meet current Web Content Accessibility Guidelines (WCAG). Information about accessibility-related changes made to SAP Concur solutions is published on a quarterly basis. You can review the quarterly updates on the Accessibility Updates (English only) page.

Browser Certifications and Supported Configurations

The SAP Concur Release Notes – Monthly Browser Certifications document lists current and planned browser certifications. The document is available with the other SAP Concur monthly release notes.

The Concur Travel & Expense Supported Configurations – Client Version guide is available with the set-up guides, user guides and other technical documentation.

Subprocessors

The list of non-affiliated subprocessors is available here: SAP Concur list of Subprocessors

If you have questions or comments, please reach out to: Privacy-Request@Concur.com