.png)

SAP Concur Integration Guide
Connect SAP Concur travel, expense, invoice, user, and receipt data with enterprise systems through REST APIs, OAuth 2.0, selective event notifications, and workflow orchestration.
SAP Concur integration options at a glance
SAP Concur integrations are primarily API-led, with product-specific REST APIs for Expense, Invoice, Travel, User Administration, and supporting resources. OAuth 2.0 provides application authentication, while event notifications are available for selected products, resources, and lifecycle events rather than every object. Receipt and supporting-document APIs can handle metadata and binary content, and some products provide batch or asynchronous processing. Where events are unavailable, scheduled incremental synchronization can use timestamps, status filters, pagination, and checkpoints. Martini can consume these APIs, receive supported notifications, transform SAP Concur JSON and files, and coordinate downstream workflows.
Common SAP Concur integration patterns
Common SAP Concur data objects used in integrations
Authentication and security considerations
OAuth 2.0 and authorization
SAP Concur integrations generally use OAuth 2.0 with an application client ID, client secret, access token, refresh behavior, scopes, and tenant or company authorization. Access to a token does not necessarily grant access to every product or resource.
Credential protection
Martini should keep client secrets, refresh tokens, and related credentials in secure environment configuration rather than workflow payloads or source code. Development, test, and production environments should use separate authorization contexts.
Sensitive data
Expense, travel, receipt, invoice, and user data may contain personal and financial information. Apply least-privilege access, minimize sensitive logging, protect transmitted data, and configure retention according to organizational policy.
Operational considerations for SAP Concur integrations
Rate limits and retries
SAP Concur quotas can vary by API, application, tenant, and environment. Handle HTTP 429 and transient 5xx responses with bounded retries, backoff, controlled concurrency, and visible failure states.
Pagination and checkpoints
Large collections should use the API’s supported pagination model. Scheduled workflows should persist durable checkpoints, use an overlap window where appropriate, and avoid repeatedly loading complete collections.
Idempotency and state
Retain SAP Concur and target identifiers and use deterministic correlation keys before creating Expense Reports, Invoices, Receipts, or User updates. Model state transitions explicitly so approval, rejection, payment, and exception changes are not treated as duplicate transactions.
Schema and file variation
Product APIs can differ in fields, status values, identifiers, and pagination behavior. Tolerant mappings should handle optional fields, while receipt workflows should validate content type, size, encoding, retention, and duplicate attachment behavior.
Testing and monitoring
Test with separate SAP Concur environments and representative product permissions. Monitor token failures, authorization issues, validation errors, throttling, missing resources, schema changes, and downstream write failures without exposing sensitive payloads.
Why use Martini instead of scripts or point-to-point integrations?
Reusable integration logic
Martini centralizes OAuth token handling, API calls, pagination, checkpoints, mappings, validation, and retry behavior in reusable workflows rather than duplicating logic across scripts.
Orchestration across systems
A single workflow can retrieve SAP Concur Expense Reports, Invoices, Users, or Receipts, enrich the data, apply business rules, and coordinate writes to finance, workforce, document, or operational applications.
Controlled APIs and change management
Martini can expose an API façade over SAP Concur operations, isolate product-specific API differences, and provide a maintainable boundary for downstream consumers.
Operational reliability
Workflow-based error handling, idempotency, checkpointing, logging, and environment configuration provide more consistent operational controls than isolated point-to-point scripts.