diff --git a/PULLMERGE.md b/PULLMERGE.md index b264fc31c..6290634a7 100644 --- a/PULLMERGE.md +++ b/PULLMERGE.md @@ -60,6 +60,10 @@ Clone the repository. You can have multiple clones of the same repository on yo 1. Go to your `pullmerge` copy of the `developer.concur.com` repository + cd ~/pullmerges/developer.concur.com + +* Mac Users + cd pullmerges/developer.concur.com 2. Ensure you're on `main` branch, and it's up to date diff --git a/src/_data/sidebars/tools-support.yml b/src/_data/sidebars/tools-support.yml index e94cd87a5..c3ee0ca3c 100644 --- a/src/_data/sidebars/tools-support.yml +++ b/src/_data/sidebars/tools-support.yml @@ -5,6 +5,8 @@ - title: Developer Platform Release Notes url: '' children: + - title: December 2025 + url: /tools-support/release-notes/api/2025-12-04.html - title: November 2025 url: /tools-support/release-notes/api/2025-11-11.html - title: October 2025 diff --git a/src/api-reference/expense/expense-report/v4.expense-tax-new.markdown b/src/api-reference/expense/expense-report/v4.expense-tax-new.markdown deleted file mode 100644 index cb5121dd8..000000000 --- a/src/api-reference/expense/expense-report/v4.expense-tax-new.markdown +++ /dev/null @@ -1,325 +0,0 @@ ---- -title: Expense Tax v4 -layout: reference ---- -# Expense Tax v4 - -{% include prerelease.html %} - -The Expense Tax v4 API can be used for operations related to the association of a tax with an expense on a report. - -## Limitations - -Access to this documentation does not provide access to the API. - -## Products and Editions - -* Concur Expense Professional Edition -* Concur Expense Standard Edition - -## Scope Usage - -Name | Description | Endpoint | -------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------| -`expense.report.read` | Read information about tax details of an expense on a report. | GET | -`expense.report.readwrite` | Read information about tax details of an expense on a report. Note: this is a variance from how the `.readwrite` scope works with other Expense v4 APIs. Write access to tax details is specifically limited to `expense.report.tax.readwrite`. | GET | -`expense.report.tax.readwrite`| Read and Write information about tax details of an expense on a report. | GET/PATCH | - -## Dependencies - -SAP Concur clients must purchase Concur Expense to use this API. User based API requires the use of the [Identity v4 API](/api-reference/profile/v4.identity.html). Please contact your SAP Concur representative for more information. - -## Access Token Usage - -This API only supports company level access tokens. - -## Retrieves Tax Details for a specific Expense on a specific Report - -Gets tax details for the specified expense on a specific report. - -### Scopes - -* `expense.report.read` - Refer to [Scope Usage](#scope-usage) for full details. -* `expense.report.readwrite` - Refer to [Scope Usage](#scope-usage) for full details. -* `expense.report.tax.readwrite` - Refer to [Scope Usage](#scope-usage) for full details. - -### URI - -```shell -/expensereports/v4/reports/{reportId}/expenses/{expenseId}/taxes -``` - -#### Parameters - -|Name|Type|Format| Description | -|---|---|---|-----------------------------------------------------------------------------------------------------------------------------------------------------------------| -`reportId`|`string`|-| **Required** The unique identifier of the report that is being read. | -`expenseId`|`string`|-| **Required** The unique identifier of the expense that is being read. | - - -### Payloads - -* Request: None -* Response: [Expense Tax Details Response](#tax-details-response-schema) - -### Examples - -#### Requests - -```shell -curl -X 'GET' \ - 'https://us.api.concursolutions.com/expensereports/v4/reports/28BA437223EE41A49F7B/expenses/51ADA86C8EB164488FE67180CCE16EDB/taxes' \ - --header 'Authorization: Bearer {access_token}' \ - --header 'Content-Type: application/json' -``` - -#### Response - -```shell -{ -"expenseTaxes": [ - { - "customData": [ - { - "id": "custom1", - "value": "custom1", - "isValid": true, - "listItemUrl": null - }, - { - "id": "custom2", - "value": "custom2", - "isValid": true, - "listItemUrl": null - }, - { - "id": "custom5", - "value": "custom5", - "isValid": true, - "listItemUrl": null - }, - { - "id": "custom6", - "value": "custom6", - "isValid": true, - "listItemUrl": null - }, - { - "id": "custom9", - "value": "custom9", - "isValid": true, - "listItemUrl": null - } - ], - "reclaimCode": null, - "reclaimTransactionAmount": null, - "taxAuthorityId": "D3216F5209D6694EBDD5CB52D0326D3B", - "taxAuthorityName": "Canada GST", - "taxCode": null, - "taxLabel": "GST", - "taxFormId": "C66F76E686904304A5A6F44C62239E24", - "taxRateTypeId": null, - "taxRateTypeName": null, - "taxReclaimConfigurationId": null, - "taxTransactionAmount": null, - "taxPostedAmount": null, - "taxReclaimPostedAmount": null - }, - { - "customData": [ - { - "id": "custom1", - "value": "custom1", - "isValid": true, - "listItemUrl": null - }, - { - "id": "custom2", - "value": "custom2", - "isValid": true, - "listItemUrl": null - }, - { - "id": "custom5", - "value": "custom5", - "isValid": true, - "listItemUrl": null - }, - { - "id": "custom6", - "value": "custom6", - "isValid": true, - "listItemUrl": null - }, - { - "id": "custom9", - "value": "custom9", - "isValid": true, - "listItemUrl": null - } - ], - "reclaimCode": null, - "reclaimTransactionAmount": null, - "taxAuthorityId": "1CBBFDFE4E77CD478E9F09161A9DC777", - "taxAuthorityName": "Canada QST", - "taxCode": null, - "taxLabel": "QST", - "taxFormId": "C66F76E686904304A5A6F44C62239E24", - "taxRateTypeId": null, - "taxRateTypeName": null, - "taxReclaimConfigurationId": null, - "taxTransactionAmount": null, - "taxPostedAmount": null, - "taxReclaimPostedAmount": null - } - ] -} -``` - -## Updates the Tax Details of a Specific Expense in a Submitted Report - -Updates the tax details and custom data of a specified expense on a submitted report. When calling this endpoint only Company JWT authentication is -allowed. The fields that can be updated are `taxTransactionAmount`, `reclaimTransactionAmount`, `reclaimCode`, `customData`, and`taxCode`. - -### Scopes - -* `expense.report.tax.readwrite` - Refer to [Scope Usage](#scope-usage) for full details. - -### URI - -```shell -/expensereports/v4/reports/{reportId}/expenses/{expenseId}/tax/{taxAuthorityId} -``` - -#### Parameters - -|Name|Type|Format| Description | -|---|---|---|--------------------------------------------------------------------------------------| -`reportId`|`string`|-| **Required** The unique identifier of the report to which this expense entry belongs | -`expenseId`|`string`|-| **Required** The unique identifier of the expense entry that is being patched. | -`taxAuthorityId`|`string`|-| **Required** The unique identifier of the tax associated with an expense entry. | - -#### Headers - -* [RFC 7231 Accept-Language](https://tools.ietf.org/html/rfc7231#section-5.3.5) -* [RFC 7231 Content-Type](https://tools.ietf.org/html/rfc7231#section-3.1.1.5) -* [RFC 7231 Content-Encoding](https://tools.ietf.org/html/rfc7231#section-3.1.2.2) -* [RFC 7234 Cache-Control](https://tools.ietf.org/html/rfc7234#section-5.2) -* [RFC 7232 If-Modified-Since](https://tools.ietf.org/html/rfc7232#section-3.3) -* [RFC 7231 Accept-Encoding](https://tools.ietf.org/html/rfc7231#section-5.3.4) -* [RFC 7235 Authorization](https://tools.ietf.org/html/rfc7235#section-4.2) - Bearer Token that identifies the caller. - This is the Company or User access token. - -#### REST Design Specification - -PATCH operations in Expense Reports v4 conform to the JSON Merge Patch specification: - -* [RFC 7386 Authorization - JSON Merge Patch](https://tools.ietf.org/html/rfc7386) - -### Payloads - -* Request: [Patch Expense Tax Schema](#update-report-expense-tax-schema) -* Response: None - -### Examples - -#### Request - -```shell -curl --location --request PATCH 'https://us.api.concursolutions.com/expensereports/v4/reports/52FE459784414104BA4D/expenses/A57E742BFA61994DABC964EE39677392/tax/11373416D4DC0640B6B2CDE372937C1A' \ ---header 'Authorization: Bearer {access_token}' \ ---header 'Content-Type: application/json' \ ---header 'Content-Type: text/plain' \ ---data-raw '{ - "customData": [ - { - "id": "custom1", - "value": "check" - } - ], - "reclaimTransactionAmount": 12, - "taxTransactionAmount": 25, - "reclaimCode": "RC7", - "taxCode": "TC7" -}' -``` - -#### Response -```shell -204 No Content -``` - -## Schema - -### Expense Tax Details Response - -| Name | Type | Format | Description | -|-----------------|--------------------------------------|--------------|---------------------------------------| -| `expenseTaxes` | [`ExpenseTaxes`](#expense-tax-schema) | - | The list of tax data for the expense. | - -### Expense Tax - -| Name | Type | Format | Description | -|-----------------------------|---------------------------------------------------|--------|----------------------------------------------------------------------------------------------------------------------------------------------------------| -| `customData` | [`CustomData`](#expense-tax-custom-data-schema) | - | This is a set of data that the custom fields contain for the tax based on the configuration. This set might be empty if no custom fields are configured. | -| `reclaimCode` | `string` | - | The tax reclaim code. | -| `reclaimTransactionAmount` | `decimal` | - | The tax reclaim transaction amount. | -| `taxAuthorityId` | `string` | - | **Required** The unique identifier of the tax authority. This also uniquely identifies a specific tax for an expense entry. | -| `taxAuthorityName` | `string` | - | The name of the tax authority. | -| `taxCode` | `string` | - | The tax code. | -| `taxLabel` | `string` | - | The localized label of the tax authority. | -| `taxFormId` | `string` | - | The unique identifier of the tax form associated with the expense. | -| `taxRateTypeId` | `string` | - | The unique identifier of the tax rate type id. | -| `taxRateTypeName` | `string` | - | The name of the tax rate type. | -| `taxReclaimConfigurationId` | `string` | - | The unique identifier of the tax reclaim configuration id. | -| `taxTransactionAmount` | `decimal` | - | The tax transaction amount. | -| `taxPostedAmount` | `decimal` | - | The tax posted amount. | -| `taxReclaimPostedAmount` | `decimal` | - | The tax reclaim posted amount. | - - -### Custom Data - -| Name | Type | Format | Description | -|---------------|-----------|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `id` | `string` | - | **Required** The unique identifier of the custom field. Examples: `custom1`, `orgUnit1` | -| `isValid` | `boolean` | `true`/`false` | If `true`, the value returned is valid. This value is returned for custom fields of all data types and is specifically evaluated for list items to represent the current status. Default: `true` | -| `value` | `string` | - | The value of the custom field. This field can have values for all the supported data types such as `text`, `integer`, `boolean` and `listItemId`. Maximum length: 48 characters | -| `listItemUrl` | `string` | - | href (string): The URL of the related HATEOAS link that you can use for subsequent calls. | - -#### Update Custom Data - -| Name | Type | Format | Description | -|-----------|-----------|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `id` | `string` | - | **Required** The unique identifier of the custom field. Examples: `custom1`, `orgUnit1` | -| `isValid` | `boolean` | `true`/`false` | Whether the value returned is valid or not. This value is returned for custom fields of all data types and is specifically evaluated for list items to represent the current status. Default: `true` | -| `value` | `string` | - | The value of the custom field. This field can have values for all the supported data types such as `text`, `integer`, `boolean` and `listItemId`. Maximum length: 48 characters | - -### Update Report Expense Tax Schema - -| Name | Type | Format | Description | -|----------------------------|--------------------------------------------------------|--------|-----------------------------------------------------------------------------------------------------------| -| `customData` | [`CustomData`](#update-expense-tax-custom-data-schema) | - | The details from the `customData` fields. These fields may not have data, depending on the configuration. | -| `taxTransactionAmount` | `decimal` | - | The tax transaction amount. | -| `reclaimTransactionAmount` | `decimal` | - | The reclaim transaction amount. | -| `taxCode` | `string` | - | The tax code. | -| `reclaimCode` | `string` | - | The reclaim code. | - -### Error Message - -| Name | Type | Format | Description | -|----------------------|-----------------------------------------------|-------------|------------------------------------------------------------------| -| `customResponseData` | `object` | - | The custom parameters related to error. | -| `errorId` | `string` | - | The unique identifier of the error associated with the response. | -| `errorMessage` | `string` | - | **Required** The detailed error message. | -| `httpStatus` | `string` | - | **Required** The HTTP response code and phrase for the response. | -| `path` | `string` | - | **Required** The URI of the attempted request. | -| `timestamp` | `string` | `date-time` | **Required** The time when the error was captured. | -| `validationErrors` | [`ValidationError`](#validation-error-schema) | - | The validation error messages. | - -### Validation Error - -| Name | Type | Format | Description | -|----------|----------|--------|-----------------------------------------------| -| `id` | `string` | - | The ID of the validation error. | -| `message`| `string` | - | The detailed message of the validation error. | -| `source` | `string` | - | The type of validation which failed. | diff --git a/src/api-reference/expense/expense-report/v4.expense-tax.markdown b/src/api-reference/expense/expense-report/v4.expense-tax.markdown index 4fbe2e72b..b8d945984 100644 --- a/src/api-reference/expense/expense-report/v4.expense-tax.markdown +++ b/src/api-reference/expense/expense-report/v4.expense-tax.markdown @@ -17,11 +17,11 @@ Access to this documentation does not provide access to the API. ## Scope Usage -Name | Description |Endpoint| -------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----| -`expense.report.read` | Read information about tax details of an expense on a report. | GET | -`expense.report.readwrite` | Read information about tax details of an expense on a report. Note: this is a variance from how the `.readwrite` scope works with other Expense v4 APIs. Write access to tax details is specifically limited to `expense.report.tax.readwrite`. | GET | -`expense.report.tax.readwrite`| Read and Write information about tax details of an expense on a report. | GET | +Name | Description | Endpoint | +------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------| +`expense.report.read` | Read information about tax details of an expense on a report. | GET | +`expense.report.readwrite` | Read information about tax details of an expense on a report. Note: this is a variance from how the `.readwrite` scope works with other Expense v4 APIs. Write access to tax details is specifically limited to `expense.report.tax.readwrite`. | GET | +`expense.report.tax.readwrite`| Read and Write information about tax details of an expense on a report. | GET/PATCH | ## Dependencies @@ -174,6 +174,79 @@ curl -X 'GET' \ } ``` +## Updates the Tax Details of a Specific Expense in a Submitted Report + +Updates the tax details and custom data of a specified expense on a submitted report. When calling this endpoint only Company JWT authentication is +allowed. The fields that can be updated are `taxTransactionAmount`, `reclaimTransactionAmount`, `reclaimCode`, `customData`, and`taxCode`. + +### Scopes + +* `expense.report.tax.readwrite` - Refer to [Scope Usage](#scope-usage) for full details. + +### URI + +```shell +/expensereports/v4/reports/{reportId}/expenses/{expenseId}/tax/{taxAuthorityId} +``` + +#### Parameters + +|Name|Type|Format| Description | +|---|---|---|--------------------------------------------------------------------------------------| +`reportId`|`string`|-| **Required** The unique identifier of the report to which this expense entry belongs | +`expenseId`|`string`|-| **Required** The unique identifier of the expense entry that is being patched. | +`taxAuthorityId`|`string`|-| **Required** The unique identifier of the tax associated with an expense entry. | + +#### Headers + +* [RFC 7231 Accept-Language](https://tools.ietf.org/html/rfc7231#section-5.3.5) +* [RFC 7231 Content-Type](https://tools.ietf.org/html/rfc7231#section-3.1.1.5) +* [RFC 7231 Content-Encoding](https://tools.ietf.org/html/rfc7231#section-3.1.2.2) +* [RFC 7234 Cache-Control](https://tools.ietf.org/html/rfc7234#section-5.2) +* [RFC 7232 If-Modified-Since](https://tools.ietf.org/html/rfc7232#section-3.3) +* [RFC 7231 Accept-Encoding](https://tools.ietf.org/html/rfc7231#section-5.3.4) +* [RFC 7235 Authorization](https://tools.ietf.org/html/rfc7235#section-4.2) - Bearer Token that identifies the caller. + This is the Company or User access token. + +#### REST Design Specification + +PATCH operations in Expense Reports v4 conform to the JSON Merge Patch specification: + +* [RFC 7386 Authorization - JSON Merge Patch](https://tools.ietf.org/html/rfc7386) + +### Payloads + +* Request: [Patch Expense Tax Schema](#update-report-expense-tax-schema) +* Response: None + +### Examples + +#### Request + +```shell +curl --location --request PATCH 'https://us.api.concursolutions.com/expensereports/v4/reports/52FE459784414104BA4D/expenses/A57E742BFA61994DABC964EE39677392/tax/11373416D4DC0640B6B2CDE372937C1A' \ +--header 'Authorization: Bearer {access_token}' \ +--header 'Content-Type: application/json' \ +--header 'Content-Type: text/plain' \ +--data-raw '{ + "customData": [ + { + "id": "custom1", + "value": "check" + } + ], + "reclaimTransactionAmount": 12, + "taxTransactionAmount": 25, + "reclaimCode": "RC7", + "taxCode": "TC7" +}' +``` + +#### Response +```shell +204 No Content +``` + ## Schema ### Expense Tax Details Response @@ -211,6 +284,24 @@ curl -X 'GET' \ | `value` | `string` | - | The value of the custom field. This field can have values for all the supported data types such as `text`, `integer`, `boolean` and `listItemId`. Maximum length: 48 characters | | `listItemUrl` | `string` | - | href (string): The URL of the related HATEOAS link that you can use for subsequent calls. | +#### Update Custom Data + +| Name | Type | Format | Description | +|-----------|-----------|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `id` | `string` | - | **Required** The unique identifier of the custom field. Examples: `custom1`, `orgUnit1` | +| `isValid` | `boolean` | `true`/`false` | Whether the value returned is valid or not. This value is returned for custom fields of all data types and is specifically evaluated for list items to represent the current status. Default: `true` | +| `value` | `string` | - | The value of the custom field. This field can have values for all the supported data types such as `text`, `integer`, `boolean` and `listItemId`. Maximum length: 48 characters | + +### Update Report Expense Tax Schema + +| Name | Type | Format | Description | +|----------------------------|--------------------------------------------------------|--------|-----------------------------------------------------------------------------------------------------------| +| `customData` | [`CustomData`](#update-expense-tax-custom-data-schema) | - | The details from the `customData` fields. These fields may not have data, depending on the configuration. | +| `taxTransactionAmount` | `decimal` | - | The tax transaction amount. | +| `reclaimTransactionAmount` | `decimal` | - | The reclaim transaction amount. | +| `taxCode` | `string` | - | The tax code. | +| `reclaimCode` | `string` | - | The reclaim code. | + ### Error Message | Name | Type | Format | Description | diff --git a/src/tools-support/release-notes/api/2025-12-04.md b/src/tools-support/release-notes/api/2025-12-04.md new file mode 100644 index 000000000..150332499 --- /dev/null +++ b/src/tools-support/release-notes/api/2025-12-04.md @@ -0,0 +1,200 @@ +--- +title: SAP Concur Developer Center - API Release Notes, December 2025 +layout: reference +--- +# API Release Notes, December 2025 + +## New This Month + +### Preview: Retrieve Card Transactions by User with Cards v4 + +The Cards Service API suite will be updated to include an endpoint to retrieve user credit card transactions. Only cleared card transactions received via file feed, or bespoke API integration are supported. Card transactions received via the Yodlee integration, including personal card transactions, are not exposed. This endpoint will initially support only User JWT authentication. + +### Updated Preview: Support for IPv6 + +The SAP Concur platform will support IPv6 for network communication to and from SAP Concur solutions via HTTPS and SFTP. This implementation is expected for Q4/2025. Previously, IPv6 was only supported for inbound HTTPS calls, and all other inbound and outbound calls supported only IPv4. Check out [July's Release Notes](/tools-support/release-notes/api/2025-07-10.html) for more details. + +## Ongoing + +### Updated: New Client SSL Certificate for ESS webhook.api.concursolutions.com + +**Overview** + +In an effort to ensure the ongoing security of our products and services, on October 22, 2025, ESS issued a new webhook.api.concursolutions.com SSL certificate. We will always use the same client [x509](/api-reference/ess/2026.webhook.api.concursolutions.com.pem) certificate. The common name is C=DE, ST=Baden-Württemberg, L=Walldorf, O=SAP SE, CN=webhook.api.concursolutions.com. + +Please note that this year not just the certificate has been reissued, but also the location, country, and organization in the certificate metadata is changing to SAP. + +Make sure you visit our [Troubleshooting](/api-reference/ess/v4.event-subscription.html#ess-troubleshooting) section in the Event Subscription Service v4 documentation. + +### Updated: Public Certificate Root Change + +To maintain compliance with evolving security standards and ensure uninterrupted compatibility with Mozilla-based browsers, we are transitioning our digital certificates to the updated DigiCert Global Root G2 and G3 authorities: + +* DigiCert Global Root G2 – for RSA-based certificates + +* DigiCert Global Root G3 – for ECDSA-based certificates + +This proactive update follows DigiCert’s announcement regarding Mozilla’s planned deprecation of the DigiCert Global Root CA. + +Adopting the new root certificates is critical to avoid potential trust errors or connection issues when accessing our services via Mozilla browsers. + +Target Implementation Dates: + +Certificate|Implementation Date +---|--- +*.concurcdc.cn|Oct 2, 2025 +*.api.concurcdc.cn|Oct 9, 2025 +*.concursolutions.com|Oct 23, 2025 +*.api.concursolutions.com|Nov 6, 2025 + +Clients who have not pinned the certificate do not need to take any action as the new certificate will automatically be updated when it becomes available. + +#### RECOMMENDATION – Please Read Carefully + +**Certificate pinning is not recommended.** + +While it may add a layer of control, pinning certificates introduces risks. Certificates used by SAP Concur are renewed on a regular basis. Pinned certificates are not updated automatically and may cause service disruptions if not updated before implementation date. + +#### FOR SAP ICS Customers + +Please refer to section 2 “**Which SSL certificates do I need to have installed**” of [2914977 - FAQ: Concur Certificates, Authentication, and Connectivity](https://me.sap.com/notes/2914977) for detailed instructions. + +#### ACTION REQUIRED + +If your systems **pin** the root or intermediate certificate, you must update your trust store to include the following certificates: + +**RSA Certificates Download Links** + +* Intermediate: [DigiCert Global G2 TLS RSA SHA256 2020 CA1](https://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt.pem?_gl=1*i7c9wi*_gcl_au*MTI2NjY3MzYyMC4xNzMyNTAwNTAw) +* Root: [DigiCert Global Root G2](https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem?_gl=1*102cn1j*_gcl_au*MTI2NjY3MzYyMC4xNzMyNTAwNTAw) + +**ECDSA Certificates Download Links** + +* Intermediate: [DigiCert Global G3 TLS ECC SHA384 2020 CA1](https://cacerts.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crt.pem?_gl=1*htixu2*_gcl_au*MTY5MjI4Mjk2Ni4xNzQzOTg1ODYz) +* Root: [DigiCert Global Root G3](https://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem?utm_medium=organic&utm_source=google&referrer=https://www.google.com/&_gl=1*1ouisuk*_gcl_au*MTUwNDgyOTI5OS4xNzQxMjQ2NDEy) + +> Note: Most modern systems now prefer **ECDSA** for connections, while **RSA** is still used primarily by legacy systems. To ensure full compatibility, please ensure that your systems trust both **ECDSA and RSA certificates**. + +**CERTIFICATE CHAIN LINKS**: (consist of end-entity, Intermediate, and Root certificates respectively). If your system is pinning the end-entity certificate, see the links below. +Please make sure to open the link in an Incognito or Private browser window to ensure there is no cached data causing outdated or incorrect content to appear. + +*.concursolutions.com + +[https://assets.concur.com/concurtraining/cte/en-us/concursolutions-com-chain_ECDSA.pem](https://assets.concur.com/concurtraining/cte/en-us/concursolutions-com-chain_ECDSA.pem) + +[https://assets.concur.com/concurtraining/cte/en-us/concursolutions-com-chain_RSA.pem](https://assets.concur.com/concurtraining/cte/en-us/concursolutions-com-chain_RSA.pem) + +*.api.concursolutions.com + +[https://assets.concur.com/concurtraining/cte/en-us/api-concursolutions-com-chain_ECDSA.pem](https://assets.concur.com/concurtraining/cte/en-us/api-concursolutions-com-chain_ECDSA.pem) + +[https://assets.concur.com/concurtraining/cte/en-us/api-concursolutions-com-chain_RSA.pem](https://assets.concur.com/concurtraining/cte/en-us/api-concursolutions-com-chain_RSA.pem) + +You can [test the certificate here](https://help.sap.com/docs/SAP_CONCUR/c5d6d15e7ecb4b4d8238b383d59ac2f4/8430787301844a698c894eecf317b858.html?locale#test-the-certificate). + +### Updated: Digital Certificates to be Transitioned to DigiCert Global Root G2 and G3 Authorities + +The following change applies to the **Concur Cloud for Public Sector** data center: To maintain compliance with evolving security standards and ensure uninterrupted compatibility with Mozilla-based browsers, SAP Concur is transitioning our digital certificates to the following updated DigiCert Global Root G2 and G3 authorities: + +* DigiCert Global Root G2 – for RSA-based certificates +* DigiCert Global Root G3 – for ECDSA-based certificates + +Adopting the new root certificates is critical to avoid potential trust errors or connection issues when accessing our services via Mozilla browsers. + +>**Note**: This proactive update follows DigiCert’s announcement regarding Mozilla’s planned deprecation of the DigiCert Global Root CA. + +* Information First Published: October 10, 2025 +* Applies to: All Products +* Applicable Data Centers: Concur Cloud for Public Sector + +>**Note**: The information in this release note applies to the Concur Cloud for Public Sector data center. For information about Digital Certificate transitions for other data centers, refer to [**Ongoing** Digital Certificates to be Transitioned to DigiCert Global Root G2 and G3 Authorities](https://help.sap.com/docs/SAP_CONCUR/c5d6d15e7ecb4b4d8238b383d59ac2f4/1164714ddbd044c5aeca870bbc4e4a3a.html) in the Release Notes section of these release notes. + +Edition|Component|Administrator Action|Availability Target +---|---|---|--- +Professional and Standard|Digital Certificates|Required|Refer to Availability Target Details + +**Availability Target Details**: SAP Concur plans to implement the changes on the following schedule: + +**Target Implementation Dates** + +Certificate|Implementation Date and Time +---|--- +usg.concursolutions.com|January 15, 2026 at 22:00 PDT +usg.api.concursolutions.com|January 22, 2026 at 22:00 PDT + +Clients who have not pinned the certificate do not need to take any action as their certificate will be updated automatically. **Most clients do not pin the certificate.** + +>**Note**: Certificate pinning is not recommended. To maintain compliance with evolving security standards, SAP Concur renews certificates on a regular basis. Pinned certificates are **not** updated automatically and failure to manually update them before the implementation date might cause service disruptions. + +>**Note**: SAP ICS customers who follow the certificate handling processes described in the following note do not need to take any action: [2914977 - FAQ: Concur Certificates, Authentication, and Connectivity](https://help.sap.com/docs/SAP_CONCUR/c5d6d15e7ecb4b4d8238b383d59ac2f4/1164714ddbd044c5aeca870bbc4e4a3a.html). + +**Action is required if you pin certificates.** If your organization pins the root or intermediate certificate, you must update your trust store to include the new certificates before your scheduled update date to avoid service disruptions. + +**Updated Root Certificates for Pinning Customers:** + +RSA Certificate Chain: +* Intermediate: [DigiCert Global G2 TLS RSA SHA256 2020 CA1](https://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt.pem?_gl=1*i7c9wi*_gcl_au*MTI2NjY3MzYyMC4xNzMyNTAwNTAw) +* Root: [DigiCert Global Root G2](https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem?_gl=1*102cn1j*_gcl_au*MTI2NjY3MzYyMC4xNzMyNTAwNTAw) + + ECDSA Certificate Chain: +* Intermediate: [DigiCert Global G3 TLS ECC SHA384 2020 CA1](https://cacerts.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crt.pem?_gl=1*htixu2*_gcl_au*MTY5MjI4Mjk2Ni4xNzQzOTg1ODYz) +* Root: [DigiCert Global Root G3](https://cacerts.digicert.com/DigiCertGlobalRootG3.crt.pem?utm_medium=organic&utm_source=google&referrer=https://www.google.com/&_gl=1*1ouisuk*_gcl_au*MTUwNDgyOTI5OS4xNzQxMjQ2NDEy) + +Complete chain: (end-entity, Intermediate and Root certificates, respectively) + +For usg.concursolutions.com + +* [https://assets.concur.com/concurtraining/cte/en-us/usg-concursolutions-com-chain_RSA.pem](https://assets.concur.com/concurtraining/cte/en-us/usg-concursolutions-com-chain_RSA.pem) +* [https://assets.concur.com/concurtraining/cte/en-us/usg-concursolutions-com-chain_ECDSA.pem](https://assets.concur.com/concurtraining/cte/en-us/usg-concursolutions-com-chain_ECDSA.pem) + +For usg.api.concursolutions.com + +* [https://assets.concur.com/concurtraining/cte/en-us/usg-api-concursolutions-com-chain_RSA.pem](https://assets.concur.com/concurtraining/cte/en-us/usg-api-concursolutions-com-chain_RSA.pem) +* [https://assets.concur.com/concurtraining/cte/en-us/usg-api-concursolutions-com-chain_ECDSA.pem](https://assets.concur.com/concurtraining/cte/en-us/usg-api-concursolutions-com-chain_ECDSA.pem) + +**Additional Note for usg.api.concursolutions.com:** + +As part of our recent Digicert account migration from **Concur** to **SAP**, the organization information associated with usg.api.concursolutions.com certificates has been updated. + +**From**: +subject=C=US, ST=Washington, L=Bellevue, O=Concur Technologies, Inc., + +**To**: +subject=C=DE, ST=Baden-Württemberg, L=Walldorf, O=SAP SE + +**Note**: This is an internal administrative change and does not affect certificate validity or functionality. + +You can access and test the certificates by following the instructions in [Shared Release Notes](https://help.sap.com/docs/SAP_CONCUR/c5d6d15e7ecb4b4d8238b383d59ac2f4/be7724518e33480ea5d9ab4070b283d1.html). Note that the release notes will be updated with the latest changes for usg.api.concursolutions.com in the month of November. + +If you're unsure whether your organization pins certificates, please reach out to your IT department for guidance. You can also review additional details in us Shared Release Notes. + +## Previews + +In general, this table lists items that will be shipping in the next 30-60 days. For a broader view of features that are coming, please see our [Road Map Explorer](https://roadmaps.sap.com/board?PRODUCT=089E017A62AB1EDA94C15F5EDB3400E1&range=CURRENT-LAST#Q3%202024). + +Date|API|Preview +---|---|--- +[11/2025](/tools-support/release-notes/api/2025-11-11.html)|Patch Expense Taxes by Expense ID|The Expense Report Service API suite will be updated to include a mechanism to update tax details for a specified expense entry. These details will include individual tax amounts, tax and reclaim code, and custom data. +[07/2025](/tools-support/release-notes/api/2025-07-10.html)|New Attributes for Spend User v4.1|The Spend User v4.1 API will allow you to access the `processorReportAccess` field in the User Preference extension and the User extension will allow you to access the following fields: `officeLocationCountry`, `officeLocationStateProvince`, `officeLocationCity`. +[06/2025](/tools-support/release-notes/api/2025-06-04.html)|Detokenizer (DTK) v5 API|The FIPS Compliant v5 Credit Card Detokenization API will be set to launch within the CCPS environment for IBCP customers. This compliance-driven initiative aligns with the Federal Information Processor Standards (FIPS) to ensure robust protection of sensitive data, per U.S. federal requirements. +[04/2025](/tools-support/release-notes/api/2025-04-03.html)|New Fields Added to Financial Integration Services (FIS) v4 API|For customers of the Concur Expense Professional Edition using the Financial Integration Services (FIS) v4 API, additional fields will be included in the Expense report document payload and mileage fields will be added to the payroll document schema. +[05/2024](/tools-support/release-notes/api/2024-05-09.html)|Retention Period for Credit Card Data Files|For compliance reasons, SAP Concur will be implementing a process wherein card data files received from external sources (Issuing banks, Card associations) will be deleted from systems after 90 days. +[01/2024](/tools-support/release-notes/api/2024-01-11.html)|Hotel Service v4|Updates to Hotel Service v4 that will remove existing elements from the section relating to gender and name prefixes. + +## Deprecations and Decommissions + +APIs are being deprecated or decommissioned in accordance with the [SAP Concur API Lifecycle & Deprecation Policy](/tools-support/deprecation-policy.html). + +Date|API|Details +---|---|--- +[10/2025](/tools-support/release-notes/api/2025-10-02.html)|Deprecation of Locations v3|Effective October 10, 2025, the Locations v3 API will be deprecated. This has been replaced by Localities v5. Decommission will follow. +[07/2025](/tools-support/release-notes/api/2025-07-10.html)|Deprecation of Expense Group Configurations v3|Effective June 26, 2025, the Expense Group Configurations v3 API was deprecated. This has been replaced by the Expense Configuration v4 API. Decommission will follow. +[07/2025](/tools-support/release-notes/api/2025-07-10.html)|Deprecation of Expense v3 DELETE |Effective June 26, 2025, Expense v3 DELETE was deprecated. This has been replaced by Expense v4 Delete. Decommission will follow. +[07/2025](/tools-support/release-notes/api/2025-07-10.html)|Deprecation of Attendees v3 API|Effective July 1, 2025, the Attendees v3 API was deprecated. This has been replaced by Attendees v4. Decommission will follow. +[07/2025](/tools-support/release-notes/api/2025-07-10.html)|Deprecation of Attendee Types v3 API|Effective July 1, 2025, the Attendee Types v3 API was deprecated. This has been replaced by Attendee Types v4. Decommission will follow. +[04/2025](/tools-support/release-notes/api/2025-04-03.html)|Deprecation of Attendees v1, v1.1, and v2|Effective October 9, 2018, we have deprecated the Attendees v1, v1.1, and v2 APIs. Decommission will follow. +[03/2024](/tools-support/release-notes/api/2024-03-14.html)|Deprecation of Spend User Retrieval 4.0.|The decommission of password provisioning via file import will occur in April 2025. +[06/2023](/tools-support/release-notes/api/archive/2023-06-02.html)|Deprecation of Launch External URL Callout v1|The Launch External URL V1 API is deprecated as of June 16th, 2023. Decommission will follow. +[01/2023](/tools-support/release-notes/api/archive/2023-01-05.html)|Move from the Travel Request External Validation Callout v1 to the Event Subscription Service (ESS)|This callout was designed to work with the Concur Request v1 API that is in the process of being decommissioned. Users are strongly recommended to move to the Event Subscription Services (ESS) in order to subscribe to the [Request events](https://developer.concur.com/api-reference/ess/v4.event-subscription.html). +[01/2021](/tools-support/release-notes/api/archive/2021-01-22.html#planned-list-deprecation)|List v3 API|Effective April 16, 2021, we have deprecated the List v3 API. This API is replaced by the [List v4](/api-reference/common/lists/v4.list.html) API. List v3 is planned to be retired in a future release. +[01/2021](/tools-support/release-notes/api/archive/2021-01-22.html#planned-list-item-deprecation)|List Item v3 API|Effective April 16, 2021, we have deprecated the List Item v3 API. This API is replaced by the [List Item v4](/api-reference/common/list-item/v4.list-item.html) API. List Item v3 is planned to be retired in a future release. Please migrate to the [List Item v4](/api-reference/common/list-item/v4.list-item.html) API as soon as possible. diff --git a/src/tools-support/release-notes/index.markdown b/src/tools-support/release-notes/index.markdown index c67c3a5e8..9e12d5e4f 100644 --- a/src/tools-support/release-notes/index.markdown +++ b/src/tools-support/release-notes/index.markdown @@ -6,6 +6,7 @@ layout: reference ## Developer Platform Release Notes +* [December 2025](./api/2025-12-04.html) * [November 2025](./api/2025-11-11.html) * [October 2025](./api/2025-10-02.html) * [September 2025](./api/2025-09-04.html)