> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAP Concur

## After this article

You'll be able to connect SAP Concur to Lumos to sync users, spend groups, spend roles, and product entitlements. The integration supports both syncing and provisioning, and you can connect it read-only or write-enabled.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User account records |
| Spend Groups | Permission | Yes | No | Access control groups |
| Spend Roles | Permission | Yes | Yes | Role definitions in SAP Concur |
| Product Entitlement | Permission | Yes | Yes | Product access in SAP Concur |

**Update Account.** Update Account writes the same fields as Create Account: the core identity fields (email, given name, family name, active) plus the enterprise and spend fields, and custom attributes. Every field is optional, so Lumos patches only the fields you map.

Assigning a spend role a user already holds, or removing one they do not hold, completes as a no-op rather than failing, so re-running a task is safe. When Create Account finds the user already exists in Concur, Lumos reads the account's real status and runs activation if it is inactive.

Deprovisioning supports two actions on users. **Delete** removes a user in SAP Concur. **Deactivate** sets a user inactive.

**Assign Approver.** The connector can set a user's Expense approver. You identify the approver by employee number and Lumos resolves it to the matching Concur user before writing. Concur supports one primary and one secondary Expense approver per user, and the assignment names the slot it writes to (**Primary** or **Secondary**) rather than filling whichever slot is free, so the same request always does the same thing and you can replace the approver in a slot that is already taken. Assigning an approver who is already in that slot is a safe no-op. The lookup requires the `identity.user.enterprise.read` scope, and the approver must hold the **EXP\_APPROVER** spend role.

Lumos syncs each user's current approvers as the attributes **primaryExpenseApprover** and **secondaryExpenseApprover**. The primary Expense approver is also writable: **Primary Expense Approver** is a standard field on Update Account, so you can map it in Attribute Sync (for example to keep the approver in step with a manager change). The field accepts the approver's Concur user ID or their employee number. The secondary approver is set through Assign Approver.

## Required plan and roles

SAP Concur authenticates with an OAuth 2.0 application. Before you start, reach out to SAP Concur Support to get a **Client ID**, **Client Secret**, **Company UUID** (Organization ID), and **Refresh Token**. Support also tells you the geolocation of your instance.

The application behind your Client ID must be configured with the right scopes. Which scopes you need depends on whether you want read-only visibility or full provisioning.

**Read-only scopes**

* `identity.user.ids.read`
* `spend.listitem.read`
* `identity.user.core.read`, retrieves user information like name and active status
* `identity.user.coresensitive.read`, retrieves user information like email
* `spend.user.general.read`, retrieves users' spend roles

**Write scopes (add these for provisioning)**

* `user.provision.write`
* `identity.user.coreenterprise.writeonly`
* `identity.user.delete`
* `spend.user.general.writeonly`
* `identity.user.enterprise.read`, required by the Assign Approver capability to look up approvers by employee number

The SAP Concur connector card also lists these scopes as required: `EXPRPT`, `spend.listitem.read`, `identity.user.ids.read`, `identity.user.sap.read`, and `travel.user.general.read`. Confirm the full set with SAP Concur Support when they provision your application.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Ask SAP Concur Support to configure your OAuth application with only the read-only scopes (`identity.user.ids.read`, `spend.listitem.read`, `identity.user.core.read`, `identity.user.coresensitive.read`, `spend.user.general.read`) and the connection syncs without write access.

**What read-only requires.** The same OAuth application credentials (Client ID, Client Secret, Company UUID, Refresh Token) configured with the read-only scope set above. Follow the steps below to request them from SAP Concur Support.

**What full provisioning requires.** The same application configured with the write scopes added on top of the read set, `user.provision.write`, `identity.user.coreenterprise.writeonly`, `identity.user.delete`, and `spend.user.general.writeonly`.

**Watch out for.** SAP Concur Support, not you, configures the scopes on your application, so switching modes means going back to Support to add the write scopes rather than making a self-service change. The connector card also lists `EXPRPT`, `spend.listitem.read`, `identity.user.ids.read`, `identity.user.sap.read`, and `travel.user.general.read` as required, so confirm the full scope set with Support rather than relying on the read and write lists alone.

## Instructions

**Phase 1: Get your credentials from SAP Concur**

1. Contact SAP Concur Support and request a Client ID, Client Secret, Organization ID (Company UUID), and Refresh Token.
2. Ask Support to configure the application with the read-only scopes above, plus the write scopes if you plan to provision.
3. Ask Support for the geolocation of your instance. You'll enter it as a full URL with no trailing slash, for example `https://us2.api.concursolutions.com`. The full list of API servers is in SAP Concur's Base URIs documentation.

**Phase 2: Connect in Lumos**

1. Find the SAP Concur card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter the **Client ID**, **Client Secret**, **Company UUID**, **Refresh Token**, and **Geolocation**.
3. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails with an authentication error.** Confirm the Client ID, Client Secret, Company UUID, and Refresh Token are the exact values SAP Concur Support gave you. The refresh token is issued by Support, not generated in the console.

**Connection succeeds but no data syncs.** Check that the application behind your Client ID has the read-only scopes configured. Ask SAP Concur Support to verify the scope set on the application.

**Provisioning actions fail.** Read-only scopes let Lumos sync but not write. To provision, the application also needs the write scopes (`user.provision.write`, `identity.user.coreenterprise.writeonly`, `identity.user.delete`, `spend.user.general.writeonly`).

**Assign Approver fails.** Four things to check. The OAuth application needs the `identity.user.enterprise.read` scope. Without it, Lumos can't resolve the approver's employee number. The approver must have a spend profile and the **EXP\_APPROVER** spend role. And Concur allows only one primary and one secondary Expense approver per user, so choose the slot you want to write to; assigning to an occupied slot replaces the approver in it. The employee number must also match exactly one Concur user.

**Requests go to the wrong region.** The Geolocation value routes every API call. Enter the full base URL for your instance with no trailing slash, for example `https://us2.api.concursolutions.com`. If Support gave you an EMEA or China instance, use that host instead of the US default.