Pre-2017 Authorization (Deprecated)

Access tokens

An access token is a long-lived token used to make API calls.

Verb and URIs

All authentication and authorization tasks use the GET verb and URI as noted here depending on type of application:

Keys and Secrets

The Application Authorization section in the New Partner Application page includes Key and Secret fields that are used to generate a request token which is later exchanged for an access token.

Getting an access token

Parameters

Input

None

Response

Refreshing an access token

NOTE: The token being refreshed must be used to make the refresh call.

Parameters

Input

None

Response

Revoking a single access token for a given user

POST https://{InstanceURL}/net2/oauth2/revoketoken.ashx

Note: To revoke tokens, the caller must have one of the following roles:

• Web Services Administrator for Concur Professional/Premium
• Can Administrator for Concur Standard.

Headers

Parameters

Response

None

Example

POST https://www.concursolutions.com/net2/oauth2/revoketoken.ashx?token=fdjhk2382kwkajsklwe8i3932kslswl
Authorization: OAuth fdjhk2382kwkajsklwe8i3932kslswl

Revoking all access tokens for a user

POST https://www.concursolutions.com/net2/oauth2/revoketoken.ashx

Headers

Parameters

Response

w None

Example

POST https://www.concursolutions.com/net2/oauth2/revoketoken.ashx?consumerKey=eZByXv2X41cJlC21pSVvRi&user=Maria
Authorization: OAuth fdjhk2382kwkajsklwe8i3932kslswl

Choosing an authorization flow

Use this table to decide which OAuth 2.0 authorization flow to use for the application:

Native

The request must contain the following HTTP headers:

Headers

Example

GET {uri}
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
X-ConsumerKey: hj7683jslks93lalkjss93

Response

Access token response

Web

There are two types of access levels that can be enabled with web flow:

This is determined by the type of Concur user account used in the process.

The web flow is as follows:

1. Application redirection to the Concur website for authentication and authorization.
2. Parse of a inbound HTTP request from the Concur system to an application specified endpoint.
3. Getting an access token

Application Redirection to the Concur website for authentication and authorization.

https://www.concursolutions.com/net2/oauth2/Login.aspx?{parameters}

Parameters

Parse of a inbound HTTP request from the Concur system to an application specified endpoint.

http://{redirect_uri}?{parameters}

• If access is denied the error and error_description parameters are used.
• If access is granted the code parameter is used.

Parameters

AppCenter

The AppCenter flow is as follows:

1. Listening for an HTTP GET request from the Concur system.
   • The listener must be hosted at the URI specified in the App Center listing.
   • The request will be in this form: GET {listener_URI}?code={request_token}
2. Parsing the request token value from the code query parameter.
3. Getting an access token

Auto-Connect

The Auto-Connect flow is an authorization to support Connection Requests API calls from TripLink applications. During the Auto-Connect flow, the request token associated with a TripLink application is exchanged for an access token for the user who granted the TripLink application access to the user’s Concur data.

1. Periodically getting a list of connection requests.

   GET /common/connectionrequests

2. For each user in the connection requests response: Getting an access token

3. For each connection request, call any other Concur APIs you need to match the Concur user with the user in your system. When the user is successfully matched, or when matching fails, update the connection request.

   PUT /common/connectionrequests/{id}

4. If you encounter an error that makes it impossible to complete the connection process, revoke the access token so the user knows that the connection attempt failed and they can try again at a later time.