Important: This API is currently in pre-release status and is only available to approved early access partners. The API is under development and might change before being generally released. To become an early access partner, contact your SAP Concur Representative.

Overview

The Hotel Services v2 Direct Connect from Concur Connect provides a method for Travel users to access hotel inventory.

The Hotel Service 2.0 API from SAP Concur is a specification based on OTA 2015 standard for Hotel Suppliers. Please refer to XSD schema of the service and WSDL service description. This Guide provides information how the Hotel Supplier can make their content available for Concur Travel users using Hotel Service 2.0 API. Once the Hotel Supplier has developed and certified their interface with SAP Concur, their inventory will begin appearing in hotel searches by opted-in Travel users. This API has client/server architecture, where SAP Concur acts as client, pulling information from the Hotel Supplier, who acts as server, responding to SAP Concur’s requests. This guide specifies the request and response format required by SAP Concur.

This call-out differs from the in-bound SAP Concur web services in the following ways:

  • It uses an out-bound message where SAP Concur calls a public facing API end-point provided by the hotel supplier.
  • The supplier configures and maintains the public web service interface. This guide specifies the request and response format required by SAP Concur.

Contents

Product Restrictions

Hotel Service 2 API inventory is not accessible from the SAP Concur mobile app. SAP Concur products are highly configurable, and not all clients will have access to all features.

Supported Operations

  • Search
  • Availability
  • Hotel Description
  • Reservation
  • Read-Itinerary
  • Cancel

Non-Functional Requirements

Response Times

SAP Concur needs to receive all responses within 55 seconds, otherwise it causes timeout. To prevent no show fees, duplicate bookings and other similar issues, SAP Concur recommends to perform Auto-Cancel by the Hotel Supplier if ReadRQ message is not sent by SAP Concur 5 minutes after HotelResRS message was sent to SAP Concur.

Emergency Technical Contact

The Hotel supplier needs to provide emergency technical contact email that will be used for communication in case of blocking technical issues.

Testing Environment

To allow SAP Concur performing testing, the Hotel Supplier needs to provide testing URL or specify properties for testing in production URL. SAP Concur needs to be able to perform test bookings with testing credit cards.

Security

PCI DSS Compliance

As sensitive data and payment card details are transferred via API, the Hotel Suppliers need to comply with PCI DSS standard. SAP Concur is compliant with PCI DSS standard and undergoes regular security audits.

HTTPS

SAP Concur prefers to use the newer TLS 1.2, however TLS 1.1 is still supported. TLS 1.0 is not supported. The Hotel Supplier will provide SAP Concur HTTPS URL of its end-point. Standard HTTPS port 443 should be used.

Concur IP Ranges

Check with SM to see if we already have a publicly available list of IPs suppliers/vendors have to white-list.

URLs

SAP Concur will receive a single URL from the Hotel Supplier. All requests will go to that URL.

For details of all required HTTP headers refer to Headers

SAP Concur is using date as xs:date XML type “2017-05-01”.

Handling of HTML

CDATA and HTML code inside of XML nodes and attributes are not allowed. These data will be escaped. The hotel suppliers should not use XML special characters - predefined entities: &, <, >, “, ‘ inside of ID elements like RatePlanID.

Message Structure

All messages to and from the HS2 API follow this structure:

Requests

  • Envelope
    • Header
    • Body
      • OTA_ RQ

Note: The Header element in a request must contain the Authentication element.

Responses

  • Envelope
    • Header
    • Body
      • OTA_RS

Note: The header in the response does not need the Authentication element.