ServiceNow SAP Concur Integration Guide

Architecture Overview

Implementation Steps

// REST Message HTTP Method configuration for GetExpenseEntries
var request = new sn_ws.RESTMessageV2('Concur Advanced API', 'GetExpenseEntries');
request.setStringParameterNoEscape('user_id', current.u_employee_number);
request.setStringParameterNoEscape('report_id', current.u_concur_report_id);
request.setRequestHeader('Concur-CorrelationId', 'ServiceNow-' + current.sys_id);
var response = request.execute();
if (response.getStatusCode() == 200) {
    var responseBody = response.getBody();
    var expenseData = JSON.parse(responseBody);
    return expenseData;
} else {
    gs.error('Concur API Error: ' + response.getStatusCode() + ' - ' + response.getBody());
}

// Scheduled Job script for syncing Concur expense reports
var concurAPI = new sn_ws.RESTMessageV2('Concur Advanced API', 'GetExpenseReports');
var lastSync = gs.getProperty('concur.last_sync_time', gs.dateGenerate(gs.daysAgoStart(1)));
concurAPI.setStringParameterNoEscape('modifiedafter', lastSync);
var response = concurAPI.execute();

if (response.getStatusCode() == 200) {
    var reports = JSON.parse(response.getBody()).Items;
    var processed = 0;
    
    reports.forEach(function(report) {
        var gr = new GlideRecord('u_concur_expense_report');
        gr.addQuery('u_concur_report_id', report.ID);
        gr.query();
        
        if (!gr.next()) {
            gr.initialize();
            gr.u_concur_report_id = report.ID;
            gr.short_description = 'Expense Report: ' + report.Name;
        }
        
        gr.u_total_amount = report.Total;
        gr.u_approval_status = report.ApprovalStatusCode;
        gr.state = mapConcurStatusToSNState(report.ApprovalStatusCode);
        gr.update();
        processed++;
    });
    
    gs.setProperty('concur.last_sync_time', new GlideDateTime().getDisplayValue());
    gs.info('Processed ' + processed + ' Concur expense reports');
} else {
    gs.error('Concur sync failed: ' + response.getStatusCode());
}

// Scripted REST API Resource for Concur webhooks
(function process(request, response) {
    var requestBody = request.body.dataString;
    var signature = request.getHeader('X-Concur-Signature');
    
    // Validate webhook signature
    var expectedSignature = gs.generateHMAC('HmacSHA256', requestBody, gs.getProperty('concur.webhook.secret'));
    if (signature !== expectedSignature) {
        response.setStatus(401);
        response.setBody('Invalid signature');
        return;
    }
    
    var webhookData = JSON.parse(requestBody);
    
    if (webhookData.eventType === 'expense.report.submit') {
        var gr = new GlideRecord('u_concur_expense_report');
        gr.addQuery('u_concur_report_id', webhookData.data.reportId);
        gr.query();
        
        if (gr.next()) {
            gr.state = 'submitted_for_approval';
            gr.update();
            
            // Trigger approval workflow
            var workflow = new Workflow();
            workflow.startFlow('expense_approval_flow', gr.sys_id);
        }
    }
    
    response.setStatus(200);
    response.setBody('Processed');
})(request, response);

Common Use Cases

Troubleshooting

Pro Tips

• →Implement custom business rules on the expense report table to automatically assign categories and priorities based on amount thresholds and expense types, improving routing efficiency and SLA management. Use dot-walking in your business rules to access related employee data like department and manager information for intelligent assignment logic.
• →Create a custom application with dedicated modules for expense management to provide users with streamlined views of their expense requests and approval status. Include custom UI actions that allow managers to approve expenses directly from ServiceNow while maintaining integration with Concur's approval workflow through API callbacks.
• →Set up Performance Analytics widgets to track expense processing metrics including average approval times, policy violation rates, and integration health indicators. Configure automated alerting when API error rates exceed acceptable thresholds or when expense report processing falls behind schedule.
• →Implement field-level encryption for sensitive expense data like personal credit card information or detailed receipt data stored in ServiceNow. Use the Edge Encryption proxy to encrypt data at rest while maintaining searchability for reporting and analytics purposes.
• →Configure Connection & Credential Aliases with multiple failover endpoints to handle Concur data center outages or maintenance windows. Implement circuit breaker patterns in your integration code to automatically switch to secondary endpoints when primary connections fail.
• →Create custom update sets specifically for Concur integration components to streamline deployment across development, test, and production environments. Include all related tables, business rules, scheduled jobs, and credentials in a single update set for consistent deployment practices.

Known Limitations

• —The SAP Concur API enforces a rate limit of 1000 requests per hour per application, which may constrain real-time synchronization for large organizations with high expense report volumes. This requires implementing queuing mechanisms and spreading API calls across longer time windows to avoid throttling.
• —Concur's webhook delivery mechanism does not guarantee ordered delivery of events, potentially causing race conditions when processing rapid status changes on the same expense report. ServiceNow implementations must include logic to handle out-of-order webhook processing and maintain data consistency.
• —The Integration Hub SAP Concur spoke requires an Integration Hub Professional license and supports a limited subset of Concur's API endpoints, necessitating custom REST Message implementations for advanced features like detailed expense line item retrieval or custom field synchronization. This increases development complexity and maintenance overhead.
• —Real-time bidirectional synchronization is not fully supported due to Concur's API architecture, which may result in temporary data inconsistencies between systems during high-volume processing periods. Critical approval decisions should include manual verification steps to ensure data accuracy.
• —MID Server dependency for webhook processing and outbound API calls adds infrastructure complexity and potential points of failure. Organizations must maintain high availability MID Server configurations and monitor connectivity to prevent integration disruptions during network outages or maintenance windows.

Frequently Asked Questions