What data moves between QuickBooks Online and SAP Concur, and in which direction?

The main flow is SAP Concur to QuickBooks Online. Expense reports, invoices (Payment Requests), and financial integration documents flow from SAP Concur into QuickBooks Online as bills and journal entries. Vendors and cost centers are synchronized in both directions so expenses land on valid accounts. Invoices and expense reports are read-only in SAP Concur, so ml-connector does not write financial data back into SAP Concur.

How does ml-connector handle SAP Concur's multi-region setup and mutual TLS requirement?

SAP Concur returns a geolocation (us, emea, or cn) in the OAuth token response, and ml-connector uses that geolocation for all subsequent API calls to route to the correct region. SAP Concur also requires a client certificate for mutual TLS on every webhook delivery, with CN matching webhook.api.concursolutions.com. ml-connector stores the certificate encrypted and presents it at the TLS layer on each inbound webhook.

How are QuickBooks Online OAuth refresh tokens and SAP Concur auth tokens managed?

QuickBooks Online access tokens expire in 1 hour and refresh tokens rotate every 24-26 hours; ml-connector refreshes the access token on each 401 response. SAP Concur auth tokens are valid for 24 hours on first exchange only, after which refresh tokens (6-month lifetime) are used. If either refresh fails or revokes, ml-connector surfaces the error so re-authentication can happen, preventing silent failures.

QuickBooks OnlineSAP Concur

QuickBooks Online and SAP Concur integration

QuickBooks Online runs your accounting. SAP Concur manages travel and expenses. Connecting them keeps your accounts payable and your expense records synchronized. Expense reports and invoices submitted in SAP Concur flow directly into QuickBooks Online as bills, allocated to the correct vendors and cost centers, without manual re-entry. ml-connector handles the very different OAuth flows on each side, the mutual TLS certificate that SAP Concur requires, and moves the data as expense reports and invoices arrive.

How QuickBooks Online works

QuickBooks Online exposes vendors, employees, accounts, cost centers, bills, invoices, payments, and journal entries through the QuickBooks Online Accounting API (v3), a REST API accessible at https://quickbooks.api.intuit.com/v3/company/{realmId}. Authentication uses OAuth 2.0 Authorization Code flow with short-lived access tokens (1 hour) and rotating refresh tokens (24-26 hour rotation cycle, up to 5-year lifetime). QuickBooks Online sends data via webhooks on Create/Update/Delete for bills, invoices, accounts, vendors, and more, with each webhook payload containing only the entity ID and operation type, requiring a full-record fetch via GET. A CDC (Change Data Capture) endpoint is also available for polling with up to 30 days of history. All creates and updates require exact object representation with a SyncToken for concurrency control.

How SAP Concur works

SAP Concur exposes vendors, invoices (called Payment Requests), purchase orders, expense reports, and financial integration documents through a multi-region REST API. The base URL is determined by geolocation returned in the OAuth token response (us.api.concursolutions.com, emea.api.concursolutions.com, or cn.api.concursolutions.com), and all subsequent calls must use that region. Authentication uses OAuth 2.0 password grant with a company-level auth token that is valid for 24 hours on first exchange, after which refresh tokens (6-month lifetime) are used. SAP Concur requires mutual TLS for webhook delivery with a certificate CN matching webhook.api.concursolutions.com (issuer SAP SE). Webhooks are delivered through the Event Subscription Service (ESS) with at-least-once semantics and automatic retries on 5xx, 401, 403, 429, and I/O errors. SAP Concur enforces a limit of 5 active event subscriptions per application.

What moves between them

The main flow is from SAP Concur into QuickBooks Online. Expense reports and invoices submitted in SAP Concur are received via webhook, transformed into QuickBooks Online bill documents, and posted to the accounts payable and cost center accounts designated for that expense category. Vendor records are synchronized in both directions so SAP Concur invoices land on vendors that already exist in QuickBooks Online. Financial integration documents generated by SAP Concur for expenses and invoices flow into QuickBooks Online's general ledger, mapped to the cost centers and departments captured at the time of expense submission. The sync runs as webhooks arrive from SAP Concur and can be supplemented with scheduled polling to catch any missed events.

How ml-connector handles it

ml-connector stores both credential sets encrypted. For QuickBooks Online, it stores the OAuth 2.0 refresh token and realm_id, and refreshes the access token when calls return 401. For SAP Concur, it stores the OAuth 2.0 client credentials and company_id, exchanges the auth token once on first connection, and uses the refresh token thereafter. SAP Concur returns a geolocation in the token response (us, emea, or cn), and ml-connector uses that geolocation for all subsequent API calls to route to the correct region - never hardcoding a single base URL. SAP Concur webhooks arrive with a mutual TLS client certificate (CN webhook.api.concursolutions.com) that ml-connector verifies at the TLS layer. Expense and invoice records are fetched in full from SAP Concur, mapped to matching vendors and accounts in QuickBooks Online, and posted as bills with the SyncToken required by QuickBooks Online for concurrency. SAP Concur rate limits and webhook delivery is at-least-once, so ml-connector deduplicates on expense or invoice ID. QuickBooks Online OAuth refresh tokens rotate every 24-26 hours and revoke the entire auth chain if stale, so ml-connector handles token rotation gracefully and re-authenticates if a refresh fails.

A real-world example

A mid-sized services consulting firm uses QuickBooks Online for all accounting and SAP Concur for employee travel and expense management. Before the integration, the finance team downloaded expense reports from SAP Concur every week and manually created bills in QuickBooks Online, then matched them to cost centers for project allocation. With QuickBooks Online and SAP Concur connected, each approved expense report flows directly into QuickBooks Online as a bill on the same day, allocated to the correct project cost center. Month-end close no longer requires manual expense matching, and the AP aging report in QuickBooks Online reflects the actual company spend without rework.

What you can do

Post approved expense reports from SAP Concur into QuickBooks Online as bills, allocated to the correct cost centers and vendors.
Synchronize vendor records between SAP Concur and QuickBooks Online so invoices land on matching vendor accounts.
Transform SAP Concur financial integration documents (expenses, invoices) into QuickBooks Online journal entries with cost center and department dimensions.
Verify SAP Concur mutual TLS webhook certificates, refresh both OAuth 2.0 tokens on expiry, and route to the correct SAP Concur region based on geolocation.
Deduplicate and retry on webhook delivery failures with a full audit trail on every expense report and invoice posted.

Questions

What data moves between QuickBooks Online and SAP Concur, and in which direction?: The main flow is SAP Concur to QuickBooks Online. Expense reports, invoices (Payment Requests), and financial integration documents flow from SAP Concur into QuickBooks Online as bills and journal entries. Vendors and cost centers are synchronized in both directions so expenses land on valid accounts. Invoices and expense reports are read-only in SAP Concur, so ml-connector does not write financial data back into SAP Concur.
How does ml-connector handle SAP Concur's multi-region setup and mutual TLS requirement?: SAP Concur returns a geolocation (us, emea, or cn) in the OAuth token response, and ml-connector uses that geolocation for all subsequent API calls to route to the correct region. SAP Concur also requires a client certificate for mutual TLS on every webhook delivery, with CN matching webhook.api.concursolutions.com. ml-connector stores the certificate encrypted and presents it at the TLS layer on each inbound webhook.
How are QuickBooks Online OAuth refresh tokens and SAP Concur auth tokens managed?: QuickBooks Online access tokens expire in 1 hour and refresh tokens rotate every 24-26 hours; ml-connector refreshes the access token on each 401 response. SAP Concur auth tokens are valid for 24 hours on first exchange only, after which refresh tokens (6-month lifetime) are used. If either refresh fails or revokes, ml-connector surfaces the error so re-authentication can happen, preventing silent failures.

Connect QuickBooks Online and SAP Concur

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started