Skip to main content
Solved

Clarification on Webhooks and Polling in Concur Integration

  • September 23, 2025
  • 8 replies
  • 71 views

hundleymf
Forum|alt.badge.img+4

Background:

  • In June, before Webhooks were available, setting up instant approval notifications through the Concur API was difficult because Concur doesn’t have native automation tools.
  • At that time, we were told we’d need to regularly poll Concur records to check for updates, since Webhooks weren’t an option yet.

Current Situation and Questions:

  1. Webhooks Availability:
    Now that Webhooks are available, can we use them to automatically trigger approval notifications in SAP Concur?

    • In other words: Instead of our bot checking for updates all the time, can Webhooks now handle this automatically?
  2. Impact on Our Bot Performance:
    Given that we would like to use real-time Webhooks (and not scheduled ones), what does this mean for our bot’s performance?

    • Specifically:
      • Will this drastically reduce the number of API calls our bot makes?
      • Will it make our bot more responsive, especially considering hundreds of expense approvals happen daily?
  3. Scheduled Webhooks:
    I understand that Scheduled Webhooks—which would automatically check for approvals at specific times—aren’t available yet and are expected later this quarter.

    • Until those are ready, is it correct to say that we still depend on real-time Webhooks?
    • And does that mean polling will still be necessary for certain parts of our process until scheduled Webhooks are live?
  4. Polling Necessity:
    Finally:

    • If we are fully using real-time Webhooks, do we still need to poll Concur for updates at all?
    • Or can Webhooks now replace polling altogether?

Best answer by Kevin Mok

Thanks ​@hundleymf - Based on the docs we should be able to receive events from SAP Concur. But there’s one limitation that we currently do not support.

SAP Concur uses Asymmetric Key Signature verification to secure webhooks, while in Agent Studio, we currently only support Shared secret (HMAC).

With that said, we can still receive webhooks, but they won’t be entirely secure. We enforce strict rate limits on unsecured webhooks, which could be a deal-breaker for a use case that sends a large number of instant approval notifications daily.


A workaround would be to use scheduled triggers, and as you mentioned, check twice a day (or even more frequently) for new approvals. But that won’t be instantaneous

8 replies

Kevin Mok
Forum|alt.badge.img+1
  • Community Manager
  • September 24, 2025

Hi ​@hundleymf,

As you mentioned, if Concur does not have any automation tools, it won’t be able to trigger webhooks. External systems trigger webhooks; they are not a technology that examines business records and checks for changes. I highly recommend reading How Webhooks Work.

 

One correction from your post is that we are not providing Scheduled Webhooks - but Scheduled Triggers - we explain the difference among the triggers Ambient Agents will have in this doc. Scheduled triggers are ambient agents that are triggered at a predefined time or interval. 

 

If Concur does not have any automation tools to trigger webhooks, polling will still be required. 

 

 


hundleymf
Forum|alt.badge.img+4
  • Author
  • Inspiring
  • September 24, 2025

@Kevin Mok 

Thank you for your quick responses, sincerely they help a lot!

I’ve been exploring SAP Concur's Event Subscription Service (ESS) and its capabilities. From what I understand, ESS allows us to manage subscriptions via API endpoints:

• GET /v4/subscriptions: List all existing subscriptions.
• PUT /v4/subscriptions/webhook: Create or update a webhook subscription.
• GET /v4/subscriptions/{id}: Retrieve details of a specific subscription.
• DELETE /v4/subscriptions/{id}: Remove a subscription

We can create subscriptions for specific event types—such as expense report submissions or travel requests—and Concur will call a client-defined endpoint with event data whenever these actions occur. This setup seems to enable real-time notifications about business events.

Given this, does this mean we can use Webhooks to receive automatic, instant updates whenever expenses are submitted in Concur? If so, would implementing Webhooks allow us to avoid polling Concur periodically (like twice a day at 8am and 8pm) to check for new expense submissions? 

I'm asking because of SAP Concur's Event Subscription Service (ESS) and that we would manage subscriptions through API endpoints and I want to make sure that this will work with Webhooks and would it work with Webhooks as it is setup now or do we need to wait for Schedule Triggers.

Thanks in advance for your insights!


Kevin Mok
Forum|alt.badge.img+1
  • Community Manager
  • September 25, 2025

@hundleymf Do you have the documentation site for these endpoints? I’ll like to take a look before I can confirm anything with you 😀


hundleymf
Forum|alt.badge.img+4
  • Author
  • Inspiring
  • September 25, 2025

Kevin Mok
Forum|alt.badge.img+1
  • Community Manager
  • Answer
  • September 25, 2025

Thanks ​@hundleymf - Based on the docs we should be able to receive events from SAP Concur. But there’s one limitation that we currently do not support.

SAP Concur uses Asymmetric Key Signature verification to secure webhooks, while in Agent Studio, we currently only support Shared secret (HMAC).

With that said, we can still receive webhooks, but they won’t be entirely secure. We enforce strict rate limits on unsecured webhooks, which could be a deal-breaker for a use case that sends a large number of instant approval notifications daily.


A workaround would be to use scheduled triggers, and as you mentioned, check twice a day (or even more frequently) for new approvals. But that won’t be instantaneous


hundleymf
Forum|alt.badge.img+4
  • Author
  • Inspiring
  • September 25, 2025

@Kevin Mok Thank you, this helps and answers all my questions. I appreciate the help!. 


Kevin Mok
Forum|alt.badge.img+1
  • Community Manager
  • September 25, 2025

Glad to help!


Thanks ​@hundleymf - Based on the docs we should be able to receive events from SAP Concur. But there’s one limitation that we currently do not support.

SAP Concur uses Asymmetric Key Signature verification to secure webhooks, while in Agent Studio, we currently only support Shared secret (HMAC).

With that said, we can still receive webhooks, but they won’t be entirely secure. We enforce strict rate limits on unsecured webhooks, which could be a deal-breaker for a use case that sends a large number of instant approval notifications daily.

A workaround would be to use scheduled triggers, and as you mentioned, check twice a day (or even more frequently) for new approvals. But that won’t be instantaneous

@Kevin Mok can you find out for ​@hundleymf and me if Asymmetric Key Signature verification is in the backlog to be built?

If it isn’t road mapped, can we start that discussion?   I too am tasked with building a Concur ↔ Moveworks integration and EDA style pub/sub architecture would provide us a much-enhanced user experience. 

Thank you!