Okta Generates a "Error authenticating: Action error: INVALID_CREDENTIALS [HTTP 401]: 401 Unauthorized" During SAP Concur API Credentials Test

Okta generates a 401 Unauthorized error when testing SAP Concur API credentials because the OAuth 2.0 token lacks the necessary Identity v4 API scopes. Resolve this by updating the SAP Concur OAuth application with the correct scopes and generating new tokens. Okta administrators encounter an error when selecting the Test API Credentials button under the Provisioning tab for the SAP Concur Solutions application. Okta attempts to call the SAP Concur API and receives the following error:

{"body":"Access Denied","message":"401 Unauthorized"}

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN)
• SAP Concur Solutions
• System for Cross-domain Identity Management (SCIM)

The OAuth 2.0 token from SAP Concur lacks the necessary Identity v4 API scopes required for System for Cross-domain Identity Management (SCIM) user provisioning. When an administrator selects Test API Credentials, Okta uses the token to perform a test API call against the SAP Concur endpoints. If the OAuth application registered in the SAP Concur Application Management Tool only contains basic authentication scopes, SAP Concur rejects the Okta SCIM test call with an access denied error.

Update the API scopes in the SAP Concur application.

Update the SAP Concur OAuth application to include the granular Identity v4 scopes for reading and writing user data. Review the SAP Concur Identity v4 documentation for the specific required scopes.

NOTE: Administrators do not need to activate the identity.user.delete scope to correct this issue. To delete users in SAP Concur using this scope, contact SAP Concur to obtain authorization, as this is not available by default.

How are new tokens generated in SAP Concur?

Generate a new Company Request Token and Refresh Token in SAP Concur to inherit the newly added Identity v4 scopes.

1. Generate a new Company Request Token in SAP Concur.
2. Use the new Company Request Token to generate a new Refresh Token.

NOTE: If a third-party API client generates the Refresh Token, inspect the JavaScript Object Notation (JSON) response to ensure the scope parameter lists the newly added Identity v4 scopes.

How does Okta test the new credentials?

Navigate to the SAP Concur Solutions application in the Okta Admin Console, enter the new Refresh Token, and test the API credentials.

1. Navigate to the SAP Concur Solutions application in the Okta Admin Console.
2. Select the Provisioning tab and choose Integration.
3. Verify that the Username field contains the exact Universally Unique Identifier (UUID).
4. Enter the newly generated Refresh Token.
5. Select Test API Credentials.

If the issue persists, please submit a case to Okta technical support.