<commit_before>---
title: Headers 
layout: reference
---

Concur will send the username and password in both the HTTP header and the SOAP header.  The HTTP header, please refer to <Headers page>




# HTTP Headers

Concur will send the following HTTP headers in every request.  The contents of the Authentication header will be repeated in the SOAP pay-load.


| Header name | Data Type | Description |
|----------|-----------|---------------|
| Authorization | string | A Base64 encoded string in the form of 'Basic <username:password>' |
| Soapaction | string | The message type e.g search.  The action will always be sent in lowercase |
| Content-Type | string | All communication with the HS2 API is by way of a "application/xml" content type |
| Accept | string | Concir will always set the Accept header to "application/xml". |
| Accept-Charset | string | Concur will always set the Accept-Charset header to "utf-8". |

Supported Soapactions:

| Soapaction | Functionality |
|----------|-----------|
| search | Used in Search requests |
| availability | Used in Availability requests |
| detail | Used in Hotel Description requests | 
| book | Used in Reservation requests | 
| read | Used in Read Itinerary requests | 
| cancel | Used in Cancel requests | 

Example HTTP Header from network capture:

```bash
Header: (http.Header) (len=4) {
	(string) (len=13) "Authorization": ([]string) (len=1 cap=1) {
	(string) (len=38) "*************************
	},
	(string) (len=12) "Content-Type": ([]string) (len=1 cap=1) {
	(string) (len=32) "application/xml; charset=\"utf-8\""
	},
	(string) (len=10) "Soapaction": ([]string) (len=1 cap=1) {
	(string) (len=6) "search"
	},
  (string) (len=6) "Accept": ([]string) (len=1 cap=1) {
  (string) (len=15) "application/xml"
	},
  (string) (len=14) "Accept-Charset": ([]string) (len=1 cap=1) {
  (string) (len=5) "utf-8"
	}
}
```

# Soap Header

The Soap header nested in the Envelope will contain an authentication element.

**authentication**

|  Element |	Required | Data Type 	|  Description |
|----------|-----------|---------------------------|-|
| userid | Y | String	| Contains the authentication details |
| password | Y | String	| Contains the authentication details |

Sample:

```xml
    <Header xmlns="http://schemas.xmlsoap.org/soap/envelope/">
        <authentication xmlns="http://www.concur.com/webservice/auth">
            <userid>testLogin123</userid>
            <password><PASSWORD>>
        </authentication>
    </Header><commit_msg>more formatting<commit_after>---
title: Headers 
layout: reference
---

Concur will send the username and password in both the HTTP header and the SOAP header.  The HTTP header, please refer to <Headers page>




# HTTP Headers

Concur will send the following HTTP headers in every request.  The contents of the Authentication header will be repeated in the SOAP pay-load.


| Header name | Data Type | Description |
|----------|-----------|---------------|
| Authorization | string | A Base64 encoded string in the form of 'Basic <username:password>' |
| Soapaction | string | The message type e.g search.  The action will always be sent in lowercase |
| Content-Type | string | All communication with the HS2 API is by way of a "application/xml" content type |
| Accept | string | Concir will always set the Accept header to "application/xml". |
| Accept-Charset | string | Concur will always set the Accept-Charset header to "utf-8". |

Supported Soapactions:

| Soapaction | Functionality |
|----------|-----------|
| search | Used in Search requests |
| availability | Used in Availability requests |
| detail | Used in Hotel Description requests | 
| book | Used in Reservation requests | 
| read | Used in Read Itinerary requests | 
| cancel | Used in Cancel requests | 

Example HTTP Header from network capture:

```bash
Header: (http.Header) (len=4) {
  (string) (len=13) "Authorization": ([]string) (len=1 cap=1) {
  (string) (len=38) "*************************
	},
  (string) (len=12) "Content-Type": ([]string) (len=1 cap=1) {
  (string) (len=32) "application/xml; charset=\"utf-8\""
	},
  (string) (len=10) "Soapaction": ([]string) (len=1 cap=1) {
  (string) (len=6) "search"
	},
  (string) (len=6) "Accept": ([]string) (len=1 cap=1) {
  (string) (len=15) "application/xml"
	},
  (string) (len=14) "Accept-Charset": ([]string) (len=1 cap=1) {
  (string) (len=5) "utf-8"
	}
}
```

# Soap Header

The Soap header nested in the Envelope will contain an authentication element.

**authentication**

|  Element |	Required | Data Type 	|  Description |
|----------|-----------|---------------------------|-|
| userid | Y | String	| Contains the authentication details |
| password | Y | String	| Contains the authentication details |

Sample:

```xml
    <Header xmlns="http://schemas.xmlsoap.org/soap/envelope/">
        <authentication xmlns="http://www.concur.com/webservice/auth">
            <userid>testLogin123</userid>
            <password><PASSWORD></password>
        </authentication>
    </Header>
{'fraction_non_alphanumeric': 0.1801514547628537, 'fraction_numerical': 0.014746911119968115, 'mean_word_length': 3.249788314987299, 'pattern_counts': {'":': 10, '<': 24, '<?xml version=': 0, '>': 25, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 16}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5999141', 'n_tokens_mistral': 1566, 'n_tokens_neox': 1496, 'n_words': 518}