cXML vs OCI: how the two PunchOut protocols work

cXML and OCI side by side

cXML PunchOut: how a session works

In cXML every step is an XML document sent over HTTPS. The buyer’s system and your side identify each other with credentials in the header (for SAP Ariba, Network IDs) and a shared secret.

1. Setup request

   The buyer clicks your catalogue; their system sends a PunchOutSetupRequest with credentials, a BuyerCookie and a return URL.

2. Setup response

   Your side answers with a StartPage URL; the buyer’s browser opens your store.

3. Shopping

   The buyer sees contract prices and fills the cart.

4. Cart return

   A PunchOutOrderMessage posts the cart back to the return URL for approval.

5. Order

   After approval the purchase order arrives as an OrderRequest.

Example · PunchOutSetupRequest (abridged)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cXML SYSTEM "http://xml.cxml.org/schemas/cXML/1.2.069/cXML.dtd">
<cXML payloadID="1729332000.4711@buyer.example.com" timestamp="2026-10-19T10:00:00+02:00">
  <Header>
    <From><Credential domain="NetworkID"><Identity>AN01000000001</Identity></Credential></From>
    <To><Credential domain="NetworkID"><Identity>AN01000000002</Identity></Credential></To>
    <Sender>
      <Credential domain="NetworkID">
        <Identity>AN01000000001</Identity>
        <SharedSecret>••••••••</SharedSecret>
      </Credential>
      <UserAgent>Buyer procurement system</UserAgent>
    </Sender>
  </Header>
  <Request>
    <PunchOutSetupRequest operation="create">
      <BuyerCookie>8f2c41d0a9</BuyerCookie>
      <BrowserFormPost><URL>https://buyer.example.com/punchout/return</URL></BrowserFormPost>
      <SupplierSetup><URL>https://gateway.example.com/setup</URL></SupplierSetup>
    </PunchOutSetupRequest>
  </Request>
</cXML>

Example · PunchOutSetupResponse

<cXML payloadID="1729332001.88@gateway.example.com" timestamp="2026-10-19T10:00:01+02:00">
  <Response>
    <Status code="200" text="OK"/>
    <PunchOutSetupResponse>
      <StartPage><URL>https://gateway.example.com/session/7f3a…</URL></StartPage>
    </PunchOutSetupResponse>
  </Response>
</cXML>

Example · PunchOutOrderMessage

<cXML payloadID="1729332555.12@gateway.example.com" timestamp="2026-10-19T10:09:15+02:00">
  <Header>…</Header>
  <Message>
    <PunchOutOrderMessage>
      <BuyerCookie>8f2c41d0a9</BuyerCookie>
      <PunchOutOrderMessageHeader operationAllowed="edit">
        <Total><Money currency="EUR">96.00</Money></Total>
      </PunchOutOrderMessageHeader>
      <ItemIn quantity="20">
        <ItemID><SupplierPartID>GLV-09</SupplierPartID></ItemID>
        <ItemDetail>
          <UnitPrice><Money currency="EUR">4.80</Money></UnitPrice>
          <Description xml:lang="en">Safety gloves, size 9</Description>
          <UnitOfMeasure>PR</UnitOfMeasure>
          <Classification domain="UNSPSC">46181504</Classification>
        </ItemDetail>
      </ItemIn>
    </PunchOutOrderMessage>
  </Message>
</cXML>

OCI PunchOut: how a session works

OCI is simpler and older in style: there is no XML. SAP opens your catalogue URL with login parameters and a HOOK_URL; at the end your store posts the cart to that address as HTML form fields.

1. Call

   SAP opens your catalogue URL with login parameters and the HOOK_URL.

2. Shopping

   The buyer shops with its contract prices.

3. Cart return

   Your store posts the cart as NEW_ITEM-* fields to the HOOK_URL.

4. Order

   OCI does not carry the purchase order: it reaches you through a channel agreed with the buyer, for example email or its supplier portal.

Example · OCI call with HOOK_URL

https://shop.example.com/oci?USERNAME=acme&PASSWORD=••••
  &HOOK_URL=https%3A%2F%2Fsap.buyer.example.com%2Fsap%2Fbc%2Fsrm%2Foci_return
  &OCI_VERSION=4.0&returntarget=_top

Example · OCI cart return to the HOOK_URL

<form method="post" action="{HOOK_URL}">
  <input type="hidden" name="NEW_ITEM-DESCRIPTION[1]" value="Safety gloves, size 9">
  <input type="hidden" name="NEW_ITEM-QUANTITY[1]"    value="20">
  <input type="hidden" name="NEW_ITEM-UNIT[1]"        value="PR">
  <input type="hidden" name="NEW_ITEM-PRICE[1]"       value="4.80">
  <input type="hidden" name="NEW_ITEM-CURRENCY[1]"    value="EUR">
  <input type="hidden" name="NEW_ITEM-MATGROUP[1]"    value="46181504">
  <input type="hidden" name="NEW_ITEM-VENDORMAT[1]"   value="GLV-09">
</form>

Field names are indexed by line ([1], [2]…). The buyer’s documentation tells you which fields are mandatory, for example a vendor material number, a lead time or a long text.

Which one does your buyer use?

If you are not sure, the buyer’s supplier documentation says it in the first pages. Some SAP buyers run SAP Ariba for indirect spend and OCI catalogues in S/4HANA for direct materials: you may need both.

cXML PunchOut catalog integration: what changes in your store

Whatever the protocol, a store needs the same five things to work as a PunchOut catalogue:

• A customer-specific catalogue and prices per buyer
• A classification code on every product (UNSPSC or ECLASS)
• Opening inside the buyer’s frame: frame headers, cookies and security settings
• Units of measure mapped to the buyer’s codes
• Order import with cXML OrderRequest (Premium plan)

Supporting both on one store

Many suppliers end up with buyers on both protocols. Building two integrations doubles the work; a gateway that speaks both lets one store serve every buyer. With PunchOut Rocket you configure each buyer once in the dashboard, choose cXML or OCI, and the plugin on your store stays the same.