What is cXML? Commerce XML explained for suppliers

cXML in one minute

cXML was created in the late 1990s, originally by Ariba, to let procurement systems and suppliers exchange business documents in a common format. It is published at cxml.org as a set of XML document types with a public DTD, and it is still the language spoken by most cloud procurement systems today.

Every cXML document has the same outline: an envelope with a payloadID and a timestamp, a Header that says who sends it to whom with which credentials, and then either a Request, a Response or a Message carrying the business content.

cXML vs XML

The cXML messages a supplier receives

For PunchOut, the first three are what matter: they open the session, return the cart and deliver the order. Confirmations, ship notices and invoices are separate flows that some buyers require after go-live: PunchOut Rocket imports purchase orders with the Premium plan, sends confirmations and ship notices with its OC & ASN add-on, and quotes invoices on request.

Example · PunchOutSetupRequest (abridged)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cXML SYSTEM "http://xml.cxml.org/schemas/cXML/1.2.069/cXML.dtd">
<cXML payloadID="1729332000.4711@buyer.example.com" timestamp="2026-10-19T10:00:00+02:00">
  <Header>
    <From><Credential domain="NetworkID"><Identity>AN01000000001</Identity></Credential></From>
    <To><Credential domain="NetworkID"><Identity>AN01000000002</Identity></Credential></To>
    <Sender>
      <Credential domain="NetworkID">
        <Identity>AN01000000001</Identity>
        <SharedSecret>••••••••</SharedSecret>
      </Credential>
      <UserAgent>Buyer procurement system</UserAgent>
    </Sender>
  </Header>
  <Request>
    <PunchOutSetupRequest operation="create">
      <BuyerCookie>8f2c41d0a9</BuyerCookie>
      <BrowserFormPost><URL>https://buyer.example.com/punchout/return</URL></BrowserFormPost>
      <SupplierSetup><URL>https://gateway.example.com/setup</URL></SupplierSetup>
    </PunchOutSetupRequest>
  </Request>
</cXML>

Credentials and shared secrets

Each cXML document carries three credentials in its header: From (who the document comes from), To (who it is for) and Sender (the system that actually sends it, with a SharedSecret). On SAP Business Network the identities are Ariba Network IDs (ANIDs); other systems use DUNS numbers or their own identifiers. The shared secret is agreed with the buyer and must never appear in emails or screenshots.

What is a cXML catalog?

The term is used for two different things:

Next: how cXML compares to SAP’s OCI.