Buyer systems

This section is for the administrator who adds a punchout.dev shop as a punchout catalog in a buyer system such as SAP SRM, S/4HANA, SAP Ariba, Coupa or craftsman software.

Systems and protocols

System	Protocol	Setup guide
Healy Hudson	OCI (through Veenion)	OCI guide
SAP S/4HANA	OCI	SAP SRM and S/4HANA (OCI)
SAP SRM	OCI	SAP SRM and S/4HANA (OCI)
Synertrade	OCI	OCI guide
Veenion (impact ordering)	OCI	OCI guide
Coupa	cXML	Coupa (cXML)
GEP SMART	cXML	cXML guide
GHX	cXML	cXML guide
hubwoo (now Proactis)	cXML	cXML guide
Ivalua	cXML	cXML guide
Jaggaer (JAGGAER ONE)	cXML	cXML guide
Oracle (Fusion Procurement, iProcurement)	cXML	cXML guide
SAP Ariba	cXML	SAP Ariba (cXML)
Wescale	cXML	cXML guide
Workday (Procurement)	cXML	cXML guide
Basware	OCI or cXML	OCI guide, cXML guide
Onventis	OCI or cXML	OCI guide, cXML guide
Proactis	OCI or cXML	OCI guide, cXML guide
Medius	Ask us	hello@punchout.dev
Unite (Mercateo)	Ask us	hello@punchout.dev
Craftsman and wholesaler software	IDS Connect	Craftsman software (IDS Connect)

The table follows the vendors’ public documentation. A system missing from it works the same way, as long as it launches punchouts over OCI, cXML or IDS Connect.

Which page do I need

Your system	Read
SAP SRM or SAP S/4HANA	SAP SRM and S/4HANA (OCI)
Any other OCI system	SAP SRM and S/4HANA (OCI): identical steps, only the menu names differ
SAP Ariba	SAP Ariba (cXML)
Coupa	Coupa (cXML)
Any other cXML system	Coupa (cXML) or SAP Ariba (cXML): the steps carry over, only the screens have other names
Craftsman software	Craftsman software (IDS Connect)

What every buyer administrator needs to know

The launch URL

In the recommended setup your system does not call the shop. It calls punchout.dev, which checks the login and then opens the shop in the user’s browser. Each shop has one address per protocol, built from its Shop ID:

Protocol	Launch URL
OCI	https://api.punchout.dev/v1/oci/launch/<shop id>
cXML	https://api.punchout.dev/v1/cxml/setup/<shop id>
IDS Connect	https://api.punchout.dev/v1/ids/launch/<shop id>

The shop owner finds all three in the portal on the shop’s Embed tab, under Launch URLs for the buying system, and gives you the one your system needs.

The credential

The shop owner creates one credential per buyer system on the shop’s Buyers tab and passes it on to you: a username and password for OCI and IDS Connect, a domain, identity and shared secret for cXML. The portal shows the secret to the shop owner only once. If they rotate it, the old secret stops working immediately, and every launch fails until you enter the new one.

For cXML, the domain and identity must match what your system sends, so agree on both with the shop owner first. Connect a buyer describes the shop owner’s side of these steps.

The cart comes back through the browser

punchout.dev does not send the cart to your system server to server. The user’s browser hands it to the return address your system sends with every launch. That address therefore has to be reachable from the user’s browser, not from the internet.

The shop owner can limit which return addresses may receive carts. If they do, give them the host name of your system’s return address. If the shop sends a Content-Security-Policy, it must allow that host as well, or the browser blocks the transfer. Both are settings on the shop owner’s side.

The first test is a real punchout

With the portal’s Test punchout the shop owner can rehearse the round trip (see Test punchout). That covers the shop side. Your first test should be a real launch from your system:

1. Open the catalog from a new shopping cart or requisition, as a user would.
2. The shop opens with the punchout panel. Put two or three items in the shop’s cart and open the cart page. The panel lists the items.
3. Click Transfer to procurement system. The items appear in your system’s cart.
4. Launch once more and click Back to procurement system. Your system receives a cart without items.

A punchout lasts four hours from the launch. After that the transfer fails, and the user has to start the punchout again.

Caution

A shop that is still in its Sandbox refuses launches from real buyer systems. Your test then ends on a page that reads “Punchout not enabled” (OCI, IDS Connect) or with the message “Supplier not enabled for productive punchout” (cXML). The cause is the shop’s plan, not your configuration. See Plans and Sandbox.