SAP Ariba (cXML)

This page shows an SAP Ariba administrator how to connect a punchout.dev shop as a cXML punchout catalog.

What you need

Item	Value
Punchout setup URL	https://api.punchout.dev/v1/cxml/setup/<shop id>
Domain	The credential domain Ariba sends, for example NetworkID
Identity	The credential identity Ariba sends
Shared secret	Generated by the portal, or one you chose (at least 16 characters)

The shop owner finds the setup URL on the shop’s Embed tab under Launch URLs for the buying system and creates the credential on the Buyers tab. Agree on the domain and identity with them first. The portal offers NetworkID, DUNS and AribaNetworkUserId and accepts any other domain as a custom one. If a shared secret is already set on your side, the shop owner chooses Enter my own and stores the same value.

If the shop owner limits Allowed return hosts, give them the host name of Ariba’s return address.

Where the URL goes in Ariba

In most installations the setup URL and the shared secret are part of the supplier’s punchout configuration. When the punchout is routed through the SAP Business Network, they sit in the supplier’s network account; for a direct punchout, in your own Ariba configuration. Which route applies depends on how your organisation runs punchout, and SAP’s Ariba documentation shows the screens. punchout.dev handles both routes alike.

Enter the domain, identity and shared secret character for character as the shop owner created them, upper and lower case included: NetworkID and NetworkId are two different domains. Through the SAP Business Network, the credential Ariba sends can belong to the network rather than to your organisation. Check what your configuration sends and have the shop owner store those values.

The punchout described here opens the shop’s landing page and returns a cart. Item-level landing (Level 2) is enabled on request; ask the shop owner, who contacts us.

Test the catalog

1. Open the punchout catalog from a new requisition in Ariba.
2. Put two or three items in the shop’s cart and open the cart page.
3. Check the items the panel lists and click Transfer to procurement system.
4. Launch again and click Back to procurement system.

What a successful test looks like

• The shop opens with the punchout panel, which reads “Punchout active”.
• On the cart page the panel lists the items with quantity and price.
• After the transfer, the items appear in the requisition with part number, description, unit, price and currency.
• After Back to procurement system, Ariba closes the punchout without adding anything.

If the shop owner set up auto-login for your credential, the user arrives signed in to the shop account mapped to it and sees that account’s prices.

punchout.dev hands prices over the way Ariba expects. The shop owner decides in the portal whether they arrive gross or net. If you need them the other way, ask the shop owner to change Price quality on the General tab.

When the test fails

What Ariba reports	Cause	What to do
Authentication failed	The domain, identity or shared secret does not match, or the credential is disabled	Compare all three with the shop owner, including case
Unknown tenant or credentials	The Shop ID in the setup URL is wrong, or the shop is inactive	Copy the URL again from the shop owner
Invalid PunchOutSetupRequest	Most often the shop does not allow Ariba’s return address	Give the shop owner the host name; they add it to Allowed return hosts
Supplier not enabled for productive punchout	The shop is still in its Sandbox	Nothing on your side. See Plans and Sandbox

Other problems show up in the shop:

• The shop opens without the punchout panel. The shop forwards the browser to an address that is not registered for punchout.dev, for example with or without www.. The shop owner adds that address under Allowed origins.
• The transfer button does nothing. The shop’s Content-Security-Policy blocks Ariba’s return host. The shop owner allows it in that policy.
• The transfer fails after a long pause. A punchout lasts four hours. Launch again.