SAP SRM and S/4HANA (OCI)

This page shows an SAP administrator how to add a punchout.dev shop as an OCI catalog in SAP SRM or SAP S/4HANA. Apart from the SAP names, it applies to any other buyer system that speaks OCI.

What you need from the shop owner

Item	Example	Where the shop owner finds it
OCI launch URL	https://api.punchout.dev/v1/oci/launch/pob_live_…	Embed tab, Launch URLs for the buying system, OCI launch
Username	SAP-SRM-01	Buyers tab, the credential’s identity
Password	(shown once)	Buyers tab, when the credential is created or rotated

If the shop owner limits Allowed return hosts, give them the host name of your SAP system’s return address.

What to enter in SAP

In SAP systems an OCI catalog is typically defined as a web service: in SAP SRM and on-premise S/4HANA in Customizing, in S/4HANA Cloud in the Settings for Web Services app. Screens and menu paths vary by release, and SAP’s documentation for your release shows them. The catalog call needs these entries:

Parameter	Typical type	Value
Call URL	URL	https://api.punchout.dev/v1/oci/launch/<shop id>
USERNAME	Fixed value	The username from the shop owner
PASSWORD	Fixed value	The password from the shop owner
HOOK_URL	Return URL	No value: SAP fills in the return address at runtime
FUNCTION	(none)	Leave it out or empty

Use POST, so the password stays out of the browser’s address bar and history. GET works too. With POST, every parameter belongs in the call structure and none in the call URL.

punchout.dev supports only the classic catalog call. Do not enable catalog functions such as validation or background search for this catalog.

If your catalog call needs parameter names other than USERNAME and PASSWORD, the shop owner can change them in the portal under Advanced settings on the General tab.

The catalog can also point straight at the shop with the OCI parameters, but then only with GET. Prefer the hosted URL above, because only it checks the login before the shop opens.

Test the catalog

1. Create a shopping cart in SAP and open the new catalog from it.
2. Put two or three items in the shop’s cart and open the cart page.
3. Check the items the panel lists and click Transfer to procurement system.
4. Open the catalog again and click Back to procurement system.

What a successful test looks like

• The shop opens with the punchout panel, which reads “Punchout active”.
• On the cart page the panel lists the items with quantity and price.
• After the transfer, SAP shows the items in the shopping cart with description, quantity, unit, price and currency.
• After Back to procurement system, SAP returns to the shopping cart without new items.

If the shop owner set up auto-login for your credential, the user arrives signed in to the shop account mapped to it and sees that account’s prices.

punchout.dev hands prices over the way SAP expects. The shop owner decides in the portal whether they arrive gross or net. If you need them the other way, ask the shop owner to change Price quality on the General tab.

When the test fails

What you see	Cause	What to do
A page “Zugang verweigert / Access denied”	The username or password does not match, or the credential is disabled	Compare both with the shop owner, or ask for a new password
The same page	The shop does not allow the return address of your SAP system	Give the shop owner your host name; they add it to Allowed return hosts
The same page	The call URL carries a wrong Shop ID, FUNCTION is set, or the return address is missing	Check the catalog call against the table above
A page “Punchout nicht freigeschaltet / Punchout not enabled”	The shop is still in its Sandbox	Nothing on your side. See Plans and Sandbox
The shop opens without the punchout panel	The shop forwards the browser to an address that is not registered for punchout.dev, for example with or without www.	The shop owner adds that address under Allowed origins on the General tab
The transfer button does nothing	The shop’s Content-Security-Policy blocks your return host	The shop owner allows your host in that policy
The transfer fails after a long pause	A punchout lasts four hours	Open the catalog again

The “Access denied” page is deliberately identical for every cause, so it gives nothing away about the shop or the credential. Work through the causes in the order of the table.