OCI vs cXML — Which One Does Your Customer Use?

The Quick Decision Tree

If your customer uses SAP Ariba → OCI
If your customer uses anything else → cXML

That's the 30-second answer. For everything beyond that — read on.

Which Procurement Systems Use Which Protocol

cXML — The Industry Default

What It Is

cXML (commerce eXtensible Markup Language) is an open XML-based protocol maintained by the cXML.org community. It's been the de facto standard for B2B procurement integration since the early 2000s.

How It Works

1. Buyer's procurement system sends a PunchOutSetupRequest XML document via HTTPS POST
2. Supplier's endpoint validates the request via SharedSecret HMAC
3. Supplier responds with PunchOutSetupResponse containing a session URL
4. Buyer's browser redirects to the session URL — full shopping experience
5. On checkout, cart is serialized as PunchOutOrderMessage XML
6. Order message POSTed back to procurement system as form data

Authentication

cXML uses SharedSecret HMAC-SHA256. The supplier and buyer agree on a secret string (essentially a password). Every request carries the secret in the Sender credentials block. Validation compares HMAC signatures.

Strengths

• Well-documented open standard
• Bidirectional — supports order messages, invoices, shipment notices
• Wide adoption across enterprise systems
• Mature tooling and validators available

Weaknesses

• Requires XML parsing — slightly more complex than form POST
• Strict DTD validation — small mistakes cause silent failures
• SharedSecret is a single point of failure if leaked

OCI — The SAP World

What It Is

OCI (Open Catalog Interface) is SAP's protocol for external catalog integration. While it predates cXML, OCI remains the primary PunchOut method for SAP Ariba and SAP Business Suite installations.

How It Works

1. Buyer's SAP system redirects browser to supplier catalog URL with query parameters
2. Parameters include ~Username, ~Password, and HOOK_URL
3. Supplier validates credentials and serves the catalog as a normal web session
4. On checkout, cart items are POSTed as HTML form fields to HOOK_URL
5. SAP receives form data and creates a shopping cart in the buyer's procurement system

Authentication

OCI uses username and password credentials passed as URL parameters. While this sounds insecure, the entire flow runs over HTTPS, so credentials are not exposed in transit.

OCI Field Format

When the cart is returned, SAP expects specific form field names:

NEW_ITEM-DESCRIPTION[1] = WD Blue 1TB SSD
NEW_ITEM-MATNR[1]       = WDS100T3B0A
NEW_ITEM-QUANTITY[1]    = 2
NEW_ITEM-UNIT[1]        = EA
NEW_ITEM-PRICE[1]       = 89.99
NEW_ITEM-CURRENCY[1]    = USD
NEW_ITEM-VENDORMAT[1]   = WDS100T3B0A
NEW_ITEM-LONGTEXT[1]    = Internal SSD, 1TB, SATA III...

The [1], [2], [3] suffixes index each cart item.

Strengths

• Simpler protocol — no XML parsing required
• Browser-testable directly (just URL parameters)
• Native support in all SAP procurement systems
• Easy to debug — open URL in browser, see what happens

Weaknesses

• Limited to catalog browsing — not bidirectional like cXML
• SAP-specific field names
• No XML schema validation
• Custom data fields require Extensibility extension

Side-by-Side Comparison

When You Need Both

Many enterprise organizations run multiple procurement systems simultaneously. A common pattern:

• SAP Ariba for indirect spend (office supplies, MRO)
• Oracle Fusion for direct procurement (production inputs)
• Coupa for specific business units

If your supplier business serves multiple customer types, you'll eventually need to support both protocols. The good news: a single store can serve both, with each buyer configured independently.

How to Ask Your Customer

If you're a supplier and your customer says "we need PunchOut" — here are the exact questions to ask:

1. "Which procurement system are you using — Oracle, SAP Ariba, Coupa, or something else?"
2. "Does your team use cXML, OCI, or both?"
3. "Can you provide a sample SetupRequest XML or OCI URL we can test against?"
4. "Do you have a sandbox environment for testing?"
5. "What's your timeline for going live?"

If your customer doesn't know — ask them to forward your questions to their procurement IT team. This is a 5-minute task for them, and it saves you weeks of guessing.

How PunchOutHub Handles Both

PunchOutHub supports both cXML 1.2 and OCI from a single PrestaShop 9 installation. Each buyer is configured independently with their own credentials, customer group, and catalog filter. There is no conflict between protocols.

For each buyer, the admin selects the platform:

• Oracle Fusion iProcurement → cXML endpoint at /module/punchouthub/punchout
• SAP Ariba (OCI) → OCI catalog URL at /module/punchouthub/catalog
• Coupa → cXML endpoint (same as Oracle)
• Jaggaer → cXML endpoint (same as Oracle)

SAP Ariba (OCI) support is included from the Business tier and above.

The Bottom Line

Pick the protocol based on your customer's procurement system — not on which protocol you find easier. The goal is to support whatever they use, with minimum friction.

If you're not sure — and your customer can't tell you — start with cXML. It's the more common choice, more documented, and more flexible. You can always add OCI support later if needed.