What Is cXML PunchOut?

The Short Answer

cXML PunchOut is a protocol that lets enterprise buyers shop your B2B online store from inside their procurement system, then return cart contents as a structured purchase order request — without ever leaving their ERP workflow.

cXML stands for commerce eXtensible Markup Language, an open XML-based standard maintained by Ariba and adopted across Oracle, Coupa, Jaggaer, and many other enterprise procurement platforms. PunchOut is the specific cXML use case for catalog shopping.

The Buyer's Perspective

A procurement officer at a large company opens their internal procurement system — Oracle Fusion iProcurement, SAP Ariba, Coupa, or Jaggaer. They need to order industrial parts, IT hardware, lab supplies, or office equipment.

Inside their procurement UI, they see a list of approved suppliers with "Shop" links. They click your store's link, and instead of being redirected to your homepage, they land directly inside your B2B catalog with their negotiated pricing applied. They browse, add items to cart, and click "Return to ERP" or similar.

What happens next is the magic of PunchOut: the cart never becomes an order on your store. Instead, the cart contents are serialized into a cXML PunchOutOrderMessage and POSTed back to their procurement system. Their internal approval workflow takes over from there.

Why Enterprises Demand PunchOut

Large enterprises run procurement systems to enforce:

• Approval routing — purchases over a threshold must be approved by a manager
• Budget control — orders are checked against department budget in real time
• Audit compliance — every purchase must be traceable through the ERP
• Negotiated pricing enforcement — buyers see only their contracted prices
• Vendor consolidation — only approved suppliers in the system can be ordered from

If suppliers can't integrate via PunchOut, the buyer faces a difficult choice: either manually re-key every order (slow, error-prone, audit nightmare) or stop buying from the supplier altogether. Most large enterprises eventually choose the second option.

The PunchOut Flow Explained

A complete PunchOut transaction has six steps:

1. Buyer launches PunchOut. Inside their procurement system, the buyer clicks "Shop" next to your supplier name.
2. Procurement system sends PunchOutSetupRequest. An XML document with the buyer's identity, your SharedSecret, and a unique BuyerCookie session identifier.
3. Your store validates and responds. Authentication via SharedSecret HMAC; if valid, your store creates a session and returns a PunchOutSetupResponse with a one-time URL.
4. Buyer browses your catalog. Their browser is redirected to the session URL. They see your B2B store with their negotiated pricing.
5. Buyer checks out. Instead of paying, the cart is converted into a cXML PunchOutOrderMessage.
6. Cart returns to procurement system. Your store POSTs the order message back to the buyer's ERP. Their approval workflow takes over.

cXML vs OCI vs EDI — Which Does Your Buyer Use?

For interactive catalog shopping, the relevant protocols are cXML and OCI. EDI is generally used for transactional documents (purchase orders, invoices) — not catalog browsing.

What You Need to Support PunchOut

Adding PunchOut support to a B2B store requires:

• A dedicated endpoint on your store that accepts cXML POST requests
• SharedSecret HMAC authentication per buyer (SHA-256)
• HTTPS with a CA-signed certificate — TLS 1.2+ required
• Session management tied to the buyer's BuyerCookie
• A modified cart flow that returns PunchOutOrderMessage instead of placing an order
• Buyer-specific pricing (typically via customer groups)
• Catalog filtering — buyers see only their approved products

Building this from scratch on PrestaShop typically takes 200–400 hours of development. PunchOutHub implements all of this as a native PrestaShop 9 module — installed in minutes, configured from the admin panel.

When Should You Add PunchOut?

Add PunchOut support when:

• A current customer asks "do you support PunchOut?"
• You receive an RFP that includes "supplier must support cXML/OCI integration"
• You want to bid for enterprise contracts where PunchOut is a default expectation
• You spend more than a few hours per week manually re-keying orders from emails

For many suppliers, the cost of adding PunchOut is recovered by retaining one enterprise buyer that requires procurement-system integration.

Common Misconceptions