If punchout is new territory, start with how punchout works; this page assumes you know the round trip and want to know which protocol your project actually needs. The short version: your buyers decide for you. Ariba, Coupa, Jaggaer, Oracle and Workday mean cXML. SAP SRM, S/4HANA and most of German-speaking Europe mean OCI. The long version is about what each choice commits you to.
Two shapes of the same idea
cXML is document-based. Everything is a typed, validatable XML document: PunchOutSetupRequest to open a session, PunchOutOrderMessage to return the cart, OrderRequest to deliver the purchase order. Structure is the point: carts carry clean metadata like UNSPSC classifications, units of measure, tax data and cost centers, and both sides can validate what they receive. The price of structure is that you need real schema handling and real error handling, on both ends.
OCI is a form post. The buyer's ERP calls your catalog URL with a HOOK_URL return address; when the buyer is done, your side answers with an HTML form of NEW_ITEM fields that submits itself back. No schemas, no documents, no validation layer. It is quick to build and easy to read, and it gets strained exactly where structure would help: extra fields, custom data, anything beyond the standard list.
The return leg is the real difference
The cart out is symmetrical between the two standards. The purchase order back is not, and this is the difference that matters commercially. cXML specifies the return leg: an OrderRequest document arrives at your endpoint, and full two-way automation is the normal, expected case. OCI specifies nothing after the cart transfer. There is no OCI equivalent of OrderRequest; how the PO reaches you is whatever the buyer's ERP supports, from a clean cXML OrderRequest (many SAP setups can) to a printed fax-era PDF. Any vendor promising automatic OCI purchase orders is quietly depending on that ERP capability. Honest OCI integrations name the two paths: automatic when the ERP can send OrderRequest, one click from transferred cart to draft order when it cannot.
Where each one bites in practice
The spec-level comparison misses what integration teams actually spend time on: per-buyer dialects.
- cXML cart transfer arrives as
cxml-urlencodedfor one buyer andcXML-base64for the next; each connection gets configured, not assumed. - cXML item lines require UnitOfMeasure and UNSPSC classification, neither of which exists in a typical commerce catalog; suppliers need a mapping layer (EA, BX, CS and friends) before the first test.
- cXML has no standard way for an OrderRequest to reference the punchout session that produced the cart; correlation rides in SupplierPartAuxiliaryID and depends on the buyer echoing it back. Buyers who strip it need their own correlation setup.
- OCI has no standard correlation field at all; OCI 4.0 offers NEW_ITEM-CUST_FIELD1 through 5, and whether the ERP preserves them must be verified per connection.
- SAP frequently embeds the punchout catalog in an iframe, so the transfer form must honor the
returntargetparameter or the cart gets stuck inside the frame. - OCI setup calls can arrive as HTTP GET, which puts credentials in the URL: logs need masking and buyers should be nudged toward POST. And after the cart transfer there is no acknowledgment, so your side never learns whether the ERP accepted the cart. Session logging matters twice as much for OCI because you only ever see one direction.
Geography, then both
North American enterprise buying runs overwhelmingly on cXML networks: Ariba, Coupa, Jaggaer, Oracle, Workday. In Europe, and especially in DACH, OCI is the de facto standard wherever SAP handles purchasing. A supplier selling on both continents, or a European supplier with one American buyer, ends up needing both protocols sooner than expected. That is the practical argument for handling cXML and OCI in one connector with one catalog, one contract-pricing source and one log view, instead of running two integration projects that drift apart.
PunchRelay does exactly that for Shopify stores: both protocols against the same Shopify B2B catalog, with the OCI purchase-order reality handled honestly. Start from the page that matches your buyer: Ariba, Coupa, or OCI for SAP.