What is a punchout catalog?

A punchout catalog is a supplier's own web store that a buyer opens from inside their procurement system. The buyer's employee browses it at their company's contract prices, fills a cart, and sends the cart back into the procurement system as a requisition. The purchase order comes later, after the buyer's own approval.

Buyers ask suppliers for one when they want employees to order from approved suppliers without leaving SAP Ariba, Coupa, Oracle or an SAP ERP. This guide is written for the supplier: what the catalog is, what a session looks like, what you hand over, and how it works when your store runs on Shopify B2B. For the full round trip with both protocols, read how punchout works.

How is a punchout catalog different from a catalog file?

A static catalog is a file you send to the buyer: every item, description and price, loaded into their procurement system and approved there. A punchout catalog keeps items and prices on your site. The procurement system stores only a link or a short index entry, and opens your site live for each shopping session.

The cXML User's Guide calls punchout an alternative to static catalog files: "PunchOut sites are live, interactive catalogs running on a website" (section 2.2.2). SAP Ariba's Customer Catalog Format Reference lists the file formats for static catalogs, among them CIF (Catalog Interchange Format), a comma-separated list of items and their attributes, and cXML. After the procurement system approves such a file, its users can add the items to requisitions. A punchout item in the same file carries much less: SAP notes that pricing in the file is ignored, because pricing is set by your site for each punchout session. So an SAP Ariba buyer may still ask you for a small index file, in CIF or cXML, that points to your punchout site.

Which one fits depends on what you sell. The guide's content delivery table (section 2.4) matches static catalogs to stable content and pricing, and punchout to large ranges, configurable products and items whose attributes vary. If your contract prices or stock change often, a file means sending and re-approving new versions; a punchout catalog shows the current state each time someone opens it.

What happens in a punchout session?

The employee starts a requisition and clicks your catalog. Their system sends your site a setup request, your site answers with a page to open, and the employee shops there. The cart goes back into the requisition, the buyer's approvers sign off, and the approved requisition becomes a purchase order that is sent to you.

The cXML User's Guide describes the same sequence (section 5.2):

1. Requisition. The user logs in to the procurement application, opens a purchase requisition and selects your punchout item.
2. Setup request. The procurement system sends a request that identifies the buying organization and the operation (a new cart, or reopening one). A network such as SAP Business Network can authenticate it and pass it on to you.
3. Shopping. The user's browser opens your site, logged in to the buyer's account. The guide says the experience is "the same as if they had logged on to the supplier's website directly", and that suppliers can show contract products and prices.
4. Cart transfer. The user clicks your check out button and the cart is submitted through the browser back into the requisition. At this point you have given a quote; the guide is explicit that you have not received an order yet.
5. Approval. The requisition goes through the buyer's approval workflow. If someone needs to change a line, they punch out to your site again to edit the cart there.
6. Purchase order. The procurement system converts the approved requisition into a purchase order and sends it to you for fulfillment.

Oracle's procurement documentation describes the same flow from the requester's side: the supplier authenticates the requester, the requester adds items on the supplier site, and the items come back as lines on the requisition they then submit.

What does the supplier have to provide?

You provide endpoints for the buyer's system to call, credentials that prove a request comes from that buyer, a way to recognize the buyer and show their prices, and item data the procurement system can book, such as units of measure and commodity codes. Most buyers also expect separate setups for testing and production.

• Endpoints. A setup URL that receives the setup request and, if the buyer sends cXML purchase orders, an order URL. Coupa's supplier documentation lists the punchout URL, the domain and identity of both parties (usually a DUNS number or a NetworkID), a shared secret, and a 150 by 50 pixel logo.
• Credentials. In cXML the shared secret is "a password that validates the buyer with the supplier" (Coupa). In OCI the SAP system passes its call-up parameters, such as log-on names, which it must know before it calls your catalog (OCI 4.0, section 3).
• Buyer identity and pricing. The cXML guide has the site identify the requester at company level from the request header, and the user from contact or extrinsic data (sections 5.3.2.2 and 5.3.2.4). It asks for a start page URL that is unique to the session and valid only for a limited time, and for authentication before any confidential price is shown (sections 5.4.1 and 5.4.2).
• Item data. A unit of measure on every line from the UN/CEFACT common codes, and a UNSPSC commodity code, which buyers use for accounting and reporting (cXML guide, sections 3.2.1 and 5.5.1). OCI carries the same information in fields such as NEW_ITEM-UNIT and NEW_ITEM-MATGROUP.
• Test and production. Coupa: "Normally, suppliers provide two sets of information: one set for testing, and one set for production."

cXML or OCI: which protocol does your buyer use?

Ask the buyer's IT team. SAP Ariba and Coupa punch out with cXML, and Oracle Procurement supports cXML alongside its own XML format. SAP ERP systems such as SAP SRM and S/4HANA use SAP's Open Catalog Interface (OCI). The shopping part looks the same; the setup call and the cart format differ, and only cXML also carries the purchase order to you.

cXML punchout is a set of XML documents over HTTPS: a setup request and response, a cart document posted back through the user's browser, and an OrderRequest for the purchase order. The steps and fields are in cXML punchout, end to end. OCI calls your catalog with HTTP parameters, including a return URL that is usually named HOOK_URL, and your page posts the cart back to it as NEW_ITEM- form fields (OCI 4.0, sections 3.1.3 and 4.2). The OCI documentation covers calling the catalog and returning the cart, so a purchase order from an SAP system reaches you through a channel you agree with the buyer. More in OCI punchout and cXML vs OCI, practically. The procurement systems page lists what each system expects.

How does a punchout catalog work on Shopify?

Shopify B2B already holds the commercial data a punchout catalog needs: companies, company locations, and catalogs with prices, quantity rules and volume pricing. An app adds the punchout part. PunchRelay receives the setup request, shows the buyer what Shopify offers their company location at their prices, and sends the cart back to the procurement system.

A Shopify B2B catalog chooses which products and prices B2B customers get, and can set quantity rules and volume pricing. It reaches company locations through a B2B market, or directly on Shopify Plus. PunchRelay builds on that:

• Each connection is tied to one Shopify company, company location and contact. The catalog shows the products Shopify publishes to that location, at the prices, quantity rules and volume breaks Shopify returns for it. A location without a catalog sees list prices.
• PunchRelay keeps no copy of your catalog. It reads products and prices from Shopify for each request, so a price you change in Shopify applies to the next session.
• UNSPSC codes, units of measure and other item attributes come from product or variant metafields you choose, or from per-SKU mappings on the connection. When no unit resolves, the cart line carries EA and the pre-flight catalog check lists the variant so you can fix it.
• The start page link works once and expires after 15 minutes.
• The cart transfer creates nothing in Shopify: no order, no draft order, no payment. A cXML purchase order lands in the Purchase orders inbox, and a Shopify order exists only after someone on your team reviews it and clicks Create Shopify order.

What does the buyer's team set up?

The buyer adds you as a punchout supplier in their own system. They enter your URLs, identities and shared secret (or the OCI user and password), test the round trip with you, and then switch to production. This part runs in their system, so plan the test dates together.

How that looks depends on the system. Coupa asks that you are set up as a supplier in Coupa, have a contract with the customer, and fill in Coupa's cXML supplier questionnaire; after you send the punchout details, the customer sets up the punchout in Coupa. On SAP Business Network, punchout requests are routed to the setup URL in your cXML profile or in the "PunchOut Setup Request" field of your account, and buyers may also ask for an index catalog file that they approve (SAP catalog format reference). In an SAP ERP the buyer's administrators define your catalog URL and its call-up parameters in their system (OCI 4.0, section 3.1). The pages for SAP Ariba, Coupa, Oracle and SAP OCI go through each one.

What PunchRelay does, and what stays with you

PunchRelay runs the punchout side of your Shopify store: it receives and checks setup requests over cXML and OCI, serves the buyer's catalog from your Shopify B2B data, returns the cart in the format the buyer's system reads, and receives cXML purchase orders into an inbox for your review. Each document an authenticated connection sends, and each one PunchRelay returns, is logged with secrets redacted, so you and the buyer's IT team can read the same XML when a test fails.

You create the connection in the PunchRelay admin. A cXML connection is self-service and needs no custom code. An OCI connection includes a one-time $499 setup that PunchRelay does for you. You keep companies, locations, catalogs and item attributes in Shopify, send the buyer the connection's URLs and credentials, and approve each purchase order before it becomes a Shopify order. OCI returns a cart only, so agree with SAP buyers how their purchase orders reach you.

The buyer's team configures the connection in their procurement system, tests it with you, and runs their own approvals. The setup guide walks through the first connection, and pricing lists the plan and fees.