Punchout explained: cXML, OCI, and what a customer means when they say "we need punchout"

PunchoutPunchout is a way for a buyer to shop on a supplier’s website from inside their own procurement system. The buyer clicks out, builds a cart, and the cart is returned to their system as a requisition for approval. is a round trip between two websites with the buyer in the middle. Your customer’s buyer never types your web address. They open a requisition inside Coupa, Ariba, Jaggaer or SAP, click your company’s name in an internal catalogue list, and land on your storefront already signed in as their company.

Under that, six things happen in order. Understanding the order is what lets you have a sensible conversation with a customer’s procurement team instead of nodding.

The important structural point is at step five. The cart does not become an order when the buyer transfers it. It becomes a line on a requisition inside their system, and it then has to survive their approval chain. The order arrives at your business later, separately, as a purchase order. That is the whole reason large organisations want punchout: it puts your catalogue inside their controls rather than asking their staff to buy outside them.

They are two different answers to the same problem and your customer will name one of them. If they say Ariba or Coupa, you are being asked for cXML. If they say SAP, you are usually being asked for OCI.

cXML is an XML protocol maintained by SAP Ariba and published at cXML.org, where the specification was at version 1.2.071 last updated on 14 August 2026 when we checked it on 20 August 2026. It is a family of documents, not one file: punchout is one part of it, and the same protocol also carries purchase orders, order changes and invoices.

OCI is SAP’s Open Catalog Interface. It is deliberately narrower. The cart comes back as an HTML form posted to a URL the buyer’s system supplied, with standardized field names such as NEW_ITEM-DESCRIPTION, NEW_ITEM-QUANTITY and NEW_ITEM-PRICE. It stops at the cart handover and leaves ordering and invoicing to other channels, which in an SAP shop usually means EDI or IDoc.

One practical consequence for your budget. Because cXML also covers the purchase order and the invoice, a customer who asks for cXML punchout may go on to ask for cXML purchase orders and cXML invoices, and those are separate pieces of work. Ask early which documents are in scope. "Punchout" as a word does not tell you.

In our experience the request almost never comes from your market. It comes from one named account, and it arrives through your sales team as a sentence like "Global Widget says we have to be punchout enabled by Q3 or we come off the approved supplier list."

The organisations that ask are recognisable. Hospitals and health networks, universities, municipal and federal government, large manufacturers with a central procurement function, and any customer whose staff buy through a requisition rather than a credit card. What they all share is that their purchasing controls sit in software, and buying outside that software is either against policy or invisible to it.

That shape has a straightforward commercial test, and we would run it before any technical evaluation. Add up the annual revenue of the accounts that have actually asked. Not the accounts you think might ask, the ones that have asked, in writing. If that number is a meaningful share of your book, punchout is a retention project and it is worth doing properly. If it is one account and the connection costs more than the margin on that account, you are allowed to say no, and some sellers do.

The honest general read: punchout is a requirement you inherit from a customer, not a channel you open to win new business. Buyers do not go shopping for new suppliers by punchout. They punch out to suppliers they have already contracted with.

None of the platforms Celeste scores support punchout natively. Not Shopify B2B, not BigCommerce, not Shopware, not Drupal Commerce. Every one of them reaches punchout through an app, an extension, or a gateway service that sits in front of the storefront. That is not a criticism of any of them: punchout is a procurement integration, and it lives more naturally in a specialist layer than in a commerce platform.

On Shopify the app route is real and priced publicly in at least one case. The ProcureSync listing on the Shopify App Store, read on 20 August 2026, advertises punchout for Coupa, SAP Ariba, Jaggaer and Oracle Procurement with OCI catalogue support and cXML purchase order processing, on a single Business plan at USD 199 a month or USD 1,995 a year with a seven-day free trial. Other providers in this space, including PunchOut Catalogs, Punchout2Go and Greenwing, do not publish per-connection pricing on their websites, so any figure you are given for those is a quote rather than a rate card.

The subscription is not the whole cost, and this is where budgets go wrong. Each trading partner has to be configured and tested individually, and the buyer’s procurement team controls that schedule, not you. Someone has to maintain the catalogue content that the buyer’s system indexes. Somebody has to be on the phone when a buyer’s session fails, because from the buyer’s point of view your website broke inside their ERP. Budget the recurring operational load, not just the connection.

A useful sequencing rule: get the customer’s procurement contact into a call before you buy anything. Ask which protocol, which version, whether purchase orders and invoices are in scope, and who at their end tests it. Those four answers change which provider fits and roughly what it costs.

Saying no is a legitimate answer and it is more common than the punchout vendors suggest. Three situations where we would push back, and what to put on the table instead.

The alternative that satisfies most procurement teams, and costs a fraction of a punchout connection, is a proper company account on your storefront with hosted catalogue content the buyer can export. Their system gets a controlled price file, their buyers get a real catalogue, and the purchase order still arrives through whatever channel you already use. Ask the procurement contact whether a hosted catalogue file meets their policy. Sometimes it does, and nobody had asked.