Notes
cXML vs OCI: the two PunchOut protocols compared
cXML and OCI both open your store from a procurement system and return a cart, but cXML starts the session server to server with a shared secret and also carries the purchase order and the documents after it, while OCI runs login and cart through the browser and ends at the cart. The buyer's system decides which one you get: Coupa and SAP Ariba use cXML, SAP SRM uses OCI.
Updated
The short answer
cXML and OCI do the same job for the buyer: open your store from the procurement system and bring the cart back as a requisition. They differ in how they get there and in how far they go.
- cXML starts with a
PunchOutSetupRequestposted from server to server, authenticated by a shared secret, and continues past the cart with theOrderRequest, the confirmation, the ship notice and the invoice. Coupa and SAP Ariba use it. - OCI starts with the buyer's browser calling your store with login parameters, returns the cart as form fields named
NEW_ITEM-<field>[n]with fixed lengths, and stops there. SAP SRM uses it.
The protocol follows the buyer's system. Facts below were checked on October 3, 2026 against the cXML reference guide, version 1.2.071, and SAP's OCI 5.0 specification.
Side by side
| cXML | OCI | |
|---|---|---|
| Session start | PunchOutSetupRequest server to server, then a redirect of the browser |
the browser calls the store with parameters, POST by default, GET possible |
| Credentials | SharedSecret in Sender, never in the browser |
login fields through the browser; Secure OCI moves them to a server call |
| Names of the credential fields | fixed by the DTD: From, To, Sender |
set per catalog and per buyer in SAP Customizing |
| User data | Contact and Extrinsic elements, such as UserEmail |
whatever the buyer configures as parameters; often one fixed login per company |
| Cart | one XML document in the form field cXML-base64 or cXML-urlencoded |
one hidden field per value, NEW_ITEM-<field>[n] |
| Field lengths | none in the DTD for description or part number | description 40, part number 40, unit 3, material group 10 |
| Character set | UTF-8, text/xml |
the one SAP passes in http_content_charset |
| Reopen a cart | edit and inspect sessions with the earlier lines |
not in the specification; DETAIL displays one item again |
| Search in the procurement system | index catalog plus SelectedItem |
BACKGROUND_SEARCH; in 5.0 replication with CATALOG_MANAGED |
| Purchase order and later documents | OrderRequest, ConfirmationRequest, ShipNoticeRequest, InvoiceDetailRequest |
not in the specification |
| Retry of a failed delivery | recommended 10 retries, one per hour, for 5xx answers | none; the cart is posted once by the browser |
The whole of OCI fits in the first rows of cXML. The session and the cart are comparable; everything from the purchase order on exists only in cXML.
One cart line in both
A cart of 3 lines is one PunchOutOrderMessage in a single hidden field in cXML. In OCI it is 3 x 7 = 21 hidden fields for the same seven values per line, plus the parameters split off the return URL. The difference that costs work is not the count but the lengths. A store description of 54 characters goes into cXML as it is and into OCI as its first 40: "Duplex receptacle 20 A, tamper resistant". If the white and the ivory variant share those 40 characters, the buyer gets two lines that read the same. The integration keeps a short description per item for OCI buyers.
Prices differ in precision as well. OCI allows 3 decimals in NEW_ITEM-PRICE; an item that costs 0.0375 per piece is sent as 3.75 with NEW_ITEM-PRICEUNIT 100, and the line value is quantity x 3.75 / 100. In cXML the Money element takes the decimal price directly.
Where each one stops
cXML stops at what the buyer's system accepts. The DTD sets the structure, but each procurement system adds limits: Coupa allows 180 characters for payloadID and 765 for SupplierPartAuxiliaryID, sends only create and inspect sessions and retries a failed purchase order 5 times at 1-hour intervals. SAP Business Network caps orders at 10,000 line items and other documents at 1,000. Each is documented by that system; details are on PunchOut for Coupa and PunchOut for Ariba.
OCI stops at the cart. The specification has no order, so a supplier with an OCI buyer still needs a second channel for the purchase order. It also has no VAT field, no edit session and no user identity beyond what the buyer configures. When the login is a fixed value in Customizing, every buyer of that company arrives as the same user, and a store that keeps carts per account mixes them.
What each one asks in upkeep
| Upkeep | cXML | OCI |
|---|---|---|
| Credentials | the buyer rotates the shared secret; every setup request gets 401 until it is updated | the buyer changes the login values or parameter names in Customizing |
| Versions | each document names its DTD; Coupa lists five versions over its documents | OCI_VERSION is informative only |
| Mapping per buyer | Extrinsic names, commodity codes, unit codes |
which of the 34 fields the buyer reads, and the meaning of the five free fields |
| Units | UN/CEFACT codes such as EA |
ISO codes that exist in the buyer's SAP system |
| Catalog for search | the index catalog, rebuilt and uploaded when the assortment changes | the JSON replication, page by page, when the buyer uses OCI 5.0 |
Neither protocol tells the supplier when something on the buyer's side changes. A setup request that starts failing with 401, or an OCI cart that SAP refuses for a unit, shows up first as a phone call from the buyer unless the connection is monitored.
What this means for your integration
Most of a PunchOut connection is shared between the two: the login without a form, the session per customer with contract prices, the transfer button in place of the checkout. The protocol decides the packaging of the cart and whether the purchase order arrives in the same channel. We build one connection on your store that speaks both, with the field mapping kept per buyer.
How the whole flow runs, including the order in your ERP, is on the PunchOut hub. The protocols each have their own page: cXML PunchOut and OCI PunchOut.
Frequently asked questions
Which one should my store support?
The one your customer's procurement system sends. A buyer on Coupa or SAP Ariba needs cXML, a buyer on SAP SRM needs OCI. A supplier with customers on both runs both on the same store: the login, the customer session and the transfer button are shared, and only the packaging of the cart differs.
Can an OCI buyer send the purchase order in cXML?
Yes. OCI ends at the cart, so the order needs another route, and cXML is a common one. AFAS Profit does exactly that: the cart comes over OCI and the order goes to the supplier as a cXML document. EDI and a PDF by email are the other routes.
Is OCI less secure than cXML?
In standard OCI the login parameters pass through the buyer's browser, so a buyer with developer tools can read them. Secure OCI, described in section 5 of SAP's OCI 5.0 specification, moves credentials and prices to a server-to-server call. In cXML the shared secret only travels server to server, and the cart, the one document that passes the browser, is sent without it.
Which protocol carries more data per line?
cXML. An ItemIn has no fixed length on its description and can carry extrinsics, a manufacturer name and a lead time. OCI has 34 fields with fixed lengths and five free fields of 10 to 50 characters. Data that does not fit OCI goes into the long text, which has no limit.
Is there a JSON version of either?
OCI 5.0 uses JSON, but only to replicate catalog data into SAP SRM, not for the cart, which still comes back as form fields. cXML is XML only.
Tell us what you need
Tell us which systems you use and what needs to work better. We reply personally within one working day. We help you define the work, then agree the price and timing before you commit.
- You know the price and the timeline before you commit to anything
- We work out the connection that takes the work off your hands
- We handle the build, hosting, monitoring and maintenance
- Your team has less information to retype and fewer discrepancies to chase