PunchOut
PunchOut catalog for Ariba
SAP Ariba sends every PunchOut request and purchase order through SAP Business Network, which checks the buyer and forwards the request to your endpoint with your own shared secret. Your store has to authenticate on those credentials only, support create, edit and inspect, and answer to the URL in your network account or cXML profile. We build that on your existing store and run it.
What moves between SAP Ariba and your store
SAP Ariba uses cXML for PunchOut, and SAP Business Network sits between the buyer's procurement system and your endpoint. SAP documents the supplier side in its cXML Solutions Guide for SAP Business Network, version 2608; everything on this page was checked against it on October 3, 2026.
| Flow | Direction | Route |
|---|---|---|
PunchOutSetupRequest and response |
SAP Ariba to your endpoint and back | through SAP Business Network |
PunchOutOrderMessage, the cart |
your store to SAP Ariba | through the buyer's browser |
OrderRequest, including change and cancel orders |
SAP Ariba to your order endpoint | through SAP Business Network |
| Confirmation, ship notice, invoice | you to SAP Ariba | through SAP Business Network |
| PunchOut index catalog, for Level 2 | you to SAP Ariba | uploaded to SAP Business Network |
The network changes the header. SAP Ariba signs the request with the buyer's credentials; the network checks them, replaces Sender with its own identity and inserts the shared secret you agreed with the network. Your endpoint checks the secret in Sender and finds the customer by the identity in From. A store that looks up the customer by Sender sees the network on every request and cannot tell buyers apart. The credential rules are on cXML PunchOut.
Which system owns what
| Data | System of record | Direction | How it moves |
|---|---|---|---|
| Items, contract prices, availability | your ERP and store | shown to the buyer | read live in the session |
| Buyer identity and authentication | SAP Business Network | network to you | checked by the network, passed in From |
| Your PunchOut and order URLs, shared secret | your network account | used by the network | cXML Profile or account configuration |
| Requisition and approval | SAP Ariba | stays there | |
| PO number, change and cancel orders | SAP Ariba | to your ERP | OrderRequest through the network |
| Confirmations, shipments, invoices | your ERP | to SAP Ariba | cXML through the network |
| Searchable items, for Level 2 | your store | to SAP Ariba | index catalog upload |
Setting up the PunchOut URL
The network has to know where to send a request. SAP lists three methods, in order of preference:
| Method | How it works | Status |
|---|---|---|
| cXML Profile | you enter a ProfileRequest URL in your account; the network sends ProfileRequest documents, your ProfileResponse lists the URL for each transaction, PunchOut included |
recommended, the URL changes without signing in |
| URL in the account | you enter the PunchOut URL in the configuration area of your network account | used when there is no profile URL |
| URL in the index catalog | the URL in the SupplierSetup element |
deprecated; ignored as a destination |
If neither of the first two gives a URL, the PunchOut request fails. The Profile transaction is also the one transaction every cXML server has to answer, so an endpoint that serves it covers both requirements.
Session rules SAP sets
| Rule | What the store has to do |
|---|---|
| Authentication by domain, buyer identity and shared secret only | no login form, no user ID or password check; a site that authenticates otherwise cannot be deployed |
BuyerCookie unique per session |
store it per session and return it in the cart |
Operations create, edit and inspect |
rebuild the cart from ItemOut lines on edit, show it read-only on inspect |
| Session ends after 6 hours without a cart | keep the store's own session at least as long |
| No Close Session control outside an iframe | add a button: on create and inspect post an empty PunchOutOrderMessage; on edit post the existing lines back unchanged, with your supplier cookie |
SAP adds that every Extrinsic a site requires lengthens the implementation, and that buyers on Ariba Buyer 7.0 and later send user details in Contact. The integration reads Contact and the extrinsics a buyer configures, and never needs them to start the session.
Size limits on SAP Business Network
| Document | Maximum |
|---|---|
| Order, ship notice, order confirmation, invoice | 40 MB or 10,000 line items |
| Any other cXML document | 4 MB or 1,000 line items |
| Attachments to one document, default | 10 MB, of which 65% is usable file size |
| Attachments, highest setting | 100 MB, set by the buyer through SAP Ariba Support |
| Display in the network's user interface | 1 MB or 1,000 line items; larger documents show only the header |
The attachment limit is counted after base64 encoding, which adds about 35%. At the default of 10,000 KB the files themselves can add up to 10,000 x 0.65 = 6,500 KB. A packing slip of 4,200 KB and a certificate of 2,800 KB, 7,000 KB together, do not fit on one ship notice.
What arrives on the purchase order
SAP's guide names the order cases a supplier site has to handle. Each is a rule in the order intake:
| Case | What arrives | Handling |
|---|---|---|
| Copied requisition | a repeat order with every line field except SupplierPartAuxiliaryID |
match the line by part number, quantity and price |
| Price change | a price that differs from the one in the session | compare with the contract price and flag the line |
| Non-catalog item | SupplierPartID "Not Available" or an isAdHoc flag |
route the line for manual review |
| Static and PunchOut items on one order | an auxiliary ID from your site or from your static catalog, or none | read both kinds |
| Quote split over several orders | one cart, several POs, for example per general ledger account | match each PO to the same cart without treating it as a duplicate |
| Change and cancel order | an OrderRequest of type update or delete |
apply it to the sales order in the ERP, or answer 409 when it has shipped |
The copied requisition is the case that breaks a store that relies on its own cart reference: the line arrives without it. The order goes into your ERP through the orders flow.
Testing before and after go-live
Your network account has a test account with a catalog tester that sends PunchOut documents to your site and lets you edit each one before it goes out. SAP also gives three test addresses for your outbound documents: one that always answers with a 4xx status, one with a 5xx, and one that answers 200 half the time and 5xx the other half, to test retries.
With each customer, SAP lists the cases to run from their system: a normal session with a cart; a session closed before checkout, after which the next session must start with an empty cart; a cart of two lines that is edited and emptied, after which the requisition must hold none of them; contract prices for that buyer; and an edit and an inspect session after approval. After go-live the buyer runs a few test sessions and orders in production.
When it goes wrong
| What happens | Cause | Handling |
|---|---|---|
| Every request refused with 401 | the store checks the buyer's secret, but the network sends yours | check the secret in Sender, the customer in From |
| All buyers land in one account | the customer is looked up by Sender, which is the network |
look up by From |
| Request never arrives | no Profile URL and no URL in the account | set the Profile URL; the request fails without one |
| Old items after edit | the store ignored the ItemOut lines |
rebuild the cart from them |
| Copied order unmatched | SupplierPartAuxiliaryID missing on a copy |
match on part number and price |
The general checklist is on the supplier checklist, and the Coupa rules for comparison on PunchOut for Coupa. How the whole flow fits together is on the PunchOut hub. Tell us which store your customer will punch out to.
Frequently asked questions
Where do I set my PunchOut URL for SAP Ariba?
On SAP Business Network, not in the index catalog. SAP's preferred method is the cXML Profile transaction: you enter a ProfileRequest URL in the configuration of your network account, the network queries it, and your ProfileResponse lists the PunchOut URL. The second method is the URL entered in the account itself. A URL in the index catalog is ignored as a destination.
Can my PunchOut site ask the buyer for a password?
No. SAP's guide says a PunchOut site has to authenticate through the domain, the buyer identity and the shared secret, and cannot be deployed if it authenticates any other way, such as with a user ID or a password the user enters. User details in Contact or Extrinsic elements can personalize the session, not authenticate it.
Once my store works with one Ariba buyer, does it work with the next?
The endpoint and the URL are the same, and the network routes the next buyer to them. What differs per buyer is the customer account and its contract prices, the Extrinsic names that buyer configures, and the tests the buyer runs before going live. SAP's guide lists those tests per customer.
How long can an Ariba PunchOut session stay open?
Six hours. Ariba Buyer and SAP Ariba Buying and Invoicing end a session that has not returned a PunchOutOrderMessage after six hours. The store's own session should last at least as long, or a buyer who comes back after lunch finds an empty cart.
Does SAP Ariba support Level 2 PunchOut?
Yes. Ariba Buyer and SAP Ariba Buying and Invoicing load index catalogs uploaded to SAP Business Network into their search, and send a SelectedItem when the buyer clicks one of your items. See Level 2 PunchOut.
Tell us what you need
Tell us which systems you use and what needs to work better. We reply personally within one working day. We help you define the work, then agree the price and timing before you commit.
- You know the price and the timeline before you commit to anything
- We work out the connection that takes the work off your hands
- We handle the build, hosting, monitoring and maintenance
- Your team has less information to retype and fewer discrepancies to chase