Tools
cXML PunchOut tester: check setup requests, carts and orders
Paste a cXML document. The tester detects whether it is a PunchOutSetupRequest, PunchOutSetupResponse, PunchOutOrderMessage or OrderRequest, checks it against the cXML DTD and reference, and lists each problem with the element it sits in.
Check a cXML PunchOut document
Paste a PunchOutSetupRequest, PunchOutSetupResponse, PunchOutOrderMessage or OrderRequest. Paste a setup request and an order message one after the other to compare their BuyerCookie. A cart posted as cXML-base64 or cXML-urlencoded is decoded first.
The check runs in your browser. What you paste is not sent to our server and is not stored.
What the tester checks
Every rule comes from the cXML DTD 1.2.071 or the cXML Reference Guide of the same version. An error breaks a rule of the standard. A warning is allowed by the standard but breaks the session in practice, or is a rule of one procurement system; each finding names its source.
| Document | Checked | Source |
|---|---|---|
| Every document | Well-formed XML; payloadID; timestamp with a UTC offset, Z not allowed |
DTD, reference 3.1.6 |
| Request and Message | From, To and Sender each with a Credential that has a domain and an Identity; UserAgent in Sender |
DTD |
PunchOutSetupRequest |
operation; BuyerCookie; BrowserFormPost with an http or https URL; deprecated SupplierSetup |
DTD, reference 5.6.2 |
PunchOutSetupResponse |
Status with code and text; StartPage URL on a 200 |
DTD, reference 5.6.3 |
PunchOutOrderMessage |
BuyerCookie; operationAllowed; no SharedSecret in the header; Total |
DTD, reference 3.1.10, 5.6.4 |
Each ItemIn and ItemOut |
quantity; SupplierPartID; UnitPrice Money with an ISO 4217 currency and a decimal point; Description with xml:lang; UnitOfMeasure; Classification with domain |
DTD, reference 5.6.4.4 |
OrderRequest |
orderID, orderDate, BillTo, Total, at least one ItemOut |
DTD |
| Setup and cart together | The same BuyerCookie in both |
Reference 5.6.4.1 |
The tester adds up quantity × unit price for every line and compares the sum with the Total. The order message example carries a Total of 1,486.75 USD; its lines add up to 1,152.00 + 298.00 + 18.75 = 1,468.75. The tester reports the difference of 18.00 as an error. Paste a setup request and an order message one after the other, or load both examples, and the tester also compares their BuyerCookie.
What the tester does not check
- The live exchange. Whether your endpoint answers within the buyer's timeout, and whether the buyer's network accepts your credentials, shows only in a real session.
- The full DTD. Element order and unknown elements are not checked. A validating parser at the buyer can still answer 406.
- Code lists.
UnitOfMeasureis checked for shape, andPCEis flagged because it is not a UN/CEFACT code. The tester does not hold the full UN/CEFACT list or UNSPSC. - Rules per buyer. Coupa keeps one
BuyerCookieper user instead of one per session, and supports onlycreateandinspect. Those rules are on PunchOut for Coupa.
The documents themselves are walked through on cXML PunchOut, element by element.
Where to get the documents
The setup request arrives at your PunchOut endpoint, so take it from your endpoint's log. The order message is in the page your store renders at checkout: open the page source and copy the form with the cXML-base64 or cXML-urlencoded field. The tester decodes the field before it checks the document.
<form method="post" action="https://procure.bakker.example/return">
<input type="hidden" name="cXML-base64" value="PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4K...">
</form>
An OrderRequest arrives at your order endpoint after approval. Its Total and lines are checked the same way as the cart.
When the documents pass and the session still fails
A session can fail with valid documents. The store loses the session cookie inside the buyer's frame, the start URL expires before the browser opens it, or the order arrives while the ERP is down. The supplier checklist lists what a store has to handle beyond the documents.
We build the PunchOut integration to your store and ERP, host it and monitor every session and order. What that covers, from setup request to invoice, is on PunchOut integration.
Frequently asked questions
Is the document I paste sent to your server?
No. Parsing and checking run in your browser, in the script of this page. There is no endpoint the text goes to and nothing is stored. Shared secrets in a pasted setup request stay on your machine.
Can the tester send a setup request to my PunchOut endpoint?
No. It sends nothing and receives nothing; it checks what you paste. To test the live exchange, use the buyer's test setup: SAP Business Network has test accounts with a catalog tester, and Coupa keeps a separate test set of URL, identities and shared secret. See PunchOut for Ariba and PunchOut for Coupa.
Why does the tester flag a SharedSecret in my order message?
The order message is posted by the buyer's browser, so anyone can read it in the page source. The cXML reference says not to put authentication elements in one-way documents. The procurement system matches the cart to the session by the BuyerCookie instead.
Does it validate against the full DTD?
No. It checks the elements and attributes a PunchOut session depends on, listed in the table on this page. An element in the wrong order or an unknown child element passes the tester and can still fail a validating parser on the receiving side.
Tell us what you need
Tell us which systems you use and what needs to work better. We reply personally within one working day. We help you define the work, then agree the price and timing before you commit.
- You know the price and the timeline before you commit to anything
- We work out the connection that takes the work off your hands
- We handle the build, hosting, monitoring and maintenance
- Your team has less information to retype and fewer discrepancies to chase