cXML (Commerce XML)
cXML (Commerce eXtensible Markup Language) is an XML-based protocol, created by Ariba in 1999, for exchanging procurement documents between buyer procurement systems and supplier catalogs. It defines schemas for the full order lifecycle — PunchOutSetupRequest for launching a hosted shopping session, OrderRequest and OrderResponse for purchase orders, and InvoiceDetailRequest for e-invoicing — so both sides can parse a document without prior coordination. It is the most common protocol behind PunchOut catalogs, competing with SAP's proprietary OCI in that role but covering a wider document set.
What cXML actually defines
cXML is a set of formal XML schemas, not a single document. Ariba published the first version in 1999 to give procurement systems (Ariba's own, plus competitors like Coupa and SAP Ariba successors) and supplier storefronts a shared, machine-parseable vocabulary for business documents. The schemas that matter for catalog and product-data work:
- PunchOutSetupRequest / PunchOutSetupResponse: the handshake that launches a hosted shopping session on a supplier's site from inside a buyer's procurement system
- PunchOutOrderMessage: the cart contents returned to the buyer's system when the shopper checks out on the supplier's site
- OrderRequest / OrderResponse: the purchase order and its acknowledgment, once the cart clears the buyer's approval workflow
- InvoiceDetailRequest: the supplier's invoice, referencing the original PO number
Each is a defined XML structure with required and optional elements, which is what lets a buyer's procurement platform and a supplier's e-commerce system exchange documents without either side reverse-engineering the other's format.
cXML and PunchOut, not the same thing
PunchOut is the buying workflow: a procurement user clicks through from their internal system into a supplier's catalog, shops there, and returns a cart. cXML is one of the protocols that can carry that workflow's messages — the PunchOutSetupRequest/Response pair and the PunchOutOrderMessage. A supplier can also receive PunchOut sessions over OCI, SAP's alternative protocol, which uses simple HTML form fields rather than XML documents. The distinction matters operationally: a supplier integrating with Ariba, Coupa, or Jaggaer needs cXML; a supplier integrating with SAP's native procurement modules more often needs OCI, and the two are not interchangeable without a translation layer.
Where cXML depends on catalog data
A PunchOutOrderMessage or OrderRequest is only as good as the item data behind it. Every line item element — supplier part ID, description, unit price, unit of measure, classification code (often UNSPSC), manufacturer part number — has to resolve correctly on both sides, or the buyer's ERP rejects the order or miscodes the spend. Missing or inconsistent UNSPSC codes, unit-of-measure mismatches (EA vs each vs PC), and stale pricing are the recurring causes of cXML order failures, and they trace back to the same underlying product data gaps that break flat-file uploads and GDSN syndication.
Frequently asked questions
Is cXML the same thing as PunchOut?
No. PunchOut is the buying workflow — a user shops on a supplier's site from inside their procurement system and returns a cart. cXML is one protocol that can carry the messages that make that workflow happen (PunchOutSetupRequest, PunchOutOrderMessage). OCI is a competing protocol that implements the same PunchOut workflow differently.
What's the difference between cXML and OCI?
cXML is a full XML document schema covering PunchOut, purchase orders, and invoices, created by Ariba and used across most major procurement platforms. OCI is SAP's proprietary alternative, built on simpler HTML form-field parameters rather than XML documents, and is mainly used for PunchOut into SAP's native procurement modules. Suppliers on multiple procurement networks often have to support both.
Who created cXML and who maintains it?
Ariba created cXML in 1999. Ariba was acquired by SAP in 2012, and cXML has continued to be maintained and versioned since, with the reference schemas and documentation published at cxml.org.
Why do cXML orders fail even when the connection works?
Connectivity failures are rare once a PunchOut setup is tested. Most ongoing failures are data failures inside a working connection: a UNSPSC code that doesn't match the buyer's category mapping, a unit-of-measure value the buyer's ERP doesn't recognize, or a price in the cXML message that doesn't match what the buyer's system expects. These trace back to incomplete or inconsistent product data rather than the protocol itself.