cXML Profile Discovery

Profile Discovery lets a procurement platform ask Magento which cXML transactions are available and where to send them. The response is generated from the active Store View and Buyer Profile, so it cannot advertise a service that the selected buyer is not allowed to use.

Configure discovery

Open Punchout > Configuration > cXML Profile Discovery for the required Store View.

• Enable cXML Profile Discovery controls the endpoint for that scope.
• Public PunchOut Base URL is needed only when the public URL used by the procurement platform differs from the Magento Store View base URL. Enter the scheme and host, without a query string or fragment.

Then open Punchout > Punchout Buyers and edit the cXML buyer:

• Accept PunchOutSetupRequest controls the setup transaction.
• Accept OrderRequest controls inbound purchase orders.

These switches affect both the actual endpoints and the transactions listed in ProfileResponse.

Send a ProfileRequest

Post the cXML document to:

POST /punchout/cxml/profile
Content-Type: application/xml

The request must contain a complete cXML Header. Magento resolves the Buyer Profile from the Sender credential domain and identity, then checks the shared secret, Store-scoped security settings and optional transport authentication.

Profile transactions require cXML 1.1 or 1.2. A cXML 1.0 request receives an error response because that version does not support Profile Discovery.

Read the response

A successful ProfileResponse lists only the buyer's enabled transactions:

• PunchOutSetupRequest points to the Store-specific setup endpoint.
• OrderRequest appears only when inbound orders are enabled for the Buyer Profile.
• the OrderRequest changes option reflects the effective update and cancellation policies.

Magento adds the selected Store code to generated endpoint URLs. The response uses the cXML version from the request and does not rely on a manually maintained transaction list.

If discovery fails, verify the Store View, Buyer Profile credentials, source IP restrictions and Profile Discovery setting before changing the public URL.