View Extension
Back to Knowledge Base
Download PDF
Current page This article as PDF Complete manual All pages in this extension manual

Go-Live Checklist

Complete this checklist with the Magento owner and the buyer's procurement team. A successful simulator request alone is not a production acceptance test.

Buyer and store context

  • The active buyer ID exactly matches the inbound OCI or cXML identity.
  • OCI username/password or cXML sender domain, identity and shared secret have been exchanged securely.
  • Optional transport authentication is configured on both sides, if used.
  • The buyer points to the intended Magento Store View and uses the agreed customer resolution mode.
  • E-mail identity sources, JIT customer group and Magento account-confirmation behavior have been tested when JIT provisioning is used.
  • OCI buyers use the agreed OCI version and external product-ID source.
  • Catalog visibility, customer-specific prices, tax mode and currency match the buyer's expectations.
  • The assigned mapping is an active outbound runtime profile, not a synced template profile.

Network and request security

  • Magento and the buyer return URL use valid HTTPS certificates.
  • The return hostname resolves to public IP addresses in production.
  • The IP allowlist contains the buyer's current egress addresses; it is not left empty unintentionally.
  • If strict signatures are enabled, the caller has proved the exact HMAC-SHA256 signing behavior with both form and raw-body requests it will send.
  • Test-only customer overrides and insecure TLS are disabled.
  • Sandbox callback mode is disabled.

End-to-end workflow

  • The procurement system starts an OCI login or cXML setup request successfully.
  • The returned token opens the expected Magento customer session.
  • Search, product visibility and cart pricing are correct.
  • create, edit, inspect, DETAIL and DETAILADD allow only their intended storefront actions when those operations are part of the integration.
  • Return to System posts the expected field names, quantities, units, prices and currency.
  • The procurement system accepts the returned cart and preserves the correlation or buyer-cookie value it needs.
  • A repeated transfer with the same X-Punchout-Request-Key and body returns the saved response; reusing the key with changed input returns HTTP 409.

Approved OrderRequest, when included

  • The procurement system posts to /punchout/document_po/inbound only after its approval process is complete.
  • The processing mode is explicitly set to Acknowledge Only, Validate Only or Create Magento Order for the selected Store view.
  • Buyer-profile overrides are documented and empty fields intentionally inherit Store-view configuration.
  • The procurement system preserves the original BuyerCookie through cart return and the later OrderRequest.
  • The snapshot retention period is longer than the longest requisition and approval cycle.
  • Unchanged, changed, added and removed lines have each been tested against the selected returned-cart policy.
  • Customer, product, address, shipping and payment resolution produce the intended Magento quote.
  • Exact OrderRequest retries do not create duplicate inbound records or Magento orders.
  • Update and cancellation requests follow the selected manual-review, reject or automatic policy.

Outbound document loop, when included

  • Shipment and invoice creation produce one queue row per Magento entity.
  • The buyer accepts generated ASN and invoice cXML at the dedicated HTTPS endpoints; the cart-return URL is not used.
  • Supplier credentials are configured before ConfirmationRequest, InvoiceDetailRequest or ShipNoticeRequest delivery is enabled.
  • Cron processes due rows every five minutes.
  • A controlled delivery failure follows the configured retry delay and reaches failed after the configured maximum.
  • A simulated uncertain transport outcome reaches Delivery Unknown and is never retried automatically.
  • Support staff understand View, Reset, Force Run and the separately authorized Retry Unknown Delivery action without exposing payload secrets.
  • Shipment and invoice delivery still works after the browser PunchOut session has expired.

Support handoff

  • Trace logging and an appropriate retention period are enabled for the launch window.
  • Support staff know how to find a request by correlation ID.
  • Buyer secrets are not copied into tickets or trace exports.
  • An owner is assigned for Magento, networking and the procurement platform.
  • The rollback action is known: deactivate the affected buyer profile or disable PunchOut only in the affected scope.
Configuration Buyer and Mapping Profiles