Go-Live Checklist

Complete this checklist with the Magento owner and the buyer's procurement team. A successful simulator request alone is not a production acceptance test.

Buyer and store context

• The active buyer ID exactly matches the inbound OCI or cXML identity.
• OCI username/password or cXML sender domain, identity and shared secret have been exchanged securely.
• Optional transport authentication is configured on both sides, if used.
• The buyer points to the intended Magento Store View and uses the agreed customer resolution mode.
• E-mail identity sources, JIT customer group and Magento account-confirmation behavior have been tested when JIT provisioning is used.
• OCI buyers use the agreed OCI version and external product-ID source.
• Catalog visibility, customer-specific prices, tax mode and currency match the buyer's expectations.
• The assigned mapping is an active outbound runtime profile, not a synced template profile.

Network and request security

• Magento and the buyer return URL use valid HTTPS certificates.
• The return hostname resolves to public IP addresses in production.
• The IP allowlist contains the buyer's current egress addresses; it is not left empty unintentionally.
• If strict signatures are enabled, the caller has proved the exact HMAC-SHA256 signing behavior with both form and raw-body requests it will send.
• Test-only customer overrides and insecure TLS are disabled.
• Sandbox callback mode is disabled.

End-to-end workflow

• The procurement system starts an OCI login or cXML setup request successfully.
• The returned token opens the expected Magento customer session.
• Search, product visibility and cart pricing are correct.
• create, edit, inspect, DETAIL and DETAILADD allow only their intended storefront actions when those operations are part of the integration.
• Return to System posts the expected field names, quantities, units, prices and currency.
• The procurement system accepts the returned cart and preserves the correlation or buyer-cookie value it needs.
• A repeated transfer with the same X-Punchout-Request-Key and body returns the saved response; reusing the key with changed input returns HTTP 409.

Approved OrderRequest, when included

• The procurement system posts to /punchout/document_po/inbound only after its approval process is complete.
• The processing mode is explicitly set to Acknowledge Only, Validate Only or Create Magento Order for the selected Store view.
• Buyer-profile overrides are documented and empty fields intentionally inherit Store-view configuration.
• The procurement system preserves the original BuyerCookie through cart return and the later OrderRequest.
• The snapshot retention period is longer than the longest requisition and approval cycle.
• Unchanged, changed, added and removed lines have each been tested against the selected returned-cart policy.
• Customer, product, address, shipping and payment resolution produce the intended Magento quote.
• Exact OrderRequest retries do not create duplicate inbound records or Magento orders.
• Update and cancellation requests follow the selected manual-review, reject or automatic policy.

Outbound document loop, when included

• Shipment and invoice creation produce one queue row per Magento entity.
• The buyer accepts generated ASN and invoice cXML at the dedicated HTTPS endpoints; the cart-return URL is not used.
• Supplier credentials are configured before ConfirmationRequest, InvoiceDetailRequest or ShipNoticeRequest delivery is enabled.
• Cron processes due rows every five minutes.
• A controlled delivery failure follows the configured retry delay and reaches failed after the configured maximum.
• A simulated uncertain transport outcome reaches Delivery Unknown and is never retried automatically.
• Support staff understand View, Reset, Force Run and the separately authorized Retry Unknown Delivery action without exposing payload secrets.
• Shipment and invoice delivery still works after the browser PunchOut session has expired.

Support handoff

• Trace logging and an appropriate retention period are enabled for the launch window.
• Support staff know how to find a request by correlation ID.
• Buyer secrets are not copied into tickets or trace exports.
• An owner is assigned for Magento, networking and the procurement platform.
• The rollback action is known: deactivate the affected buyer profile or disable PunchOut only in the affected scope.