FAQ
Does PunchOut support both OCI and cXML?
Yes. The core package has OCI login/cart-return routes and cXML setup/PunchOutOrderMessage routes. A buyer profile uses one protocol at a time.
Does the extension require Adobe Commerce B2B?
No. The Composer package depends on Magento framework and SoftwareSilo Extension Manager, not Adobe Commerce B2B. The customer, catalog and pricing capabilities available in a particular installation still depend on that Magento project.
Are SAP Ariba, Coupa and Oracle Procurement integrations included?
The module includes editable outbound starter mappings oriented toward those platforms. That is not certification or a promise that every tenant accepts the defaults unchanged. The buyer must supply its current URLs, credentials, protocol dialect, required fields and test cases.
Why can I not assign an inbound template to a buyer?
Buyer profiles intentionally list active outbound runtime profiles. The shipped inbound fixtures are synchronized reference/catalog definitions; the current OCI and cXML setup controllers parse supported fields directly rather than executing inbound mapping rules.
Does cart return place an order in Magento?
No. Return to System sends the cart to the procurement platform. The buyer normally completes approvals and creates its PO outside Magento.
Does the inbound PO endpoint create a Magento order?
It can. Acknowledge Only records the request, Validate Only builds and validates the Magento quote, and Create Magento Order places the order. The effective value comes from the buyer profile first and the selected Store view second.
Which price is returned?
The cart uses Magento pricing by default, including the customer context resolved for the buyer. Prices sent to the cart API are ignored unless Allow inbound cart item prices is explicitly enabled.
How does PunchOut resolve a Magento customer?
The Buyer Profile explicitly selects guest, fixed Magento customer, customer e-mail, optional request customer ID or required request customer ID. Fixed and resolved customers must belong to the selected Website unless Magento global customer sharing is enabled. Customer-by-e-mail can create a missing account when JIT provisioning is enabled. Magento's normal account-confirmation policy still applies.
Should strict signatures always be enabled in production?
Only when the calling integration sends the SoftwareSilo HMAC-SHA256 signature calculated with the same secret and payload rules. OCI or cXML support alone does not guarantee that signature. HTTPS, buyer credentials and an IP allowlist remain important regardless.
Why does an exact retry return the old response?
That is the request-replay contract. The same endpoint, X-Punchout-Request-Key and request hash replay the saved result with its original HTTP status. Use a new key when the cart or document action changes.
How are shipments and invoices sent?
Magento shipment and invoice events create queue rows for PunchOut-created orders. The default cron group processes them every five minutes and posts cXML to the dedicated ASN or Invoice URL from the Buyer Profile or Store View. Routing and the encrypted payload are durable, so the browser session may already be expired.
Can another module customize actor or permission behavior?
Yes. A separate Magento module can implement or decorate the public actor and permission service contracts and observe the PunchOut lifecycle events. The core package has no dependency on Sublogin or B2B Quote and does not advertise built-in bridges for either module.