Initiate a PunchOut Setup Request (cXML PunchOutSetupRequest) to the supplier's PunchOut URL, including your buyer credential (identity + shared secret), the BuyerCookie for session correlation, and the return URL where the cart XML should be posted back.
Receive the PunchOutSetupResponse containing a Start Page URL; open or navigate to this URL in a session context to browse the supplier's catalog within the PunchOut frame.
After selecting items, the supplier posts a PunchOutOrderMessage cXML document to your return URL; parse the ItemIn elements to extract supplier part numbers, descriptions, unit prices, quantities, and UOM codes.
Map the PunchOut cart items into your internal purchase requisition format and route for any required approval workflows before generating a purchase order.
Generate and transmit an OrderRequest cXML document to the supplier's order submission endpoint, referencing the original PunchOut session BuyerCookie; sign the request with your shared secret using the cXML HMAC or credential scheme.
Capture the OrderResponse, extract the supplier order ID and any line-level confirmations, and store them against the requisition for tracking.
Known gotchas
cXML timestamps must be in ISO 8601 format and match the server's expected timezone; a clock skew of more than a few minutes can cause request signature validation to fail.
PunchOut sessions are stateful and typically expire after 30–60 minutes of inactivity; do not start a PunchOut session unless the agent will complete item selection and cart return within that window.
Supplier cXML implementations often deviate from the spec in minor ways (non-standard element names, missing optional fields); test against each supplier's sandbox and handle supplier-specific quirks in a dedicated adapter.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp