Using Cofactr as a Punchout Store

Last updated: May 23, 2025

Important Note

These instructions pertain to using Cofactr alongside an existing procurement system, such as Coupa, SAP Ariba, etc, which support the cXML Punchout standard. This is used for initiating a procurement process within that procurement system and then conducting transactions within the Cofactr platform.

Cofactr also supports Punchout from Cofactr to a third-party e-commerce website (McMaster-Carr, etc.). In that flow, the procurement process is initiated from within Cofactr. If you are using Cofactr as your primary Source-2-Pay system and looking to implement Punchout from Cofactr to third-party suppliers, please contact success@cofactr.com for help enabling that feature. These instructions are not for you.

Requirements

  1. You must have an existing Cofactr account and a Sandbox organization. If you do not already have a sandbox, please contact success@cofactr.com, and they will add one for you. There is no charge for sandbox accounts for Cofactr subscribers.

  2. Users must have a Cofactr login to complete punchout transactions within Cofactr. You can use SAML/SCIM to automatically provision users within Cofactr from your main IDP system (Okta, Microsoft Entra, etc.

Procurement System Setup

You will need to following information to configure the punchout connection within your procurement system:

Punchout URL: https://flagship-api.cofactr.com/punchout_sessions/start/

PO URL: https://flagship-api.cofactr.com/punchout_sessions/appove_snapshot/

Customer Domain: NetworkID

Customer Identity:  TO BE PROVIDED BY COFACTR SUPPORT

Supplier Domain: DUNS

Supplier Identity: 118635831

Shared Secret: TO BE PROVIDED BY COFACTR SUPPORT

You must also configure an Extrinsic for the email of the user who is initiating the punchout session:

<PunchOutSetupRequest operation="create">
  <Extrinsic name="Email">{user email here}</Extrinsic>
</PunchOutSetupRequest>

The user email must match the email used for that user's Cofactr account

When Cofactr returns the cart data to the BrowserFormPost URL, the OrderRequestHeader will include a SnapshotID Extrinsic. This must be included in the cXML PO otherwise the PO will be rejected:

<Extrinsic name="SnapshotID">{Snapshot ID received from Cofactr}</Extrinsic>

Important Note

Cofactr support will provide you with two different Customer Identity and Shared Secret values, one each for your primary account and one each for your sandbox. If you place orders through your primary account, they will be processed, and you will be charged for them. If you place orders through your primary account, they will be ignored. It is very important not to mix these two up.

Important Note

Cofactr does not support partial POs in punchout workflows. The total cost and line items submitted via PO to Cofactr must match the request received from the punchout session, otherwise the PO will reject the request.