CSO Public API

Programmatically manage sourcing event content including events, item types, items, fields, supplier bids, and markets.

Overview

The Coupa Sourcing Optimization (CSO) Public API lets external systems programmatically manage sourcing event content over a secure, versioned, OAuth 2.0 REST interface. Using this API, you can:

  • Read and create CSO sourcing events

  • Manage item types, items, item fields, and bid fields

  • Read event phases, suppliers, and supplier bids

  • Access markets and templates (read-only)

  • Manage cost formulas and poll asynchronous job status

Authentication flow

The CSO Public API uses Coupa Core OpenID Connect (OIDC) authentication in your Coupa Core instance. Use the following authentication flow:

  1. Create an OIDC client in your Coupa Core instance with a Grant Type set to Client Credentials. Apply scopes to your client depending on which endpoint you need to access. The token's audience (aud) must include cso. For specific steps for creating a client in Coupa Core and accessing a token, see OAuth 2.0 and OIDC.
  2. Generate the access token using your Coupa Core instance.
  3. Send subsequent CSO API requests to your Coupa CSO tenant URL. See the Base URL section below. Include the token in the Authorization header: 
    Authorization: Bearer <access_token>

Scopes are associated with each API endpoint:

  • cso.bids.read: Access supplier bid data.

  • cso.events.read: Read event data.

  • cso.events.write: Create and update events.

  • cso.fields.read: Read field data.

  • cso.fields.write: Create and update fields.

  • cso.items.read: Read item data.

  • cso.items.write: Create and update items.

  • cso.markets.read: Read market data.

  • cso.markets.write: Create and update markets.

A request whose token lacks the required scope returns 403 insufficient_scope.

Base URL

The CSO Public API uses your CSO instance URL, for example:

https://<organization_name>.cso.coupahost.com/rest/public/v1

All endpoints are served under /rest/public/v1.

Pagination

List endpoints use offset / limit query parameters (limit 1-500, default 50) and return a { data, pagination } envelope plus RFC 8288 Link headers.

Rate Limiting

When enabled, requests are rate-limited per domain; exceeding the limit returns 429 Too Many Requests with a Retry-After header indicating when to retry.

Documentation

The complete OpenAPI specification is available at https://{organization_name}.cso.coupahost.com/rest/openapi.html. The specification provides detailed information about all endpoints, request/response schemas, and interactive testing capabilities.