{
 "categories": [
  "finance",
  "enterprise"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-09-04",
   "fact": "homepage",
   "note": "Coupa Documentation presents Coupa as a commercial platform with a REST API for reading, editing, and integrating Core data. The marketing homepage at www.coupa.com returned a Cloudflare challenge on this pass.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/coupa-core-api-overview",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "license",
   "note": "OAuth client setup lives under tenant Setup for customer-created Core integrations. No public free tenant is published on the opened developer pages.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/oauth-2.0-and-oidc",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.api.exists",
   "note": "Coupa documents a tenant REST API at https://{instance}.coupahost.com/api/{resource} for querying, creating, and updating Core resources.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.api.kinds[0]",
   "note": "The Core API is documented as REST over HTTPS with GET, POST, and PUT against /api/{resource} paths.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.api.kinds[1]",
   "note": "Coupa documents a GraphQL query endpoint at /api/graphql. Only client-credentials grant and read scopes are supported. Mutations are not supported.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api/introducing-graphql",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.api.auth[0]",
   "note": "Coupa documents OAuth 2.0 / OIDC client-credentials token minting at POST https://{instance}/oauth2/token with client_id, client_secret, grant_type=client_credentials, and space-separated scopes. Tokens last about 24 hours. API keys are deprecated for Core.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/oauth-2.0-and-oidc/set-up-an-openid-connect-client",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.api.coverage",
   "note": "Purchase Orders API documents GET/POST/PATCH/PUT including issue, cancel, close, and reopen. Get-started states not all fields are available and deleting data is not supported for any resource via the API as a general rule.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/resources/transactional-resources/purchase-orders-api-purchase_orders",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.api.docs",
   "note": "Opened as the current Core API get-started page for base URL, methods, XML/JSON, GraphQL, and CSV.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.data_access.export[0]",
   "note": "GET requests return information in JSON or XML. Accept and Content-Type must match.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.data_access.export[1]",
   "note": "The same page documents XML as a first-class response format alongside JSON.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.data_access.export[2]",
   "note": "Coupa documents CSV flat files for mass export and load of Core records such as users and suppliers.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.data_access.import[0]",
   "note": "POST and PUT accept JSON or XML payloads to create or update a resource.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.data_access.import[1]",
   "note": "Purchase Orders examples include XML order-header bodies for line delete and reopen.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/resources/transactional-resources/purchase-orders-api-purchase_orders",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.data_access.import[2]",
   "note": "CSV flat files load many records in a single scheduled integration run.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "https://docs.coupa.com/llms.txt returned 404 and did not serve a first-party agent document.",
   "source": "https://docs.coupa.com/llms.txt",
   "tier": "scraped"
  },
  {
   "date": "2026-09-04",
   "fact": "verdict.scores.api",
   "note": "The Core API is documented, OAuth/OIDC-authenticated, and read/write across purchase orders, invoices, and requisitions. Client Purpose, tenant hosts, scope assignment, no general DELETE, and GraphQL read-only keep it below unusual completeness.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/oauth-2.0-and-oidc",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as the current OAuth 2.0 / OIDC page, including API-key deprecation, mandatory Client Purpose, IP allowlists, and data-access restrictions. Last updated 2026-08-20.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/oauth-2.0-and-oidc",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current client-credentials token-mint walkthrough at POST /oauth2/token.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/oauth-2.0-and-oidc/set-up-an-openid-connect-client",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current Core API get-started page for base URL, methods, and formats.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current Purchase Orders API, including issue, cancel, close, and reopen actions.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/resources/transactional-resources/purchase-orders-api-purchase_orders",
   "tier": "declared"
  },
  {
   "date": "2026-09-04",
   "fact": "freshness.watch[4].url",
   "note": "Opened and verified as the current GraphQL page, including read-only client-credentials scopes and no mutations.",
   "source": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api/introducing-graphql",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-04",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/oauth-2.0-and-oidc"
   },
   {
    "type": "docs",
    "url": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/oauth-2.0-and-oidc/set-up-an-openid-connect-client"
   },
   {
    "type": "docs",
    "url": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api"
   },
   {
    "type": "docs",
    "url": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/resources/transactional-resources/purchase-orders-api-purchase_orders"
   },
   {
    "type": "docs",
    "url": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api/introducing-graphql"
   }
  ]
 },
 "homepage": "https://www.coupa.com/",
 "id": "coupa",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": false
  },
  "api": {
   "auth": [
    "oauth2"
   ],
   "coverage": "partial",
   "docs": "https://docs.coupa.com/en/developer-documentation/the-coupa-core-api/get-started-with-the-api",
   "exists": true,
   "kinds": [
    "rest",
    "graphql"
   ]
  },
  "cli": {
   "exists": "unknown"
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json",
    "xml",
    "csv"
   ],
   "import": [
    "json",
    "xml",
    "csv"
   ]
  },
  "extensibility": {
   "scripting": [],
   "webhooks": "unknown"
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": "unknown",
   "third_party": [],
   "verdict": "unknown"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. The documented Coupa Core REST and GraphQL APIs, plus CSV flat files, are the supported automation paths. Browser automation remains unassessed.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Coupa",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [
   "sap-concur",
   "basware",
   "visma-proceedo"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Coupa",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 7,
   "cli": null,
   "computer_use": null,
   "integrations": null,
   "mcp": null,
   "overall": 7,
   "rpa": null
  },
  "summary": "Coupa Core is automatable today through its documented REST APIs. This record is the Coupa Core platform REST surface, including purchase orders, invoices, and requisitions. It is not SAP Concur, SAP Ariba, or Basware. Treasury, CSO, and Supply Chain Optimization stay out of this identity. Callers use HTTPS against a tenant host of the form https://{instance}.coupahost.com/api/{resource}. Authentication is OAuth 2.0 / OIDC. API keys are deprecated for Core integrations. Tenant admins create OAuth clients under Setup > Oauth2/OpenID Connect Clients. Client Purpose is mandatory. Client-credentials tokens are minted at POST /oauth2/token and last about 24 hours (expires_in 86399 seconds). Optional IP allowlists and account-group or business-group restrictions apply. REST supports GET, POST, and PUT in XML or JSON; deleting data is not supported for any resource except where a resource documents a destroy action, such as requisitions. Purchase Orders API can query, create external POs, update, issue, cancel, close, and reopen. Invoices API can create, query, submit, abandon, and dispute. Requisitions API can create, submit, and update carts. A GraphQL endpoint at /api/graphql is OIDC-authenticated, client-credentials and read-scopes only; mutations are not supported. No official Core SDK or CLI was established from the opened pages. Vendor docs do not declare a first-party MCP server. The official MCP registry search for coupa returned zero servers; that is discovery silence, not proof of absence. iPaaS catalogs were not opened. Computer-use viability is unassessed.\n"
 }
}