CIB Init Script

Deploys the Coupa Integration Baseline (CIB) to a target Rossum organisation.

The script automatically:

• Downloads the configured CIB release from the public GitHub repository and caches it locally
• Notifies you if a newer CIB release is available
• Checks the target organisation before touching it: Coupa credential scopes, cluster region, that no CIB objects already exist, and that the organisation group allows the hook timeouts the release needs (see Target organization prerequisites)
• Deploys the queues, extraction engines, extensions, formula fields, rules and MDH matching configuration for that release (see CIB versions)
• Configures the connection to your Coupa environment
• Initiates data replication for the standard master data sets (suppliers, purchase orders, tax codes, payment terms, etc.)
• Verifies afterwards that every object in the deploy file really exists in the target — prd2 reports per-object failures inline but still exits 0, so a partial deploy would otherwise look like a successful one

Fresh installs only. Every run creates a new set of objects. The script stops if the target organisation already contains CIB objects, because a second run would build a parallel copy rather than update the first. There is no in-place upgrade path from CIB 1.x to 2.0 — deploy 2.0 into a clean organisation.

When clearing a previous attempt, remember that deleting the workspaces and queues in the Rossum UI does not delete their rules — around 50 rules stay behind, invisible from the workspace view. Delete them too; the script checks for them and refuses to start while they are there.

One script deploys any CIB release; rossum.cib_version in config.json picks which. Keep an older version pinned if a newer one causes trouble.

CIB 2.0 deploys everything, every time. A customer who does not process e-invoices, or who operates in only some of those countries, gets queues they will not use. Deleting the unused country workspaces after the deploy is a normal part of the handover — do it before uploading any documents. Each country queue is self-contained; the rules that route documents into them live on the E-invoicing Inbox queue and can be deleted with it.

Each release from v2.0.0 carries its own deploy configuration in a deploy/ folder. Releases predating that convention (v1.0.0, v1.1.0) are covered by the copies in this repository's _config/. The script picks whichever applies, so a new CIB release generally needs no new version of this script.

These are organization-group settings that only Rossum can change — they are not writable with an admin API token, so arrange them with Rossum support before the deploy. The script checks the first one up front and refuses to start without it; the rest surface as advisories or at run time.

All but the last are properties of the organization group, not the organisation — check them with GET /api/v1/organization_groups/<id> and compare against the CIB source group. maximum_hook_timeout is a commercial entitlement (it governs Lambda runtime cost), which is why no customer-side token can set it.

Rossum sets this on the organization group; it is not exposed in the public organization_groups response and cannot be changed with an admin token. CIB needs the group configured as:

{
  "included": [
    "public",
    "field-manager",
    "ps_eng_export_pipeline",
    "ps_eng_write_data_to_mongo",
    "integrations_team"
  ],
  "excluded": [
    "deprecated"
  ]
}

ps_eng_export_pipeline covers the Request Processor used by the export chain and integrations_team the Coupa master-data import job; public alone is not enough for either. Without them prd2 stalls on a template prompt it cannot be given an answer to.

Removing the hook_template reference does not avoid that prompt. prd2 only tries to match when the hook still has one, and the picker is a separate step reached whenever nothing matched — so dropping the reference guarantees the prompt rather than skipping it. Only visibility fixes it.

Which templates a release needs varies with its hooks. Find them with:

grep -ho '"hook_template": "[^"]*"' <release>/cib-org/default/hooks/*.json | sort -u

then check each id resolves in the target: GET /api/v1/hook_templates/<id>. CIB 2.0 uses 28 (Duplicate Handling), 39 (Master Data Hub), 50 (Export Pipeline — Request Processor) and 55 (Coupa master data import). Note the XML mime types the e-invoicing inbox needs are not an organization-group setting: they travel in the queue's own accepted_mime_types and deploy with it.

CIB v1.x needs only external egress and the local admin — its export runs on webhook extensions rather than serverless functions, so the timeout cap does not apply.

• Python 3.10 or later — python.org
• pipx — used to install the prd2 deployment tool
• prd2 v2.18.1 or later — the Rossum deployment CLI. This script requires the --ld (local deploy) flag, which first ships in v2.18.1. Earlier versions fail with Error: No such option: --ld.

Mac / Linux:

pip install pipx
pipx ensurepath

Windows (run in PowerShell):

pip install pipx
pipx ensurepath

Restart your terminal after running ensurepath.

prd2 is not published on public PyPI — install it from the GitHub repository, pinning the minimum supported tag:

pipx install git+https://github.com/rossumai/deployment-manager.git@v2.18.1

Verify the installation (must report 2.18.1 or later):

prd2 --version

git clone https://github.com/rossumai/coupa-integration-deploy-tool.git
cd coupa-integration-deploy-tool

Mac / Linux:

pip install -r requirements.txt

Windows:

pip install -r requirements.txt

Alternatively, if you use pipenv:

pipenv sync

Edit config.json with your environment details. See Configuration below.

Then tell git to stop tracking your local changes to it (so credentials are never committed accidentally):

git update-index --skip-worktree config.json

Run this once after cloning. To re-enable tracking (e.g. to commit a structural change to the file), run git update-index --no-skip-worktree config.json first.

Mac / Linux:

python cib_init_script.py

Windows:

python cib_init_script.py

The script will download the configured CIB release on the first run and cache it locally:

• Mac / Linux: ~/.cib_releases/<version>/
• Windows: %LOCALAPPDATA%\cib_releases\<version>\

Subsequent runs reuse the cached release. To force a fresh download, delete the version folder from the cache directory.

The script version is tracked in the VERSION file.

_config/ holds the deploy configuration for the CIB releases that predate per-release assets — v1.0.0 and v1.1.0, which share one set of object IDs. These files are managed by Rossum and should not be edited manually unless instructed. From CIB v2.0.0 onwards the equivalent files ship inside the CIB release itself, so _config/ is frozen and no longer changes when a new CIB is published.

Edit config.json with your environment details:

{
  "rossum": {
    "org_id": 12345,
    "api_base_url": "https://elis.rossum.ai/api/v1",
    "target_rossum_instance": "prod-eu",
    "token_owner_username": "admin@yourcompany.com",
    "target_org_token": "<your-rossum-api-token>",
    "cib_version": "v2.0.0"
  },
  "coupa": {
    "coupa_base_api_url": "https://your-instance.coupacloud.com/",
    "client_id": "<coupa-oauth-client-id>",
    "client_secret": "<coupa-oauth-client-secret>"
  }
}