Lairnin records
RODMENA LRS
Available on requestThe evidence store fer learnin, recordin whit happened yince an keepin it richt exact.
RODMENA LRS is a Learning Record Store. It receives records o learnin activity in the xAPI format, stores them unchynged an returns them through the standard xAPI query interface. It passes aal tests in the ADL LRS Conformance Test Suite fer xAPI 1.0.3 an xAPI 2.0. The database itsel keeps customers’ records apairt frae yin anither. Record contents are encrypted at rest. Learner identifiers are stored onlie in a keyed, pseudonymous form. Stored records cannae be altered, though a learner’s personal data can be dighted oot on request an the erasures are written tae a tamper-evident log.
Wha it is for. Learnin platforms an trainin providers that hae need o a conformant store fer learner activity records. It is a back-end service that products are biggit on an caa frae their servers, an learners an browsers daenae talk tae it directly. REES is its first consumer.
- Status
- Available on request
- Pairt o
- Offerins
- Licence
- Proprietary. Copyright RODMENA LIMITED, all rights reserved.
- Conformance
- 1,365 xAPI 1.0.3 conformance tests, aa passed
- 1,435 xAPI 2.0 conformance tests, aa passed
- Verified 23 September 2026
- Tags
- xAPILairnin recordsConformanceMulti-tenantData protectionAudit trail
Technical specification
Writ for a technical assessor. A raw wi nae measured value is quat.
Standards
- xAPI 1.0.3
- ADL Experience API Specification, version 1.0.3
- xAPI 2.0
- IEEE 9274.1.1-2023
- Version selection
- Per request, bi the X-Experience-API-Version header. 1.0.x an 2.0.x is accepted, an a missin or unkent version is refused wi 400.
- Conformance suite
- ADL LRS Conformance Test Suite, last run 23 September 2026
- Conformance result
- xAPI 1.0.3: 1,365 o 1,365. xAPI 2.0: 1,435 o 1,435.
- Ayont the suite
- Whar the suite says it disnae test a requirement, a dedicated check covers it. We forbye foun sax suite tests that assert nocht an covered thaim separately.
- By design
- OAuth 1.0 is deprecated an isnae accepted. Products biggit on the service caw it server tae server. It disnae tak cross-origin caws frae a browser.
Interface
- Réssources
- Statements, State, Activity Profile, Agent Profile, Activities, Agents an About. Awn GET routes forbye answer HEAD.
- Authentication
- HTTP Basic uisin credentials the service issues. Secrets is 256 bits an stored anely as a keyed verifier. Unkent, disabled an expired credentials receive byte-identical 401 responses.
- Alternate Request Syntax
- Supported unner 1.0.3 an refused unner 2.0, as that specification requires.
- Signed statements
- JWS wi RS256, RS384 an RS512, verified whan a certificate is included.
- Attachments
- multipart/mixed, matched by SHA-2 hash. 5 MiB per attachment an 1 MiB per statement body, baith configurable.
- Paging
- Signed stateless cursors at bides guid ower a restart. A' statements responses cairries the xAPI consistency header.
- Idempotency
- Re-sendin an identical statement id is accepted athoot duplication. A conflicting yin is refused wi 409.
- Rate limiting
- Per credential, forby a sindry budget per client address fer failed authentication.
Isolation an security
- Tenant isolation
- PostgreSQL row-level security, enablit an forced on ivery table haudin tenant data. The application database role awns naethin an cannae by-pass it. Ilka transaction taks its tenant frae the authenticated credential alane.
- Isolation, enforced
- A catalogue test fails the build if ony tenant table, or ony partition creatit at runtime, wants the policy.
- Encryption at rest
- AES-256-GCM on statement bodies, documents, attachments, activity definitions an credential identities, unner a per-record key derived wi HKDF-SHA256.
- Ciphertext bindin
- A ciphertext is boond tae the identity o its raw an wull no decrypt gin it is flitted tae anither raw.
- Key custody
- Thrie keys haudit ootside the database, in 0600 key files or the environs. Thair is nae default key, an the service refuses tae stairt withoot thaim.
- Key rotation
- The index key rotates bi an affline, resumable rekey, an rotatin the credential key reissues credentials. Acause records store the id o the key that wrate them, a rotation needs nae data migration.
- Learner identifiers
- Hauden anerly as HMAC-SHA256 tokens unner a per-tenant key, an yin learner in twa tenants yields twa unrelatit tokens. Nae column hauds a learner identity in clear.
- Scopes o creentials
- The xAPI scope set o statements/write, statements/read, statements/read/mine, state, profile, all/read an all. The narroest reads anerly the statements that credential itsel wrate.
- Immutability
- Database triggers keep statements an attachments append-anerly bi refusin UPDATE, DELETE an TRUNCATE. The anerly alloued chynges are the voidin flag an an erasure.
- Database transport
- TLS wi full certificate an hostname verification is mandatory, an the service refuses tae stairt athoot it.
- Request audit events
- Ae structurt event per request cairryin request id, credential key id, tenant, method, resoorce, status, record coont, duration an filter names. Learner values in filters is tokenised afore thay are logged.
- Tamper evidence
- The erasure log is hash-chained, an a single command verifees the hale chain frae the first link tae the hinmaist.
Data protection
- Erasure
- A pseudonymisin redaction. The learner is replaced bi a random pseudonym in onie poseetion a statement can name them, free-text responses an attachments are remuved, an their State an Agent Profile documents are deletit. Pheesical deletion isnae used.
- Erasure, recordit
- Erasures are writ tae the hash-chained log. Acause the command refuses an erasure that matches nocht, a mistyped learner cannae pass fur a completit erasure.
- Backups
- Ane erasure is complete ance backups taen afore it hae expired. Efter a restore, the erasure log is replayed.
- Retention
- By calendar month, per instance. The month is detached, exported as one file per tenant, and dropped. The drop is refused unless the exported row count matches.
- Keepin, per customer
- A customer needin its ain retention period needs its ain instance.
- Export on exit
- Ower the stannard xAPI interface, a customer can page through aw its records an their attachments as xAPI JSON an tak the hale lot.
- Residency
- A instance rins in the region a contract needs. The service needs only a PostgreSQL database.
Operations an verification
- Deployment model
- A shared multi-tenant instance, or a dedicated instance per customer.
- Probes pruive they can fail
- The harness wull no coont a pass frae onie o the 47 behavioural probes till that probe haes bin shawn tae FAIL agin a deliberately broken build. We run the conformance suite agin broken builds as weel.
Whit it daes
-
Conformance-tested
Passes aa 1,365 tests o the ADL LRS Conformance Test Suite fur xAPI 1.0.3, an aa 1,435 fur xAPI 2.0.
-
Records niver chynge
Eence it is stored, a statement cannae be edited or owrewritten, only voided, as the staundart specifies.
-
Isolatit by design
Customers’ records are kep apairt bi rules the database enforces, forbye the application code.
-
Encrypted an pseudonymous
Record contents is encryptit at rest, an learner identifiers is indexed ainly as keyed tokens.
-
Erasure wi an audit trail
On request, a learner’s personal data is remuved frae their records, an the erasure is recorded in a tamper-evident, hash-chained log.
-
Scoped credentials
A credential is limited tae the operations it haes need o, doon tae readin onlie the records it wrote itsel.
For documentation, a pilot or an integration, contact us.