Lowp tae content
Leid: SCO
Menu

Learning records

RODMENA LRS

Available on request

The evidence store for leirnin, recordin whit happened ance an keepin it exacklie.

Contact us

RODMENA LRS is a Learning Record Store. It receives records o learnin activity in the xAPI format, stores them unchynged an returns them throu the staundart xAPI query interface. It passes aw tests in the ADL LRS Conformance Test Suite for xAPI 1.0.3 an xAPI 2.0. The database itsel keeps customers’ records apairt frae ane anither. Record contents are encrypted at rest. Learner identifiers are stored anerly in a keyed, pseudonymous form. Stored records canna be altered, tho a learner’s personal data can be erased on request an the erasures are written til a tamper-evident log.

Wha it is for. Learnin platforms an trainin providers that need a conformant store for learner activity records. It is a back-end service that products are biggit on an caw frae their servers, an learners an brousers dinna speak til it directly. REES is its first consumer.

Status
Available on request
Pairt o
Offerins
Licence
Proprietary. Copyright RODMENA LIMITED, aw richts reserved.
Conformance
1,365 xAPI 1.0.3 conformance tests, aw passed
1,435 xAPI 2.0 conformance tests, aw passed
Verified 23 September 2026
Tags
xAPILearning recordsConformanceMulti-tenantData protectionAudit trail

Technical specification

Writ for a technical assessor. A raw wi nae measured value is left oot.

Standards

xAPI 1.0.3
ADL Experience API Specification, version 1.0.3
xAPI 2.0
IEEE 9274.1.1-2023
Version selection
Per request, bi the X-Experience-API-Version header. 1.0.x an 2.0.x is acceptit, an a missin or unkent version is refuised wi 400.
Conformance suite
ADL LRS Conformance Test Suite, last run 23 September 2026
Conformance result
xAPI 1.0.3: 1,365 o 1,365. xAPI 2.0: 1,435 o 1,435.
Ayont the suite
Whaur the suite says it disna test a requirement, a dedicatit check covers it. We fund six suite tests as weel that assert nocht an covered them separately.
By design
OAuth 1.0 is deprecatit an isna acceptit. Products biggit on the service caw it server tae server. It disna tak cross-origin caws frae a browser.

Interface

Resources
Statements, State, Activity Profile, Agent Profile, Activities, Agents an About. Aw GET routes ansuers HEAD as weel.
Authentication
HTTP Basic uisin credentials the service issues. Secrets is 256 bits an stored anerly as a keyed verifier. Unkent, disabled an expired credentials receives byte-identical 401 responses.
Alternate Request Syntax
Supportit unner 1.0.3 and refused unner 2.0, as that specification requires.
Signed statements
JWS wi RS256, RS384 an RS512, verified whan a certificate is includit.
Attachments
multipart/mixed, matched by SHA-2 hash. 5 MiB per attachment and 1 MiB per statement body, baith configurable.
Paging
Sained stateless cursors that bide valid athort a restart. Aw statements responses cary the xAPI consistency header.
Idempotency
Re-sendin an identical statement id is acceptit withoot duplication. A conflictin ane is refusit wi 409.
Rate limiting
Per credential, forby a sindry budget per client address for failed authentication.

Isolation and security

Tenant isolation
PostgreSQL row-level security, enabled and forced on ilka table haudin tenant data. The application database role ains naething and cannae bypasse it. Ilka transaction taks its tenant frae the authenticated credential alane.
Isolation, enforced
A catalogue test fails the build if ony tenant table, or ony partition creatit at runtime, lacks the policy.
Encryption at rest
AES-256-GCM on statement bodies, documents, attachments, activity definitions and credential identities, under a per-record key derived wi HKDF-SHA256.
Ciphertext bindin
A ciphertext is boond tae the identity o its raw an will no decrypt gin it is flitted tae anither raw.
Key custody
Three keys haudit ootside the database, in 0600 key files or the environment. Thare is nae default key, an the service refuses tae stairt withoot thaim.
Key rotation
The index key rotates by an offline, resumable rekey, an rotatin the credential key reissues credentials. Acause records store the id o the key that wrat them, a rotation needs nae data migration.
Learner identifiers
Hauden anerly as HMAC-SHA256 tokens unner a per-tenant key, an ane learner in twa tenants yields twa unrelatit tokens. Nae column hauds a learner identity in clear.
Credential scopes
The xAPI scope set o statements/write, statements/read, statements/read/mine, state, profile, all/read an all. The narroest reads anerly the statements that credential itsel wrat.
Immutability
Database triggers keep statements an attachments append-anerly by refusin UPDATE, DELETE an TRUNCATE. The anerly permittit chynges are the voidin flag an an erasure.
Database transport
TLS wi full certificate an hostname verification is mandatory, an the service refuses tae stairt withoot it.
Request audit events
Ae structured event per request cairryin request id, credential key id, tenant, method, resource, status, record coont, duration and filter names. Learner values in filters are tokenised afore they are logged.
Tamper evidence
The erasure log is hash-chained, an a single command verifies the hale chain frae the first link tae the hinmaist.

Data protection

Erasure
A pseudonymisin redaction. The learner is replaced by a random pseudonym in ony poseetion a statement can name them, free-text responses an attachments are remuved, an their State an Agent Profile documents are deletit. Pheesical deletion is no uised.
Erasure, recordit
Erasures are written tae the hash-chained log. Acause the command refuses an erasure that matches naething, a mistypit learner canna pass for a completit erasure.
Backups
An erasure is complete ance backups taen afore it hae expired. Efter a restore, the erasure log is replayed.
Retention
By calendar month, per instance. The month is detached, exported as one file per tenant, and dropped. The drop is refused unless the exported row count matches.
Keepin, per customer
A customer needin its ain retention period needs its ain instance.
Export on exit
Ower the staundart xAPI interface, a customer can page throu aw its records an their attachments as xAPI JSON an tak the haill lot.
Residency
An instance rins in the region a contract requires. The service needs only a PostgreSQL database.

Operations and verification

Deployment model
A shared multi-tenant instance, or a dedicated instance per customer.
Probes prove they can fail
The harness will no coont a pass frae onie o the 47 behavioural probes till that probe has been shawn tae FAIL agin a deliberately broken build. We rin the conformance suite agin broken builds as weel.

Whit it dis

  • Conformance-tested

    Passes aw 1,365 tests o the ADL LRS Conformance Test Suite for xAPI 1.0.3, an aw 1,435 for xAPI 2.0.

  • Records niver cheenge

    Efter it is stored, a statement cannae be editit or owersetten, only voided, as the staundart specifies.

  • Isolatit bi design

    Customers’ records are kept apairt by rules the database enforces, in addition tae the application code.

  • Encryptit an pseudonymous

    Record contents are encrypted at rest, and learner identifiers are indexed only as keyed tokens.

  • Erasure wi an audit trail

    On request, a learner’s personal data is remuved frae their records, an the erasure is recordit in a tamper-evident, hash-chained log.

  • Scoped credentials

    A credential is limitit tae the operations it needs, doun tae readin anerly the records it wrat itsel.

For documentation, a pilot or an integration, contact us.