# xAPI learning records > xAPI learning records: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. ![](/_astro/adl.XRNMaUb9.png)Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads training statements from any xAPI Learning Record Store, read-only, inside your deployment, with learners’ contacts left out. ## At a glance | Collector | xAPI learning records, version `1.0.0` | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | Reads | ADL Initiative / IEEE: xAPI (Experience API) Learning Record Store ([the vendor's documentation](https://github.com/adlnet/xAPI-Spec)) | | Family | Aviation | | Kind | Training | | Ways to connect | Access token | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Identity, Contact, Employment | | Hosts it may contact | Only the hosts on your deployment's allow-list (`*`: the host is the one you give it) | | Vendor API versions | xAPI 1.0.3, xAPI 2.0.0 (IEEE 9274.1.1) | | Lowest engine version | `0.46.0` | ## What it reads - Statements stored since the last run (`GET {endpoint}/statements` with `since`, `ascending` and `limit`, 1 to 10000, default 500), following the `more` link until it is empty. - Optionally only the verbs you list (`verbs`, one query each). - One record per statement, keyed by its id, titled with its verb and activity, with the verb, activity and result success in its metadata. - A statement that voids another arrives as a new statement; the voided one is then withdrawn. ## How to connect 1. In your LRS, make a client (a key and secret) with read-only access to statements. 2. In LightHouse, open **Setup and admin, Connectors**, choose **xAPI learning records**, and leave the access level at **Read**. 3. Name `endpoint` (the LRS’s https xAPI endpoint), `version` (`1.0.3` or `2.0.0`) and, optionally, `verbs`. 4. Paste the key and then the secret. Your browser seals them to your deployment, which hands them to the collector as `XAPI_KEY` and `XAPI_SECRET`. ## Permissions - `GET` only, with HTTP Basic and `X-Experience-API-Version`. The statements API is also writable on most LRSs; this collector never sends `PUT`, `POST` or `DELETE`. - The LRS’s rights for the client are the permission: give it read-only access. - Your deployment refuses to store this credential at read and write. ## Limits - Incremental: the cursor is the newest `stored` time seen. - Rate limits are the LRS’s own; `429` is retried with `Retry-After`. The default pace is two requests a second (`delay_s` 0.5). - More than `max_pages` (1000) pages fails the run; a `more` link to another host is refused. - Statements are immutable, so a changed statement never reappears. ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a learner or a statement. - Reporters are protected by default: reporters’ names, who submitted or created a record, and everyone’s email, phone and contact details are left out of every record before it is written, as are travel document numbers and dates of birth. Just culture and data protection both need a reporter kept from anyone who does not need them. Names are matched whatever the case, spacing, `_` or `-`, so `reporterName` also catches an export’s `Reporter Name`. - `exclude_fields` adds paths (for example `**.contact`); `keep_fields` takes a default back by its exact name, and that choice is your record of the decision. Free-text narratives are indexed as written and may still name people: add the fields that hold them to `exclude_fields`. - Nothing is cached raw, and a failure names the host and the status, never the URL. - Learners are personal data. The actor’s contacts (`mbox`, `mbox_sha1sum`, `openid`) are left out by default; the actor’s name is not. Add `**.actor.name` or `**.actor.account.name` to `exclude_fields` where training records are read for trends rather than people. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------- | --------------------------------------------------- | ------------------------------------------------ | | `credential variable 'XAPI_KEY' is not set` | The deployment has not been given the key or secret | Connect the credential again | | `GET host: HTTP 401` | The LRS refused the credential | Check the client and that it may read statements | | ``GET host: a `more` link to another host was refused`` | The LRS pointed away from itself | Report it to us; nothing was followed | | `xapi: more than 1000 pages` | A very long result | Add a `verbs` filter, or raise `max_pages` | | `endpoint is the LRS's https xAPI endpoint` | `endpoint` is not https | Use the https endpoint | | `version is 1.0.3 or 2.0.0` | Any other version | Choose one of the two | | `limit is 1 to 10000` | A page size out of range | Correct it | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------------------------ | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | xAPI 1.0.3 and 2.0.0 (IEEE 9274.1.1) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/xapi/