Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.Reads training statements from any xAPI Learning Record Store, read-only, inside your deployment, with learners’ contacts left out.
| Collector | xAPI learning records, version 1.0.0 |
|---|
| Reads | ADL Initiative / IEEE: xAPI (Experience API) Learning Record Store (the vendor's documentation) |
|---|
| Family | Aviation |
|---|
| Kind | Training |
|---|
| Ways to connect | Access token |
|---|
| Scopes | |
|---|
| Read only | Yes |
|---|
| Vendor's API can move money | No |
|---|
| Personal data | Identity, Contact, Employment |
|---|
| Hosts it may contact | Only the hosts on your deployment's allow-list (*: the host is the one you give it) |
|---|
| Vendor API versions | xAPI 1.0.3, xAPI 2.0.0 (IEEE 9274.1.1) |
|---|
| Lowest engine version | 0.46.0 |
|---|
- Statements stored since the last run (
GET {endpoint}/statements with since, ascending and limit, 1 to 10000, default 500), following the more link until it is empty.
- Optionally only the verbs you list (
verbs, one query each).
- One record per statement, keyed by its id, titled with its verb and activity, with the verb, activity and result success in its metadata.
- A statement that voids another arrives as a new statement; the voided one is then withdrawn.
- In your LRS, make a client (a key and secret) with read-only access to statements.
- In LightHouse, open Setup and admin, Connectors, choose xAPI learning records, and leave the access level at Read.
- Name
endpoint (the LRS’s https xAPI endpoint), version (1.0.3 or 2.0.0) and, optionally, verbs.
- Paste the key and then the secret. Your browser seals them to your deployment, which hands them to the collector as
XAPI_KEY and XAPI_SECRET.
GET only, with HTTP Basic and X-Experience-API-Version. The statements API is also writable on most LRSs; this collector never sends PUT, POST or DELETE.- The LRS’s rights for the client are the permission: give it read-only access.
- Your deployment refuses to store this credential at read and write.
- Incremental: the cursor is the newest
stored time seen.
- Rate limits are the LRS’s own;
429 is retried with Retry-After. The default pace is two requests a second (delay_s 0.5).
- More than
max_pages (1000) pages fails the run; a more link to another host is refused.
- Statements are immutable, so a changed statement never reappears.
- Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a learner or a statement.
- Reporters are protected by default: reporters’ names, who submitted or created a record, and everyone’s email, phone and contact details are left out of every record before it is written, as are travel document numbers and dates of birth. Just culture and data protection both need a reporter kept from anyone who does not need them. Names are matched whatever the case, spacing,
_ or -, so reporterName also catches an export’s Reporter Name.
exclude_fields adds paths (for example **.contact); keep_fields takes a default back by its exact name, and that choice is your record of the decision. Free-text narratives are indexed as written and may still name people: add the fields that hold them to exclude_fields.- Nothing is cached raw, and a failure names the host and the status, never the URL.
- Learners are personal data. The actor’s contacts (
mbox, mbox_sha1sum, openid) are left out by default; the actor’s name is not. Add **.actor.name or **.actor.account.name to exclude_fields where training records are read for trends rather than people.
| What you see |
What it means |
What to do |
credential variable 'XAPI_KEY' is not set |
The deployment has not been given the key or secret |
Connect the credential again |
GET host: HTTP 401 |
The LRS refused the credential |
Check the client and that it may read statements |
GET host: a `more` link to another host was refused |
The LRS pointed away from itself |
Report it to us; nothing was followed |
xapi: more than 1000 pages |
A very long result |
Add a verbs filter, or raise max_pages |
endpoint is the LRS's https xAPI endpoint |
endpoint is not https |
Use the https endpoint |
version is 1.0.3 or 2.0.0 |
Any other version |
Choose one of the two |
limit is 1 to 10000 |
A page size out of range |
Correct it |
Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.
| Date | Collector | Engine | Vendor API | Method | Expires |
|---|
| 10 November 2026 | 1.0.0 | 0.47.0 | xAPI 1.0.3 and 2.0.0 (IEEE 9274.1.1) | Fixtures only: built, not certified | Not applicable |
From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.
| Last scanned | 10 November 2026 |
|---|
| Critical findings | 0 |
|---|
| High findings | 0 |
|---|
| Medium findings | 0 |
|---|
| Low findings | 0 |
|---|
| Info findings | 0 |
|---|
| Release blocked | No |
|---|
| Network allow-list check | Pass |
|---|
| Read-only behavioural test | Pass |
|---|
| SBOM (CycloneDX) | Produced |
|---|
| Dependency licences | Pass |
|---|
| Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only |
|---|
