Rooster LRS

Rooster LRS makes your WordPress site an xAPI Learning Record Store (LRS). Learning applications, e-learning packages (xAPI and cmi5), simulators and learning management systems send their xAPI statements to it, and reporting tools read them back. The records stay in your own database, in the plugin’s own tables, and nothing is sent anywhere else.

Website · Documentation · Rooster LMS

What it does

• The xAPI resources under /wp-json/rooster-lrs/xapi/: statements (store, query, void), State, Activity Profile, Agent Profile, Activities, Agents and About.
• xAPI 1.0.3 and xAPI 2.0 (IEEE 9274.1.1) at the same endpoint, chosen by the X-Experience-API-Version header.
• Strict statement validation with clear error messages that name the property and the rule.
• xAPI Profiles: statements that follow the Rooster assessment or adaptive profile (quiz attempts and answers, from Rooster LMS Pro or any platform that emits them) have the profile’s extensions checked against their schemas. The profiles are bundled with the plugin, so nothing is fetched.
• Every statement query parameter: agent, verb, activity, registration, related activities and agents, since and until, limit, ascending, formats exact, ids and canonical, paging with more, and statements that refer to other statements.
• Attachments (multipart/mixed) and signed statements (JWS structure, payload, and the signature when the certificate is included).
• Documents with ETags and concurrency control (If-Match / If-None-Match).
• The 1.0.3 alternate request syntax and CORS for browser-based content.
• Credentials per application (HTTP Basic): a key and a secret shown once, xAPI scopes, an authority, an expiry, revocation.
• LRS → Statements: a statement browser with filters and a “Void” action. LRS → Credentials and LRS → Settings.
• Privacy: personal-data export and erasure, erasure of one person’s records by e-mail address or xAPI agent, a retention period.
• Built for large stores: its own tables, an index for every query parameter, keyset paging (tested with 100,000 statements).
• WordPress Abilities: read-only reports (activity per course, lesson, verb or learner, time spent, unfinished activities, quiz answers per question) that AI assistants on your own site, such as Rooster One’s Insights Chat, can ask for; learners are pseudonymised.

Rooster LRS implements xAPI 1.0.3 and 2.0 and is tested against its own conformance suite; it has not yet been certified with the ADL LRS Conformance Test Suite.

When Rooster LMS is active, the screens use its design system. Rooster LRS works without it.

Endpoint and credentials

1. Go to LRS → Credentials and create a credential with the scopes the application needs.
2. Copy the key and the secret (the secret is shown once).
3. Give the application the endpoint shown on that screen (for example https://example.com/wp-json/rooster-lrs/xapi/), the key as the user name and the secret as the password.

To forward statements from Rooster LMS Pro, create a credential with the scopes statements/write and define, and choose a custom authority with Rooster LMS Pro’s LMS agent.

Caching and security plugins

xAPI requests must never be cached. If your site uses a page cache, a CDN or a caching plugin, exclude /wp-json/rooster-lrs/ (and ?rest_route=/rooster-lrs/ on sites without pretty permalinks).

Some security plugins block REST API requests from visitors who are not logged in; allow /wp-json/rooster-lrs/ for xAPI clients. Some servers remove the Authorization header before PHP sees it; Rooster LRS also reads REDIRECT_HTTP_AUTHORIZATION and PHP_AUTH_USER.

Multi-tenant mode

For the Rooster Adaptive LMS service only, which keeps the statements of many sites in one store. It is off on every other site, where it costs nothing and nothing changes. wp rooster-lrs multi-tenant on turns it on (status and off too; off is refused while tenants exist). In this mode:

• Every stored row belongs to a tenant. A credential reads and writes its own tenant only; another tenant’s statement, document or activity answers 404, and the same statement id sent by two tenants is two statements.
• Tenants and their signed credentials are created by the service’s own plugin on the same site, through Rooster LRS’s PHP API (RoosterLRS\Tenancy\TenantRegistry, TenantCredentials): there is no provisioning endpoint. A tenant credential may send statements and activity definitions only, at most 300 requests a minute.
• Quiz answers and engagement statements that follow the Rooster profiles are also written, in the same transaction, to two tables the service’s models read (rooster_lrs_responses, rooster_lrs_exposures). wp rooster-lrs projection rebuild --tenant=<id> derives them again from the statements.
• Each tenant has its own retention period; a person’s records and a whole tenant are erased through RoosterLRS\Privacy\TenantEraser.
• LRS → Statements and LRS → Credentials show every tenant, with a tenant filter and column.

External services

Rooster LRS does not connect to any external service. Your site never sends anything anywhere because of it: it only answers the xAPI requests that the applications you give a credential send to it. The links below open in the browser only when someone clicks them, and the addresses after them are identifiers that are never contacted.

rooster.systems: links (on click only)

The Rooster LRS header and Home page link to the website of Oxford Metadata Ltd, the makers of Rooster LRS: the manual (https://rooster.systems/category/en/documentation/rooster-lrs/), help, feedback and rooster.systems. Nothing is sent before the click. Terms and conditions · Privacy policy

wordpress.org and Viber links (on click only)

The Rooster LRS header links to this plugin’s page and review form on wordpress.org, and to the Rooster community’s chat on Viber (https://invite.viber.com/). WordPress.org privacy · Viber terms · Viber privacy

xAPI identifiers (never contacted)

xAPI names verbs, activity types, extensions and profiles with IRIs that look like web addresses. Rooster LRS compares them as text and never opens them: the ADL verbs (http://adlnet.gov/expapi/verbs/... and https://w3id.org/xapi/adl/verbs/...), and the Rooster profiles’ own identifiers (https://rooster.systems/xapi/...), whose definitions are bundled in data/xapi-profiles/.

Privacy

Rooster LRS stores the learning records that authorised applications send: xAPI statements and documents. A statement names a learner by the identifier the sending application chose (an e-mail address, a hashed e-mail address, an OpenID or an account) and describes an activity and its result. Records stay until the site owner deletes them, a person’s records are erased, or the retention period set under LRS → Settings ends. Nothing is sent to other services. The plugin adds suggested text to the privacy policy guide and registers a personal-data exporter and eraser.