# Almost nothing on the wire carries a GLN — the identifier gap is the product

> transactions.dev · by visibility.cloud — 2026-07-31
> Written for the supply-chain ISV / traceability-vendor engineering org — the VP Engineering weighing what an event-record product can honestly promise.

One thesis: **the commercial API economy is SKU-native and address-native —
across thirty-seven audited developer surfaces, zero commercial APIs carry
SSCC and exactly two carry GLN — so any product that joins business
documents onto GS1-grain event records must bridge identity at compile
time, and the bridging layer is not a feature of the product; on this
evidence, it is the product.**

## The census method

The claim is checkable because the method was narrow: primary sources
only — official developer portals, API references, webhook documentation,
published standards — audited on 2026-07-30/31, one citation per cell,
with anything unverifiable behind a login wall flagged as unverifiable
rather than inferred. The question per surface was the same: what does
the API actually put on the wire for *what* (GTIN), *who/where* (GLN),
logistic unit (SSCC), and batch (lot)?

## The findings, category by category

**Ecommerce** is barcode-optional and party-blind. Shopify's
`ProductVariant.barcode` is documented as "barcode, UPC, or ISBN" —
free text, present exactly when merchant hygiene put it there.
BigCommerce ships explicit `gtin` and `upc` fields; WooCommerce added
`global_unique_id` (WC 9.2+) but doesn't expose it on order line items;
eBay carries `upc`/`ean`/`isbn` arrays. Party identity is free-text
addresses on every platform — no GLN exists anywhere in the category.
The consequence for what an ecommerce-sourced record can claim is
[its own post](/blog/ecommerce-has-no-invoice-object/).

**Amazon** is the category's exception and the bridge: listings carry an
immutable `externally_assigned_product_identifier` (UPC/EAN/GTIN), and
because a GTIN is required to list, the catalog is a de-facto free
SKU↔GTIN oracle — [a connector and an identifier bridge at once](/blog/amazon-vendor-api-is-edi-in-rest/).

**Parcel** is the poorest tier: `tracking_number` plus `carrier`, HS codes
at the customs line, and nothing else — no GTIN, no GLN, no SSCC across
EasyPost, Shippo, and ShipEngine. UPS likewise; FedEx is the near-miss,
with GTIN on Ship commodities and SSCC-18 *label acceptance* on Ground —
an acceptance, not a data feed. Hence
[the evidence-not-record law](/blog/delivered-webhook-is-evidence/).

**Freight** speaks its own open identifiers — ISO 6346 container numbers,
booking and transport document references, UN/LOCODE — which bridge to
GLN rather than carry it. The open-standards story there is
[DCSA's](/blog/dcsa-ebl-compiles-to-bol/).

**WMS/3PL** has real lot grain and no GS1 place grain: ShipBob is
[the product-identity standout](/blog/shipbob-wro-is-a-receiving-advice/)
(`gtin`, `upc`, `barcodes[]`, lot fields); Extensiv carries lot, expiry,
serial, and a proprietary pallet identifier. But **no WMS in the audit
exposes GLN or SSCC — facility identity is address-only everywhere** in
the tier.

**ERP** is where GS1 identity actually lives, and only at the top: SAP's
material master carries `MARA-EAN11` plus per-UoM GTINs in `MEAN`, and
its Business Partner GLN field enforces uniqueness — the strongest
posture in the audit,
[detailed in the SAP post](/blog/sap-still-speaks-idoc/). Business
Central puts [`item.gtin` in the standard API](/blog/business-central-gtin-standard-api/),
with GLN fields in the base app but not the API payload. NetSuite carries
a UPC-grain `upccode`. QuickBooks and Xero carry a bare SKU — nothing
else.

**The standards rails** invert the whole picture:
[Peppol addresses participants by GLN](/blog/peppol-puts-a-gln-on-the-envelope/)
as a first-class endpoint scheme (ISO 6523 code 0088) and carries GTIN at
line level; UBL and GS1 XML/EANCOM are
GTIN/GLN-native by construction; GDSN is the GTIN attribute source of
truth, subscriber-gated.

## The two numbers to memorize

Compress the audit to its hardest pair of facts:

- **SSCC on the wire: zero commercial APIs.** Logistic-unit identity in
  2026 comes from the EDI rail — the
  [856/DESADV's MAN and packaging segments](/blog/the-856-is-already-an-aggregation-tree/) —
  or it does not come at all.
- **GLN on the wire: two commercial APIs** (SAP, and Business Central's
  base app off-payload), plus the standards rails.

Why does the gap exist? Because nothing in the checkout-and-address-book
era required more. A SKU disambiguates within one merchant; an address
gets a package delivered. Identity only has to be *shared and validated*
when independent parties join records about the same physical things —
which is precisely what an event record does, and why the gap went
unnoticed until now.

## The consequence: resolve, don't demand

An event layer that demands GS1-clean input would exclude nearly every
system its customers actually run. The audit dictates the opposite
posture, in four rules:

1. **Compile without GTIN on day one.** CBV permits non-GS1 URIs for
   transaction, party, and location identifiers, so SKU-native input
   compiles to valid, conformant records under tenant-scoped URIs —
   upgraded in place when GS1 identity arrives. Identity absence never
   blocks capture.
2. **Maintain the SKU↔GTIN crosswalk as an asset**, populated
   opportunistically — merchant barcode fields, the Amazon oracle, WMS
   and ERP item masters — and checksum-validate everything, because
   free-text fields lie.
3. **Bridge parties from address grain to GLN grain** through a
   customer-supplied party master and address normalization — the
   resolution layer [barcoding.dev](https://barcoding.dev) owns in this
   family, feeding [the §7.4 source and destination joins](/blog/n1-loops-are-your-sourcelist/).
4. **Grade every join.** Each compiled reference carries an identity
   grade — GTIN-grade, SKU-grade, tracking-grade — so a
   [reconcile verdict](/blog/reconcile-is-a-verdict/) or an
   [executive answer](https://visibility.cloud/asn-po-context-in-traces)
   states its own evidentiary strength. Honest conformance, applied to
   identity.

## The build-vs-buy reading

For a VP Engineering, the census is the cost model. The join itself —
documents onto events — is
[core-spec machinery](/blog/biztransaction-is-a-core-field/) your team
could build. The bridging is the part that never finishes: a crosswalk
that decays as catalogs churn, per-connector identity quirks (this audit
is thirty-seven surfaces deep and the tail is long), validation rules,
grading policy. That maintenance tax is the actual product decision, and
it is the layer this site exists to carry so your roadmap doesn't.

Which surfaces are in your stack? [Walk through the list with us](/get-access/) —
the access flow asks which systems hold the records and what their
barcode fields actually carry, because the bridge gets built one
verified surface at a time.

---
Access: https://transactions.dev/get-access/ · All posts: https://transactions.dev/blog/ · Machine face: https://transactions.dev/llms.txt