Almost nothing on the wire carries a GLN — the identifier gap is the product

Written for ED-1 — the supply-chain ISV / traceability-vendor engineering org — the VP Engineering weighing what an event-record product can honestly promise.

One thesis: the commercial API economy is SKU-native and address-native — across thirty-seven audited developer surfaces, zero commercial APIs carry SSCC and exactly two carry GLN — so any product that joins business documents onto GS1-grain event records must bridge identity at compile time, and the bridging layer is not a feature of the product; on this evidence, it is the product.

The census method

The claim is checkable because the method was narrow: primary sources only — official developer portals, API references, webhook documentation, published standards — audited on 2026-07-30/31, one citation per cell, with anything unverifiable behind a login wall flagged as unverifiable rather than inferred. The question per surface was the same: what does the API actually put on the wire for what (GTIN), who/where (GLN), logistic unit (SSCC), and batch (lot)?

The findings, category by category

Ecommerce is barcode-optional and party-blind. Shopify's ProductVariant.barcode is documented as "barcode, UPC, or ISBN" — free text, present exactly when merchant hygiene put it there. BigCommerce ships explicit gtin and upc fields; WooCommerce added global_unique_id (WC 9.2+) but doesn't expose it on order line items; eBay carries upc/ean/isbn arrays. Party identity is free-text addresses on every platform — no GLN exists anywhere in the category. The consequence for what an ecommerce-sourced record can claim is its own post.

Amazon is the category's exception and the bridge: listings carry an immutable externally_assigned_product_identifier (UPC/EAN/GTIN), and because a GTIN is required to list, the catalog is a de-facto free SKU↔GTIN oracle — a connector and an identifier bridge at once.

Parcel is the poorest tier: tracking_number plus carrier, HS codes at the customs line, and nothing else — no GTIN, no GLN, no SSCC across EasyPost, Shippo, and ShipEngine. UPS likewise; FedEx is the near-miss, with GTIN on Ship commodities and SSCC-18 label acceptance on Ground — an acceptance, not a data feed. Hence the evidence-not-record law.

Freight speaks its own open identifiers — ISO 6346 container numbers, booking and transport document references, UN/LOCODE — which bridge to GLN rather than carry it. The open-standards story there is DCSA's.

WMS/3PL has real lot grain and no GS1 place grain: ShipBob is the product-identity standout (gtin, upc, barcodes[], lot fields); Extensiv carries lot, expiry, serial, and a proprietary pallet identifier. But no WMS in the audit exposes GLN or SSCC — facility identity is address-only everywhere in the tier.

ERP is where GS1 identity actually lives, and only at the top: SAP's material master carries MARA-EAN11 plus per-UoM GTINs in MEAN, and its Business Partner GLN field enforces uniqueness — the strongest posture in the audit, detailed in the SAP post. Business Central puts item.gtin in the standard API, with GLN fields in the base app but not the API payload. NetSuite carries a UPC-grain upccode. QuickBooks and Xero carry a bare SKU — nothing else.

The standards rails invert the whole picture: Peppol addresses participants by GLN as a first-class endpoint scheme (ISO 6523 code 0088) and carries GTIN at line level; UBL and GS1 XML/EANCOM are GTIN/GLN-native by construction; GDSN is the GTIN attribute source of truth, subscriber-gated.

The two numbers to memorize

Compress the audit to its hardest pair of facts:

• SSCC on the wire: zero commercial APIs. Logistic-unit identity in 2026 comes from the EDI rail — the 856/DESADV's MAN and packaging segments — or it does not come at all.
• GLN on the wire: two commercial APIs (SAP, and Business Central's base app off-payload), plus the standards rails.

Why does the gap exist? Because nothing in the checkout-and-address-book era required more. A SKU disambiguates within one merchant; an address gets a parcel delivered. Identity only has to be shared and validated when independent parties join records about the same physical things — which is precisely what an event record does, and why the gap went unnoticed until now.

The consequence: resolve, don't demand

An event layer that demands GS1-clean input would exclude nearly every system its customers actually run. The audit dictates the opposite posture, in four rules:

1. Compile without GTIN on day one. CBV permits non-GS1 URIs for transaction, party, and location identifiers, so SKU-native input compiles to valid, conformant records under tenant-scoped URIs — upgraded in place when GS1 identity arrives. Identity absence never blocks capture.
2. Maintain the SKU↔GTIN crosswalk as an asset, populated opportunistically — merchant barcode fields, the Amazon oracle, WMS and ERP item masters — and checksum-validate everything, because free-text fields lie.
3. Bridge parties from address grain to GLN grain through a customer-supplied party master and address normalization — the resolution layer barcoding.dev owns in this family, feeding the §7.4 source and destination joins.
4. Grade every join. Each compiled reference carries an identity grade — GTIN-grade, SKU-grade, tracking-grade — so a reconcile verdict or an executive answer states its own evidentiary strength. Honest conformance, applied to identity.

The build-vs-buy reading

For a VP Engineering, the census is the cost model. The join itself — documents onto events — is core-spec machinery your team could build. The bridging is the part that never finishes: a crosswalk that decays as catalogs churn, per-connector identity quirks (this audit is thirty-seven surfaces deep and the tail is long), validation rules, grading policy. That maintenance tax is the actual product decision, and it is the layer this site exists to carry so your roadmap doesn't.

Which surfaces are in your stack? Walk through the list with us — the access flow asks which systems hold the records and what their barcode fields actually carry, because the bridge gets built one verified surface at a time.

---

937 words. The access flow is at /get-access/; the family's event door is epcis.dev.