SCORM vs xAPI vs LTI 1.3: what each does in an LMS

What is the difference between SCORM, xAPI and LTI?

SCORM moves a finished course between systems: the LMS plays it and records completion and score. xAPI records what people did, in or out of an LMS, and stores it in a Learning Record Store. LTI 1.3 connects two live systems, so a learner opens a tool or course from inside another platform and the grade can come back.

SCORM and xAPI come from the Advanced Distributed Learning (ADL) Initiative, a US Department of Defense effort founded in 1997 to modernise how training is managed and delivered. LTI is a standard of 1EdTech, a member-led nonprofit consortium. None of them handles sign-in or user accounts; that is the job of SSO and SCIM, covered further down.

What does SCORM do?

SCORM (Sharable Content Object Reference Model) is a set of rules for packaging web-based e-learning so it runs in any SCORM-conformant LMS. The course travels as a package. The LMS launches it, the content talks to the LMS through an API in the web page, and the LMS records results such as status and score in SCORM’s fixed data model.

SCORM has been in use since 2000, and two versions are still common: SCORM 1.2 and SCORM 2004, whose latest edition is the 4th. ADL describes SCORM as well established and accepted in many organisations as the interoperable way to deliver and track web-based content.

Where does SCORM fall short?

SCORM assumes a web page, an LMS and one learner at a time. ADL lists the gaps itself in its xAPI profile for SCORM, and they explain why xAPI exists. If your training happens only in courses inside an LMS, they may not matter. If it happens in simulators, apps, workshops or on the job, they will.

• Content must be managed and launched by an LMS, which rules out games, virtual worlds and simulators
• The API lives in a web page, so mobile apps and other non-web content have no defined way to report
• The data model is fixed: things like how often someone paused a video don’t fit
• It tracks one learner, so group work and data about instructors and peers can’t be recorded
• There is no standard way to get data back out of the LMS, so reporting differs from vendor to vendor

What does xAPI add, and what is an LRS?

xAPI (the Experience API) records learning as statements of the form “I did this”: an actor, a verb and an activity, such as “Hannah completed the fire-safety module”. Statements go to a Learning Record Store (LRS), a server that receives, stores and gives access to learning records. The activity can happen in an LMS, an app, a simulator or offline.

Many tools were built on xAPI 1.0.3. ADL now lists xAPI 2.0 as the current version, and IEEE published the data model and web service as IEEE 9274.1.1-2023 in October 2023. If you buy an LRS or an LMS that sends xAPI, ask which version it speaks, because the two must match.

The flexibility has a cost. Any verb is allowed, so two tools can describe the same event differently, and reports only make sense when everyone uses the same vocabulary. That is why ADL publishes profiles, such as one for reporting SCORM data as xAPI. xAPI also doesn’t say how a course is launched or when it counts as complete. cmi5 fills that gap.

Where does cmi5 fit?

cmi5 is a profile for using xAPI with a traditional LMS. It defines how the LMS launches each unit of content, how that content gets a one-time token to write to the LRS, a fixed set of verbs such as completed and passed, and a course package format. The current release is Quartz, 1st Edition, from June 2016.

In practice, cmi5 is the answer when you want LMS-launched courses, like SCORM, that report richer xAPI data. Check that your authoring tool, your LMS and your LRS all support it before you build a library on it.

What does LTI 1.3 do?

LTI (Learning Tools Interoperability) connects a platform, traditionally an LMS, to an outside tool, such as a test engine, a lab or a publisher’s content, so learners open it from inside a course without logging in again. LTI 1.3 secures each launch with OAuth 2.0, OpenID Connect and signed JSON Web Tokens, replacing the OAuth 1.0-style signing of earlier versions.

The launch alone only opens the tool. The useful parts are the LTI Advantage services built on 1.3’s security:

• Deep Linking: an author picks specific content in the tool and places a link to it in the course
• Assignment and Grade Services: the tool creates a gradebook column and posts scores back to the platform
• Names and Role Provisioning Services: the tool can read who is in a course and in what role

Is an LMS the LTI platform or the tool?

It can be either, and they are separate pieces of work. As a platform, your LMS opens outside tools. As a tool, it is opened by someone else’s LMS, which is how a training provider can deliver a course inside a client’s system. Ask a vendor which roles it supports and which Advantage services work in each.

LTI moves people and grades, not content. The tool keeps its own data, and the platform only sees what the services send back. 1EdTech recommends 1.3 over older versions because older security schemes, including OAuth 1.0 variations, have known risks.

How do SCORM, xAPI and LTI work together?

They work at different layers, so you combine them instead of choosing one. SCORM carries a finished course from one system to another. LTI links live systems so people move between them and grades flow back. xAPI collects the record of what people did, wherever they did it, in one store your analysts can query. A few common cases:

• A course from an authoring tool: import it as SCORM and let the LMS track completion and score
• A client whose LMS must run your course: offer it by LTI so learners stay in their system and grades come back, or send a SCORM export if they can’t use LTI
• A simulator, a lab or a coaching app: send xAPI statements to the same LRS your LMS writes to
• Company-wide reporting: have every system send xAPI to one LRS, instead of exporting a report from each

How do SSO and SCIM fit in?

Sign-in and provisioning decide who gets in, which the learning standards don’t cover. Single sign-on (SSO) lets people use their company account through SAML 2.0 or OpenID Connect. SCIM lets your identity system create, update and deactivate accounts and groups in the LMS, so access follows the directory instead of a spreadsheet.

SAML 2.0 is an OASIS standard from 2005: an XML framework in which an identity provider vouches for a user to a service provider. OpenID Connect is “a simple identity layer on top of the OAuth 2.0 protocol” that issues an ID token describing how the user signed in. SCIM 2.0 is defined by two IETF documents from September 2015: RFC 7643 for the user and group schema, and RFC 7644 for the HTTP protocol.

Which of SAML or OIDC you use usually depends on your identity provider and your IT team. The details matter more: whether you can require SSO for your email domain, what happens when someone signs in for the first time, and what deactivating a person in the directory does to their access and their training records.

What should you ask an LMS vendor?

Ask what each standard actually does in the product, in which direction and in which version, because vendor pages often list standards as logos. Then test the answers with your own course packages, your LRS and your identity provider before you sign anything.

• SCORM: which versions do you import, play and export? How do you handle a package with several parts, and SCORM 2004 sequencing rules?
• xAPI: can you send every learning event to our own LRS, in which version, and what happens when the LRS is down?
• xAPI content: do you accept statements from packages you play, and do you support cmi5?
• LTI: 1.3 as a tool, as a platform, or both? Which Advantage services work in each, and does an outside tool’s grade come back?
• SSO and SCIM: SAML, OIDC or both? Can we require SSO? Do you support SCIM 2.0 for users and groups, and what does deactivation remove?
• Evidence: if conformance matters to you, ask for the certification or test results, not a logo

How does Classbase handle these standards?

Classbase is designed to sit beside the systems you already run. It imports and plays SCORM 1.2 and 2004 packages as course cards, and exports a course as SCORM 1.2. It supports LTI 1.3 both ways: another LMS can open a Classbase course and get the grade back when it is completed, and Classbase can open outside tools as cards.

It can send each learning event as an xAPI 1.0.3 statement to your LRS, and it accepts statements from the content it plays. People sign in through OIDC or SAML 2.0 on your verified email domains, with an option to require SSO, and SCIM 2.0 keeps users and groups in step with your identity provider.

Some limits, so you can plan: when Classbase opens an outside tool, that tool’s own grade doesn’t come back yet, and cmi5 isn’t supported today. These features are built to the published standards; we don’t claim a conformance certification. The real test is your own packages and identity provider, and we’re happy to run it with you in a demo.