What ONE Record is
ONE Record is IATA’s data-sharing standard for air cargo, designed to replace the flat-file Cargo-IMP world (FWB, FFM, FSU, FHL) with a single shared data model accessed over REST and serialised in JSON-LD.
Instead of every party shipping messages back and forth, every party publishes and consumes LogisticsObjects — structured resources for shipments, pieces, transport movements, parties, events — that link to each other through a shared ontology. A handler doesn’t receive an FWB; it reads (or subscribes to) the Shipment resource the forwarder published.
The 2.2.0 release of the spec landed in 2024 and is the version production deployments are conforming to today.
Why it matters
Three reasons handlers should care, in increasing order of importance:
-
Less protocol surface area. One JSON-LD shape across every party, not seven different Cargo-IMP message types.
-
Real-time by default. Subscriptions push notifications when a resource changes, instead of every party polling for FSUs.
-
Ontology-grounded data. A
Pieceis the same thing whether the forwarder created it or the handler updated it — no dialect drift, no per-carrier translation layer, no field-by-field reconciliation. Disputes about who knew what when are answered by reading the version history of the resource.
The catch: the value compounds only when both sides of every interface speak ONE Record. That is happening, but unevenly — which is why every serious handler needs Cargo-IMP and ONE Record running side by side for the next several years.
Concrete example: the e-CSD
A useful illustration of the ontology-grounded approach is the electronic Customs Security Declaration. In Cargo-IMP the e-CSD rides inside the OCI segment of the FWB — a loose key-value bag that’s hard to validate, hard to query, and impossible to share selectively. In ONE Record the spec defines a dedicated SecurityDeclaration Logistics Object with named properties for each of the 15 e-CSD boxes (securityStatus, regulatedEntityIssuer, screeningMethods, issuedOn, issuedBy, etc.) linked to the Shipment via the securityDeclaration property.
The result: a customs auditor can subscribe to changes on the SecurityDeclaration only, with OAuth2-bounded scope, and get HMAC-signed notifications when the security status changes — without any access to the rest of the shipment. That selective-sharing-with-audit-trail story is exactly what messaging cannot do. See the e-CSD primer for the full field-by-field mapping.
What’s in the 2.2.0 spec
The pieces a handler implementation has to care about:
| Capability | What it is |
|---|---|
| LogisticsObjects | The core resources: Shipment, Piece, TransportMovement, Party, ULD, Booking, etc. JSON-LD with @id URIs |
| Logistics Events | Append-only events attached to objects — status changes, scans, transitions |
| Action Requests | Asynchronous requests one party makes against another’s resources (e.g. “please update the status to RCS”) |
| Subscriptions | Webhook-style push notifications when a resource changes; bearer-authenticated, HMAC-signed |
| Access Delegations | OAuth2-grounded delegation so party A can let party B act on its resources |
| Notifications | The wire format for change events; JSON-LD over HTTPS POST |
| Well-known document | /.well-known/one-record for service discovery |
The spec also defines the data ontology — what fields a Shipment has, how a Piece relates to a ULD, how transport movements compose — via a published OWL ontology.
What Skidd ships today
The Skidd ONE Record server is in early-access beta (targeting 2.2.0; not yet spec-conformant). Per Skidd tenant you get:
- A discoverable server at
/.well-known/one-recorddescribing capabilities and authentication LogisticsObjectsendpoints — GET, POST, PATCH — for every supported resource typeLogistics Eventsfor append-only event capture and replayAction Requestsso partners can request state changes or data updatesSubscriptionsso partners can subscribe to specific resources or types and receive HMAC-signed webhook notifications when they changeAccess Delegationsfor OAuth2-bearer interop with partner servers- Bearer-token authentication on all reads and writes; per-token scope enforcement
What’s not yet in production:
- The client side — outbound consumption of partner ONE Record servers is scaffolded but the full bidirectional bridge is on the roadmap (Phase E in our internal sequencing). For now, partners consume Skidd; Skidd consumes partners via Cargo-IMP.
- CargoXML as a parallel transport — on the messaging roadmap behind the public Open API.
How a partner consumes Skidd
A typical integration:
- Discover. GET
https://<tenant>.skidd.io/.well-known/one-record. Read supported types, auth endpoints, subscription URL. - Authenticate. OAuth2 client-credentials flow against the auth endpoint. Receive a bearer token scoped to your delegation.
- Query. GET specific LogisticsObjects (
/logistics-objects/{id}) or list (/logistics-objects?type=Shipment&since=...). JSON-LD response. - Subscribe. POST a
Subscriptiondescribing which resources you want change events for and your callback URL. Skidd POSTs HMAC-signed notifications when things change. - Act. Submit
Action Requeststo ask Skidd’s tenant to do something on the resource (e.g. “please update piece-12’s status to FOH”).
A partner that already speaks ONE Record can be live against a Skidd tenant in an afternoon, not a month.
What’s genuinely hard about implementing ONE Record
Three things that make ONE Record server implementations hard, all of which Skidd has solved — saying so explicitly because they are easy to overlook:
-
JSON-LD is not just JSON.
@context,@id,@typematter. A server that emits JSON without proper LD framing breaks the consumer’s graph parser. Skidd emits LD-framed responses with the IATA-published context. -
Subscriptions need exactly-once-ish delivery. Skidd retries on failure with exponential backoff, signs every notification with HMAC, includes a sequence number per subscription so consumers can detect gaps, and surfaces delivery health back to the partner that owns the subscription.
- Access Delegations are real OAuth2, not a checkbox. Token issuance, token refresh, scope enforcement, revocation, and audit are all production concerns. Skidd uses Supabase’s auth infrastructure for the OAuth2 layer and treats every delegation as auditable.
Where to go from here
If you’re a handler evaluating whether to switch from a Cargo-IMP-only platform: you don’t. You add ONE Record alongside. Both will run for years. Skidd ships both because that’s the honest state of the industry.
If you’re a partner integrating into Skidd over ONE Record: hit /.well-known/one-record on a tenant URL and the rest is documented inline.
For the protocol itself, IATA publishes the spec at iata.org/one-record and the ontology in OWL form on the IATA developer portal.