One thesis: the commercial API economy is SKU-native and address-native — GS1 identity exists at its edges and is optional free text in its middle — so any architecture that assumes GTINs on ingest is assuming a fact the field measurably does not supply.
This is a data post. We surveyed 37 commercial API surfaces — ecommerce, parcel, freight visibility, WMS/3PL, ERP, POS, regulatory SaaS, standards rails — reading the actual API documentation for each, and recorded three things per system: its GTIN story, its GLN story, and its SSCC/lot story. If you run a platform team and have to defend an identity-bridging layer to an architecture review, this table is the defensibility artifact.
The finding, stated flat
GS1 identity lives at three edges: the ERP top end, the regulated verticals, and the standards rails. In the commercial middle — where your orders, shipments, and inventory actually flow — it is absent, or free text, or the wrong grain. The headline census: zero of the commercial APIs surveyed carry SSCC. Two carry GLN.
| System | GTIN story | GLN | SSCC / lot |
|---|---|---|---|
| Shopify | ProductVariant.barcode — free text, "barcode, UPC, or ISBN"; present iff merchant hygiene | none | none |
| WooCommerce | global_unique_id (WC 9.2+) — absent from order line items | none | none |
| Amazon | strongest bridge in the field: immutable externally-assigned product id + catalog search by GTIN — a GTIN is required to list, absent exemption | party-shaped vendor codes, not GLN | none |
| EasyPost / Shippo / ShipEngine | none — customs lines carry HS codes and sku only | none | none |
| FedEx | GTIN on Ship commodity; Ground accepts SSCC-18 "00" labels | none | label acceptance only |
| UPS | none | none | none |
| project44 / FourKites / Flexport | none — container, B/L, booking refs | none | none |
| ShipBob | gtin + upc + barcodes[] — best WMS in the survey | address-only | lot; no SSCC |
| NetSuite | item upccode — UPC grain, not GTIN-14 | none native | native lot/serial |
| SAP S/4 | EAN11 + per-UoM GTINs | Business Partner GLN, uniqueness-checked | batch/serial native |
| D365 BC | item.gtin in the standard API | GLN in base app, not in the API payload | lot/serial |
| QuickBooks / Xero | none — Sku / Code only | none | none |
| Square / Toast | upc (12–14 digit) / none | none | none |
| Vertical SaaS (FSMA/DSCSA cohort) | GTIN native | GLN native | lot native; SSCC in the DSCSA pair |
| Peppol / UBL / GS1 XML | GTIN at line level, standard | GLN as endpoint scheme (EAS 0088) | SSCC in despatch structures |
Every row is verifiable against the vendor's own published API reference; the survey deliberately excludes anything login-walled from the verified set rather than guessing.
Three failure classes, three verbs
The gap is not uniform, and the repair is not one tool. The rows sort into three classes, each mapping to a specific verb:
Absent identity — parcel APIs, QuickBooks, Xero, Toast: no product-identity field at all. The transaction record names a tracking_number and a free-text line item. The repair is bridge: SKU, vendor code, or free text in; ranked GTIN candidates out, each carrying its evidence, with a confidence floor below which the honest answer is exit code 1 — no candidate. The strongest evidence rail is the one the table shows: a marketplace that requires GTINs to list is a de-facto SKU↔GTIN oracle.
Free-text identity — Shopify's barcode, NetSuite's upccode, Square's upc: a field exists, and nothing validates it. Free-text fields lie: transposed digits, UPC-12 stuffed where GTIN-14 belongs, an ISBN in the barcode column. The repair is verify — checksum, structure, prefix legitimacy from pinned tables — run at the connector boundary, locally, on every value before it is trusted. This half is pure computation and free.
Wrong-grain identity — the WMS tier: a upc on the each, package-unit and pallet-unit UPCs proprietary to the platform, lot present, SSCC absent. The repair is hierarchy: the each/inner/case/pallet graph, with licensed edges labeled licensed and inferred edges labeled inference — because an API that manufactures certainty about packaging levels it derived from an indicator digit is lying with structure.
And one class has no API repair at all: SSCC comes from EDI, not from APIs. No commercial API in the survey emits logistic-unit identity; the 856/DESADV rail is where it lives — which is the previous post's territory, on transactions.dev's side of the family.
Why the fix belongs in a neutral layer
The tempting architecture is to patch identity inside each connector — a barcode-cleanup function in the Shopify sync, a UPC-pad in the NetSuite adapter. Measured against the table, that is N re-implementations of the same three repairs, each drifting independently, none carrying evidence. The defensible architecture puts one identity layer at the boundary: every inbound identifier is resolved and verified against pinned public tables; every bridged candidate carries its evidence and confidence; every record that crosses is graded — GTIN-grade, SKU-grade, tracking-grade — so every downstream consumer knows the join strength instead of assuming it. Grading is the honest-conformance posture applied to identity: a compiled record that says this join is SKU-grade is worth more in an audit than one that silently promoted a free-text field.
The pure half — resolve and verify on every identifier in every row above — runs locally today, no account, no network. The connector-boundary half — bridge, hierarchy, the evidence rails — is the gated network capability; if the table above is your ingest reality, describe your stack to us — the survey asks which connectors your stack actually runs today, and the answers sequence the gated build. Bring this table to the architecture review either way. The finding holds whether or not you buy anything from us: the API economy will not hand you GS1 identity, and the system that admits that in its design is the one that survives contact with the data.
Keys open the network half of the verb set. Get an API key — say what arrives at your door, and the provisioning order follows the list.
We answer in writing. We take at most five conversations a month, only when you ask for one, and only after you already have the written read.