AS4 (Applicability Statement 4) is an open standard for the secure and payload-agnostic exchange of Business-to-business documents using Web services. Secure document exchange is governed by aspects of WS-Security, including XML Encryption and XML Digital Signatures. Payload agnosticism refers to the document type (e.g. purchase order, invoice, etc.) not being tied to any defined SOAP action or operation.

It is a Conformance Profile of the OASIS ebMS 3.0 specification.^[1]

AS4 became an OASIS standard in 2013^[2] and an ISO standard in 2020.^[3] The majority of the AS4 profiling points constraining the ebMS 3.0 specification are based upon the functional requirements of the AS2 specification. By scaling back ebMS 3.0 using AS2 as a blueprint, AS4 provides an entry-level on-ramp for Web services B2B by simplifying the complexities of Web services.^[4]

Key technical highlights

• Support for SOAP 1.1 and 1.2 enveloping structure
• Payload agnosticism
• Support for single or multiple payloads contained either within the SOAP body or as SOAP attachment(s)
• Support for payload compression
• Support for message-level security including various combinations of XML Digital Signature and/or XML Encryption
• Support for X.509 security tokens and username/password tokens
• Support for business receipt of non-repudiation similar to the Message Disposition Notification (MDN)^[5] used by AS2 and specified as an XML schema by the ebXML BPSS group
• Support for the ebMS 3.0 One-Way/Push message exchange pattern with support for either synchronous or asynchronous responses
• Support for the ebMS 3.0 One-Way/Pull message exchange pattern which is beneficial for exchanging documents with non-addressable endpoints