What Is AS2 (Applicability Statement 2)?
Also known as: AS2 protocol, AS2 EDI, AS2 MDN, EDIINT AS2
Definition
AS2 is an internet protocol for exchanging EDI and other business documents directly between trading partners over HTTP or HTTPS. It adds digital signatures, encryption and a signed receipt called an MDN, so each side can prove delivery.
AS2 (Applicability Statement 2) Explained
AS2 is defined by the IETF EDIINT work (RFC 4130). Each partner runs an AS2 endpoint with a public URL, an AS2 identifier, and a certificate. The sender wraps the EDI file in a MIME message, signs it with its private key, encrypts it with the receiver's public key, and posts it over HTTP or HTTPS. The receiver decrypts, verifies the signature and returns a Message Disposition Notification (MDN).
The MDN is the key feature. It is a signed receipt that proves the receiver got the exact content, which supports non-repudiation. It can be returned synchronously in the HTTP response or asynchronously to a second URL. Sync is simpler through firewalls, while async is more tolerant of slow processing.
Compared with a value-added network (VAN), AS2 is a direct point to point link. There is no per-character VAN fee, but each partner needs a reachable endpoint, certificate exchange and renewal, and monitoring. Many suppliers therefore use a hosted EDI provider that runs the AS2 endpoint for them and hands the ERP a clean file or API call.
The ERP side is usually indirect. Infor SyteLine, NetSuite and Infor LN do not terminate AS2 themselves. They exchange flat files, XML or API calls with an EDI translator or provider, which in turn speaks AS2 with the partner. A manufacturer running on-prem can host the AS2 software inside its own network, behind a DMZ.
Why It Matters
- AS2 is a standard requirement for large retailers and many OEM supply chains, so a supplier without it can lose business.
- Signed MDN receipts give legal proof of delivery for orders, ASNs and invoices.
- Direct AS2 can cut VAN transaction fees at higher volumes, at the cost of managing certificates and uptime.
- Expired certificates and changed partner IPs are the most common cause of silent EDI outages.
In Practice
A supplier moves from a VAN to direct AS2 for a retail customer. It exchanges public certificates, agrees AS2 IDs, opens an inbound HTTPS port through the DMZ and sets a synchronous signed MDN. A test 850 is received and the MDN returns with a processed status. Eleven months later the customer's certificate expires and ASNs begin failing, so the supplier adds a certificate expiry alert to its monitoring.
Frequently Asked Questions
What is an MDN in AS2?
A Message Disposition Notification, the signed receipt the receiver returns to prove it got the message intact.
Is AS2 better than SFTP for EDI?
AS2 adds built-in signing and a signed receipt, which SFTP does not. SFTP is simpler to run, and many partners accept it when they do not require proof of delivery.
Do I need a VAN if I use AS2?
Not for AS2 partners, since the exchange is direct. Some companies keep a VAN for partners who do not support AS2.
Can my ERP speak AS2 directly?
Usually not. The ERP exchanges files or API calls with an EDI translator or hosted provider, which runs the AS2 endpoint.
Related Terms
EDI (Electronic Data Interchange)
EDI (Electronic Data Interchange) is the computer-to-computer exchange of business documents such as purchase orders, invoices, and shipping notices between trading partners in a standardized structured format, without human intervention.
EDI 850 Purchase Order
The EDI 850 is the ANSI X12 transaction set used to transmit a purchase order electronically from a buyer to a supplier, carrying header terms, ship-to and bill-to parties, and line item details such as quantity, price, and product identifiers.
EDI 856 (Advance Ship Notice)
The EDI 856 is the X12 transaction set a supplier sends to a customer before a shipment arrives. It lists what is in the shipment, how it is packed and labeled, and which purchase order lines it fulfils, so the receiver can plan dock work and receive by scan.
Middleware
Middleware is software that sits between applications and handles the communication, transformation, routing, and reliability concerns of moving data between them, so that the applications themselves do not need to know about each other directly.
API (Application Programming Interface)
An API (Application Programming Interface) is a defined contract that lets one software system request data or trigger functions in another, specifying the available operations, the structure of requests and responses, and the rules for authentication and error handling.
Working with AS2 (Applicability Statement 2) in a live environment? Our engineers do this every day - and our AI agents automate most of it.