GA4GH Standards Explained: Passports, Beacon, DRS & WES
The Global Alliance for Genomics and Health (GA4GH) standards are open technical specifications that let genomic and health data systems work together across organizations. Four of them do most of the work in federated research: Passports carry a researcher’s data access permissions, Beacon answers discovery questions such as “do you have any individuals with this variant?”, the Data Repository Service (DRS) gives every data object a stable, location-independent address, and the Workflow Execution Service (WES) lets an approved analysis run wherever the data sits.
Why GA4GH standards matter now
GA4GH was founded in 2013 as an international, nonprofit alliance to set standards for responsible genomic data sharing. Its standards are developed by work streams drawing on contributors from research institutions, national genomics programs, healthcare systems, and industry, and they are tested against real deployments through driver projects before approval.
The case for them has grown stronger. National genomics programs are sequencing at population scale, data residency rules restrict where genomic data can be stored and processed, and regulations such as the European Health Data Space require secondary use of health data to happen in secure processing environments. Pooling everything into one repository is increasingly impractical and often unlawful. Research has to reach data where it is held, which only works if systems in different countries and organizations agree on how to describe permissions, find data, address files, and run analyses. That is the job of the GA4GH standards. Our overview of why genomics data sharing is still broken explains the underlying problem.
The four core standards
Passports: who is allowed to see what
GA4GH Passports, part of the GA4GH Authentication and Authorization Infrastructure (AAI), express a researcher’s data access permissions as digitally signed, machine-readable claims called visas. A visa might state that the researcher’s identity has been verified by their institution, that they are a bona fide researcher, or that a data access committee has approved them for a specific dataset. A data system receiving a request can check the passport and its visas at the moment of access rather than maintaining its own copy of every approval. Permissions can carry expiry dates, so access ends when a project ends. Passports pair naturally with the GA4GH Data Use Ontology (DUO), which codes the conditions attached to a dataset, such as “health or medical research only” or “not for commercial use.”
Beacon: is the data there?
Beacon began as a simple discovery protocol: a data holder answers yes or no to whether it holds a particular genomic variant. Beacon v2, approved by GA4GH in 2022, extends this to richer queries that can include phenotypic and clinical filters and can return counts or records depending on the access level the data holder allows. Beacon lets researchers find relevant datasets across many organizations before they request access, without the data holder exposing records. Data holders choose how much a Beacon reveals, and a yes or no answer can still carry risk, so public Beacons are typically combined with safeguards against repeated probing.
DRS: where is the data, and how do I get it?
The Data Repository Service defines a standard API for resolving a data object identifier to its metadata and access methods. A workflow can reference a file by a DRS identifier rather than by a cloud bucket path, and the repository decides how and where the file is served. This decouples analysis code from storage location, which matters when the same pipeline must run in several clouds or countries.
WES: run this analysis over there
The Workflow Execution Service defines a standard API for submitting a workflow, written in a language such as WDL, CWL, or Nextflow, to a remote execution service, monitoring it, and retrieving outputs. It is the standard that makes “send the analysis to the data” a routine operation instead of a custom integration. The related Task Execution Service (TES) handles individual compute tasks, and the Tool Registry Service (TRS) lets tools and workflows be shared and discovered.
Other GA4GH standards worth knowing
htsget streams slices of large genomic files, such as reads in a region of interest, without transferring whole files. refget identifies reference sequences by checksum. Crypt4GH is a file encryption format for genomic data at rest and in transit. Phenopackets, also published as ISO 4454:2022, is a schema for exchanging phenotypic and clinical information about individuals. The Variation Representation Specification (VRS) gives genomic variants precise, computable identifiers.
The Federation angle: standards describe the interfaces, architecture decides where data sits
GA4GH standards are necessary for federation but not sufficient. A standard API can front a centralized repository just as easily as a distributed one. DRS can return a signed URL that lets a researcher download a file; WES can execute a workflow in an environment where outputs flow freely. The standards define how systems talk; they do not define whether data leaves its home.
A federated Trusted Research Environment supplies that missing guarantee, because in a federated TRE the data never leaves the source. Each custodian runs its own secure node, analyses are dispatched to the node, and only results that pass an automated airlock return. In that model the GA4GH standards become the language of federation. Passports carry permissions to the node, which verifies them locally. Beacon-style discovery lets researchers find cohorts across nodes. DRS identifiers let a workflow refer to data without knowing where it is stored. WES-style execution sends the analysis to the data instead of the data to the analysis. Lifebit’s position is that federation is an architectural commitment, reinforced by US Patent 12,519,781, and that open standards are how that architecture connects to the rest of the ecosystem. The Lifebit Federated Trusted Research Environment page describes the platform.
GA4GH standards at a glance
| Standard | Question it answers | What it standardizes | Role in a federated TRE |
|---|---|---|---|
| Passports and AAI | Is this researcher allowed to access this data? | Signed visas describing identity and data access approvals | Carries permissions to each node for local verification |
| Data Use Ontology (DUO) | What uses does this dataset permit? | Machine-readable codes for data use conditions | Lets nodes match request purpose to consent terms |
| Beacon v2 | Does anyone hold data matching my criteria? | Discovery queries across genomic and phenotypic data | Cohort discovery before access is requested |
| DRS | Where is this data object and how is it accessed? | Location-independent identifiers and access methods | Workflows reference data without moving it |
| WES | Can this workflow run over there? | Remote workflow submission and monitoring | Sends analysis to the node holding the data |
| TES and TRS | How is a task run, and where are the tools? | Task execution and tool registries | Portable, versioned analysis components |
| htsget and Crypt4GH | How do I read part of a file securely? | Region streaming and file encryption | Efficient, protected access to large genomic files |
Real-world examples
ELIXIR, the European life sciences infrastructure, has supported Beacon deployments across many institutions, giving researchers a way to discover genomic data held in different countries. The European Genome-phenome Archive (EGA) uses GA4GH standards including htsget and Crypt4GH, and the Federated EGA model extends it so that national nodes hold sensitive data locally under their own jurisdiction while remaining discoverable through a shared system. Phenopackets has been adopted in rare disease research for exchanging structured phenotype data. In each case, the standard is what lets separate organizations present a coherent research resource without pooling their data.
A practical framework for adopting GA4GH standards
- Start with discovery. A Beacon, or aggregate discovery of equivalent function, gives researchers visibility of your data with low disclosure risk and high return.
- Code your data use conditions with DUO. This is cheap, makes access decisions more consistent, and prepares you for automated permission matching.
- Adopt Passports for access. Accept visas from trusted issuers so researchers do not need a separate approval process for every system.
- Address data through DRS. Remove hard-coded storage paths from pipelines so analyses become portable between environments.
- Expose execution, not downloads. Use WES-style execution inside a secure environment, with outputs controlled by an airlock, rather than serving files to researchers.
- Check conformance. Use GA4GH compliance tooling where available, and ask vendors which specification versions they implement.
Common pitfalls and objections
“Standards compliant” does not mean secure
A DRS endpoint that hands out download links is standards compliant and still moves data. Ask what happens after the API call: where the file ends up, who can copy it, and whether anyone reviews what leaves. Those answers come from the architecture behind the interface, not from the specification.
Version drift
GA4GH specifications evolve. Two systems claiming support for Beacon may implement different versions. Record versions explicitly.
Discovery leakage
Beacon responses can be probed repeatedly to infer whether a known individual is in a dataset. Apply access tiers, query limits, and monitoring.
Standards without governance
Passports carry approvals, but someone still has to grant them. Standards speed up governance; they do not replace data access committees. See how modern data access committees work.
What to do next
Audit your current systems against the table above and identify which questions they answer with proprietary interfaces. Prioritize discovery and DUO coding first, then Passports and DRS. Most importantly, decide where analysis will run: pair GA4GH interfaces with a federated architecture so that the standards connect you to the ecosystem without moving your data.
Frequently asked questions
What is GA4GH?
The Global Alliance for Genomics and Health is an international, nonprofit alliance founded in 2013 that develops open technical standards and policy frameworks for responsible sharing of genomic and health data.
What is a GA4GH Passport?
A Passport is a bundle of digitally signed claims, called visas, that describe a researcher’s identity and data access approvals. Data systems check the passport at the time of access instead of keeping their own copy of every approval.
What is the difference between Beacon and DRS?
Beacon is for discovery: it answers whether a data holder has data matching certain criteria. DRS is for access: it resolves a data object identifier to its metadata and the methods for accessing it.
What does WES do?
The Workflow Execution Service is a standard API for submitting a workflow to a remote execution service, tracking it, and retrieving results. It makes sending an analysis to the data a routine operation.
Do GA4GH standards guarantee that data stays in place?
No. They standardize interfaces, not architecture. A federated TRE, where analyses run at each custodian and only reviewed results leave, provides that guarantee, with GA4GH standards as the interfaces between systems.
Is Phenopackets a GA4GH standard?
Yes. Phenopackets is a GA4GH schema for exchanging phenotypic and clinical data about individuals, and it has also been published as the international standard ISO 4454:2022.