# Amadeus > Amadeus: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads flight status for the flights you name, airline and airport reference data, and flight orders by id from the Amadeus Enterprise APIs, read-only, inside your deployment. ## At a glance | Collector | Amadeus, version `1.0.0` | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | Amadeus IT Group: Amadeus Enterprise APIs: flight status, reference data, flight orders ([the vendor's documentation](https://developers.amadeus.com/enterprise)) | | Family | Aviation | | Kind | Flights | | Ways to connect | OAuth approval | | Scopes | - Read: | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | No | | Personal data | Travel, Identity, Contact | | Hosts it may contact | `test.api.amadeus.com`, `api.amadeus.com`, `{environment}` | | Vendor API versions | Authorization v1, On-Demand Flight Status v2, Airline Code Lookup v1, Airport and City Search v1, Flight Order Management v1 | | Lowest engine version | `0.46.0` | ## What it reads - **Flights:** dated flight status (`GET /v2/schedule/flights`) for each flight you name, for every day from `days_back` (0 to 7, default 1) to `days_ahead` (0 to 14, default 2). One record per flight and date. - **Airlines:** reference data by airline code (`GET /v1/reference-data/airlines`), 20 codes to a request. - **Locations:** airports found by keyword (`GET /v1/reference-data/locations`), paged by `meta.links.next`. - **Orders:** flight orders by id (`GET /v1/booking/flight-orders/{id}`). An order that answers 404 is gone: its record is withdrawn. - It reads only what you name; it never lists bookings. The Altéa and NDC enterprise APIs (reservations, departure control, inventory and schedules, NDC orders) are separate collectors that need onboarding. ## How to connect 1. Get the API key and secret your Amadeus account manager issued (client credentials). Amadeus closed its self-service portal on 17 July 2026; enterprise keys reach the same endpoints. 2. In LightHouse, open **Setup and admin, Connectors**, choose **Amadeus**, and leave the access level at **Read**. 3. Name the **environment** (`test` or `production`) and what to read: `flights` (for example `XX487`), `airlines`, `locations`, `orders`. 4. Paste the key and then the secret. Your browser seals them to your deployment, which keeps them and hands them to the collector as `AMADEUS_CLIENT_ID` and `AMADEUS_CLIENT_SECRET` (settable per source as `client_id_env` and `client_secret_env`). ## Permissions - The collector requests no scope. It uses the grant the key has and refuses a token whose scope names a write (create, update, delete, cancel, book, issue, ticket, check-in, manage, admin, `*`); the credential check answers `scope_missing` and names the scopes. - It sends `GET`, and one `POST`: the OAuth token request to `/v1/security/oauth2/token`. The flight order API documents `DELETE` (cancel); no call here sends it. - Your deployment refuses to store this credential at read and write. - The read-only test proves it on every change by driving the real HTTP client through a recorder. ## Limits - Only two hosts are contacted: `test.api.amadeus.com` and `api.amadeus.com`. The environment you choose picks one; there is no third. - None of these APIs offers changed-since. Each run reads the whole window again, and a record whose content has not changed is left untouched, so a run costs requests, not writes. - Requests are paced at 0.2 s by default; `429` and `5xx` are retried with backoff and `Retry-After`. - A location search stops after `max_pages` pages (50 by default), 50 results to a page. - Amadeus does not state rate limits in the specifications it published, and the portal that did is closed. ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight order or a traveller. - Flight orders carry traveller names and contact details; they stay in your deployment. By default travel document numbers, dates of birth and health or disability special service requests (MEDA, WCHR, BLND and the rest of the IATA health set) are left out before a record is written. `exclude_fields` adds paths (for example `**.contact`); `keep_fields` takes a default back by its exact name. - Nothing is cached raw: a raw cache would keep on disk the fields the exclusion removes. - A failure names the host and the status, never the URL, because a URL can carry an order id. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------------ | ------------------------------------------ | ---------------------------------------------------------------------------------------------------- | | `credential variable 'AMADEUS_CLIENT_ID' is not set` | The deployment has not been given the key | Connect the credential again, or set the variable | | `POST test.api.amadeus.com: HTTP 401` | Amadeus refused the key and secret | Check the environment (a test key does not work on production) and that the key has not been revoked | | `the credential grants writes; this release reads only: ...` | The token’s scope names a write | Ask the account manager for a key limited to reading | | `GET api.amadeus.com: HTTP 429` | Amadeus is rate-limiting after the retries | Name fewer flights, or read less often | | `environment is test or production` | Any other value | Choose one of the two | | `name what to read: flights, airlines, locations or orders` | Nothing was named | Name at least one | | `not a flight designator (carrier code, number): ...` | A flight is not like `XX487` or `XX487A` | Correct the designator | | `days_back is 0 to 7 and days_ahead 0 to 14` | The window is too wide | Narrow it | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | Authorization v1, On-Demand Flight Status v2, Airline Code Lookup v1, Airport and City Search v1, Flight Order Management v1 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/amadeus/