Amadeus

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads flight status for the flights you name, airline and airport reference data, and flight orders by id from the Amadeus Enterprise APIs, read-only, inside your deployment.

At a glance

Collector	Amadeus, version 1.0.0
Reads	Amadeus IT Group: Amadeus Enterprise APIs: flight status, reference data, flight orders (the vendor's documentation)
Family	Aviation
Kind	Flights
Ways to connect	OAuth approval
Scopes	Read:
Read only	Yes, except: [object Object]
Vendor's API can move money	No
Personal data	Travel, Identity, Contact
Hosts it may contact	test.api.amadeus.com, api.amadeus.com, {environment}
Vendor API versions	Authorization v1, On-Demand Flight Status v2, Airline Code Lookup v1, Airport and City Search v1, Flight Order Management v1
Lowest engine version	0.46.0

What it reads

• Flights: dated flight status (GET /v2/schedule/flights) for each flight you name, for every day from days_back (0 to 7, default 1) to days_ahead (0 to 14, default 2). One record per flight and date.
• Airlines: reference data by airline code (GET /v1/reference-data/airlines), 20 codes to a request.
• Locations: airports found by keyword (GET /v1/reference-data/locations), paged by meta.links.next.
• Orders: flight orders by id (GET /v1/booking/flight-orders/{id}). An order that answers 404 is gone: its record is withdrawn.
• It reads only what you name; it never lists bookings. The Altéa and NDC enterprise APIs (reservations, departure control, inventory and schedules, NDC orders) are separate collectors that need onboarding.

How to connect

1. Get the API key and secret your Amadeus account manager issued (client credentials). Amadeus closed its self-service portal on 17 July 2026; enterprise keys reach the same endpoints.
2. In LightHouse, open Setup and admin, Connectors, choose Amadeus, and leave the access level at Read.
3. Name the environment (test or production) and what to read: flights (for example XX487), airlines, locations, orders.
4. Paste the key and then the secret. Your browser seals them to your deployment, which keeps them and hands them to the collector as AMADEUS_CLIENT_ID and AMADEUS_CLIENT_SECRET (settable per source as client_id_env and client_secret_env).

Permissions

• The collector requests no scope. It uses the grant the key has and refuses a token whose scope names a write (create, update, delete, cancel, book, issue, ticket, check-in, manage, admin, *); the credential check answers scope_missing and names the scopes.
• It sends GET, and one POST: the OAuth token request to /v1/security/oauth2/token. The flight order API documents DELETE (cancel); no call here sends it.
• Your deployment refuses to store this credential at read and write.
• The read-only test proves it on every change by driving the real HTTP client through a recorder.

Limits

• Only two hosts are contacted: test.api.amadeus.com and api.amadeus.com. The environment you choose picks one; there is no third.
• None of these APIs offers changed-since. Each run reads the whole window again, and a record whose content has not changed is left untouched, so a run costs requests, not writes.
• Requests are paced at 0.2 s by default; 429 and 5xx are retried with backoff and Retry-After.
• A location search stops after max_pages pages (50 by default), 50 results to a page.
• Amadeus does not state rate limits in the specifications it published, and the portal that did is closed.

Data handling

• Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight order or a traveller.
• Flight orders carry traveller names and contact details; they stay in your deployment. By default travel document numbers, dates of birth and health or disability special service requests (MEDA, WCHR, BLND and the rest of the IATA health set) are left out before a record is written. exclude_fields adds paths (for example **.contact); keep_fields takes a default back by its exact name.
• Nothing is cached raw: a raw cache would keep on disk the fields the exclusion removes.
• A failure names the host and the status, never the URL, because a URL can carry an order id.

Troubleshooting

What you see	What it means	What to do
credential variable 'AMADEUS_CLIENT_ID' is not set	The deployment has not been given the key	Connect the credential again, or set the variable
POST test.api.amadeus.com: HTTP 401	Amadeus refused the key and secret	Check the environment (a test key does not work on production) and that the key has not been revoked
the credential grants writes; this release reads only: ...	The token’s scope names a write	Ask the account manager for a key limited to reading
GET api.amadeus.com: HTTP 429	Amadeus is rate-limiting after the retries	Name fewer flights, or read less often
environment is test or production	Any other value	Choose one of the two
name what to read: flights, airlines, locations or orders	Nothing was named	Name at least one
not a flight designator (carrier code, number): ...	A flight is not like XX487 or XX487A	Correct the designator
days_back is 0 to 7 and days_ahead 0 to 14	The window is too wide	Narrow it

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.47.0	Authorization v1, On-Demand Flight Status v2, Airline Code Lookup v1, Airport and City Search v1, Flight Order Management v1	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only