# Cirium FlightStats > Cirium FlightStats: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads flight status by airport and by flight from Cirium’s FlightStats Flex Flight Status API, read-only, inside your deployment. ## At a glance | Collector | Cirium FlightStats, version `1.0.0` | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | Reads | Cirium: Cirium FlightStats Flex Flight Status API ([the vendor's documentation](https://developer.flightstats.com/api-docs/)) | | Family | Aviation | | Kind | Flights | | Ways to connect | Access token | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `api.flightstats.com`, `{host}` | | Vendor API versions | Flex Flight Status v2 | | Lowest engine version | `0.46.0` | ## What it reads - **Airports:** departures and arrivals of each airport you name, in blocks of up to 6 hours across the window (`GET .../airport/status/{airport}/{dep|arr}/{year}/{month}/{day}/{hour}`). - **Flights:** today’s status of each flight you name by carrier and number (`GET .../flight/status/{carrier}/{flight}/dep/{year}/{month}/{day}`). - One record per flight, keyed by FlightStats’ `flightId`, with its route, status and departure time. - The window runs from `hours_back` (0 to 72, default 6) before now to `hours_ahead` (0 to 72, default 12) after, from an hour before the last run when there was one. ## How to connect 1. Get a FlightStats application id and key from Cirium’s developer portal. 2. In LightHouse, open **Setup and admin, Connectors**, choose **Cirium FlightStats**, and leave the access level at **Read**. 3. Name the `airports` (IATA or ICAO codes) and the `flights` (such as `XX101`). 4. Paste the application id and then the key. Your browser seals them to your deployment, which hands them to the collector as `CIRIUM_APP_ID` and `CIRIUM_APP_KEY`. ## Permissions - `GET` only. The Flex status APIs are read-only and no other verb is sent. - **The key travels in the query**, as FlightStats defines it (`appId`, `appKey`). So nothing is cached (the cache index is keyed by URL) and every failure names the host only. - Requests ask for `extendedOptions=useHTTPErrors`, without which an authentication failure is an HTTP 200 carrying an `error` element that would read as “no flights”. - Your deployment refuses to store this credential at read and write. Only `api.flightstats.com` is contacted. ## Limits - No paging; an airport is read in blocks of `hours_per_request` hours (1 to 6, default 6) because the public reference does not state a limit and a smaller block is never refused. `max_flights` (1000) caps one block. - FlightStats offers no changed-since: the window from the last run, less an hour, is read again, and unchanged flights are not rewritten. - Rate limits are contractual and not published; the default pace is one request a second (`delay_s`). ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight record. - Nothing is cached raw, and a failure names the host and the status, never the URL. - Flight status carries no passenger data. The standard exclusions still apply to every record before it is written (travel document numbers, dates of birth, health or disability special service requests); `exclude_fields` adds paths and `keep_fields` takes a default back by its exact name. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------ | -------------------------------------------------------------------------------- | --------------------------------------------------------------- | | `credential variable 'CIRIUM_APP_ID' is not set` | The deployment has not been given the application id or key | Connect the credential again | | `GET api.flightstats.com: FlightStats error 403` | FlightStats refused the application id or key (reported through `useHTTPErrors`) | Check the id and key, and that the application may use this API | | `GET api.flightstats.com: HTTP 403` | The same refusal as an HTTP status | As above | | `name airports or flights to read` | Neither was named | Name at least one | | `not airport codes: [...]` | A code is not 3 or 4 letters or digits | Correct it | | `hours_per_request is 1 to 6` | A block longer than 6 hours | Use 6 or fewer | | `hours_back and hours_ahead are 0 to 72` | The window is too wide | Narrow it | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | --------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | Flex Flight Status v2 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/cirium/