Cirium FlightStats

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads flight status by airport and by flight from Cirium’s FlightStats Flex Flight Status API, read-only, inside your deployment.

At a glance

Collector	Cirium FlightStats, version 1.0.0
Reads	Cirium: Cirium FlightStats Flex Flight Status API (the vendor's documentation)
Family	Aviation
Kind	Flights
Ways to connect	Access token
Scopes	Read:
Read only	Yes
Vendor's API can move money	No
Personal data	None
Hosts it may contact	api.flightstats.com, {host}
Vendor API versions	Flex Flight Status v2
Lowest engine version	0.46.0

What it reads

• Airports: departures and arrivals of each airport you name, in blocks of up to 6 hours across the window (GET .../airport/status/{airport}/{dep|arr}/{year}/{month}/{day}/{hour}).
• Flights: today’s status of each flight you name by carrier and number (GET .../flight/status/{carrier}/{flight}/dep/{year}/{month}/{day}).
• One record per flight, keyed by FlightStats’ flightId, with its route, status and departure time.
• The window runs from hours_back (0 to 72, default 6) before now to hours_ahead (0 to 72, default 12) after, from an hour before the last run when there was one.

How to connect

1. Get a FlightStats application id and key from Cirium’s developer portal.
2. In LightHouse, open Setup and admin, Connectors, choose Cirium FlightStats, and leave the access level at Read.
3. Name the airports (IATA or ICAO codes) and the flights (such as XX101).
4. Paste the application id and then the key. Your browser seals them to your deployment, which hands them to the collector as CIRIUM_APP_ID and CIRIUM_APP_KEY.

Permissions

• GET only. The Flex status APIs are read-only and no other verb is sent.
• The key travels in the query, as FlightStats defines it (appId, appKey). So nothing is cached (the cache index is keyed by URL) and every failure names the host only.
• Requests ask for extendedOptions=useHTTPErrors, without which an authentication failure is an HTTP 200 carrying an error element that would read as “no flights”.
• Your deployment refuses to store this credential at read and write. Only api.flightstats.com is contacted.

Limits

• No paging; an airport is read in blocks of hours_per_request hours (1 to 6, default 6) because the public reference does not state a limit and a smaller block is never refused. max_flights (1000) caps one block.
• FlightStats offers no changed-since: the window from the last run, less an hour, is read again, and unchanged flights are not rewritten.
• Rate limits are contractual and not published; the default pace is one request a second (delay_s).

Data handling

• Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight record.
• Nothing is cached raw, and a failure names the host and the status, never the URL.
• Flight status carries no passenger data. The standard exclusions still apply to every record before it is written (travel document numbers, dates of birth, health or disability special service requests); exclude_fields adds paths and keep_fields takes a default back by its exact name.

Troubleshooting

What you see	What it means	What to do
credential variable 'CIRIUM_APP_ID' is not set	The deployment has not been given the application id or key	Connect the credential again
GET api.flightstats.com: FlightStats error 403	FlightStats refused the application id or key (reported through useHTTPErrors)	Check the id and key, and that the application may use this API
GET api.flightstats.com: HTTP 403	The same refusal as an HTTP status	As above
name airports or flights to read	Neither was named	Name at least one
not airport codes: [...]	A code is not 3 or 4 letters or digits	Correct it
hours_per_request is 1 to 6	A block longer than 6 hours	Use 6 or fewer
hours_back and hours_ahead are 0 to 72	The window is too wide	Narrow it

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.47.0	Flex Flight Status v2	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only