EASA Easy Access Rules
Reads the European Union Aviation Safety Agency’s Easy Access Rules: the consolidated rules, acceptable means of compliance and guidance material for a domain, as EASA publishes them for download. EASA has no versioned API for them, so you name each document by its download address and the collector notices when the bytes change.
At a glance
Section titled “At a glance”| Collector | EASA Easy Access Rules, version 1.0.0 |
|---|---|
| Reads | European Union Aviation Safety Agency: Easy Access Rules (download library) (the vendor's documentation) |
| Family | Regulation |
| Kind | Regulation |
| Ways to connect | None (no credential) |
| Scopes |
|
| Read only | Yes |
| Vendor's API can move money | No |
| Personal data | None |
| Hosts it may contact | www.easa.europa.eu |
| Vendor API versions | Easy Access Rules downloads (PDF, XML, HTML); no versioned API |
| Lowest engine version | 0.45.0 |
What it reads
Section titled “What it reads”- The documents you name, each by an
https://address on www.easa.europa.eu: PDF downloads, XML downloads, or library pages (HTML). - For each document: its text, with the title you give it and a link to where it was read.
- A document is read again only when its bytes change (the collector compares their SHA-256). A document you remove from the list is withdrawn from the knowledge base.
It does not search the EASA site or follow links from a page: a site redesign would otherwise change what is read without anyone deciding to.
How to connect
Section titled “How to connect”- In LightHouse, open Connectors and choose EASA Easy Access Rules.
- For each document, give an id of your own (for example
ear-air-ops), its download address (from the document’s page in EASA’s library) and a title. - Choose a label (normally
regulation) and how often to read. Weekly is usually enough: EASA revises each set a few times a year.
No credential is needed.
Permissions
Section titled “Permissions”None. The collector sends only GET requests, without credentials, to
www.easa.europa.eu (or any other host you add to the source’s allowed
hosts). Its read-only test proves it on every change, and the certification
run recorded every request it made against the live library.
Limits
Section titled “Limits”- EASA’s downloads do not answer conditional requests, so each read downloads every document in full (tens of megabytes for a large set) and then compares it. Read weekly, not hourly.
- PDFs are read with
pdftotext(poppler-utils). The Atlantic Agentic gateway image includes it from engine 0.47.0; on a deployment that does not use our image, install it where the collector runs. A scanned PDF with no text layer gives an empty document. - ZIP downloads (some XML editions come zipped) are not read; name the PDF or the unzipped XML instead.
- Requests are paced (one second apart by default) and back off when EASA
asks (
Retry-After).
Data handling
Section titled “Data handling”- The documents are public; they carry no personal data. Reuse is subject
to EASA’s legal notice; set the source’s
licenceto record it. - The raw bytes are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served.
- Nothing leaves your deployment: the collector runs inside it, and only the counts of documents read reach LightHouse.
- XML is parsed with
defusedxml, which refuses entity expansion and external entities.
Troubleshooting
Section titled “Troubleshooting”| What you see | What it means | What to do |
|---|---|---|
documents without an https url |
An address is not https:// |
Use the address from EASA’s library |
no reader for application/zip |
The address is a ZIP download | Name the PDF edition instead |
pdftotext is not installed |
The deployment lacks the PDF reader (our gateway image has it from engine 0.47.0) | Update the image, or install poppler-utils where the collector runs |
HostNotAllowed |
The address, or a redirect, is not on an allowed host | Add the host, if you trust it |
| Read succeeded, 0 written | No document’s bytes changed since the last read | Nothing to do |
Certification
Section titled “Certification”Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.
| Date | Collector | Engine | Vendor API | Method | Expires |
|---|---|---|---|---|---|
| 7 November 2026 | 1.0.0 | 0.45.0 | Easy Access Rules downloads (PDF, HTML); no versioned API | Vendor's sandbox (a real run) | 7 May 2027 |
| 7 November 2026 | 1.0.0 | 0.45.0 | Easy Access Rules downloads (PDF, HTML); no versioned API | Fixtures only: built, not certified | Not applicable |
Security posture
Section titled “Security posture”From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.
| Last scanned | 10 November 2026 |
|---|---|
| Critical findings | 0 |
| High findings | 0 |
| Medium findings | 0 |
| Low findings | 0 |
| Info findings | 0 |
| Release blocked | No |
| Network allow-list check | Pass |
| Read-only behavioural test | Pass |
| SBOM (CycloneDX) | Produced |
| Dependency licences | Pass |
| Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only |