# ECCAIRS 2 > ECCAIRS 2: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads your organisation’s occurrence reports from EASA’s ECCAIRS 2 (E2), read-only, inside your deployment, with reporters left out. ## At a glance | Collector | ECCAIRS 2, version `1.0.0` | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | EASA (European Union Aviation Safety Agency): ECCAIRS 2 (E2) API ([the vendor's documentation](https://www.easa.europa.eu/en/domains/safety-management/aviation-safety-reporting/aviation-safety-reporting-organisations)) | | Family | Aviation | | Kind | Occurrences | | Ways to connect | OAuth approval | | Scopes | - Read: | | Read only | Yes, except: \[object Object]; \[object Object] | | Vendor's API can move money | No | | Personal data | Identity, Contact | | Hosts it may contact | `api.aviationreporting.eu`, `*.aviationreporting.eu` | | Vendor API versions | E2 API Guide v4.19, OAuth 2.0 client credentials (EASA's 2026 change) | | Lowest engine version | `0.46.0` | ## What it reads - Occurrence reports modified since the last run (on the first run, within the last `days_back` days: 1 to 3650, default 365), through `POST /occurrences/readable/result/bool/scroll`, a query with a range on `modificationDate`, paged by `scrollId` (valid 30 minutes) in pages of `page_size` (1 to 10000, default 200). - One record per occurrence, keyed by E2’s `e2Id`, with its status, version and type. - These POSTs are queries: the only calls this source makes besides the token request. ## How to connect 1. Ask EASA’s ECCAIRS2 support for an API client for your organisation. Access needs your organisation’s E2 roles, and EASA allow-lists your deployment’s address. 2. In LightHouse, open **Setup and admin, Connectors**, choose **ECCAIRS 2**, and leave the access level at **Read**. 3. Name `token_url` only if EASA gave you one; otherwise E2’s own (`{base}/idp/oauth2/token`) is used. Name the reporter attributes of your taxonomy version in `exclude_fields` (for example `**.ATTRIBUTES.`): E2 holds values under numeric ids, and this collector does not guess them. 4. Paste the client id and then the secret. Your browser seals them to your deployment, which hands them to the collector as `ECCAIRS_CLIENT_ID` and `ECCAIRS_CLIENT_SECRET`. ## Permissions - OAuth client credentials only, as EASA’s 2026 change requires. The collector requests no scope and refuses a token whose granted scope names a write; the credential check says so. - It sends `POST` only to the two reads in the manifest’s `read_operations`: the token request and the occurrence query. - Your deployment refuses to store this credential at read and write. Only hosts ending `.aviationreporting.eu` are accepted. ## Limits - The E2 API Guide (v4.19) is written for authorities. Whether an organisation’s role can read its own submitted reports through these endpoints, the token path under the API base and the IP allow-list are the questions onboarding settles with EASA’s ECCAIRS2 support. - The token path follows the French DSAC’s webinar of 24 March 2026 (organisations to move to client credentials by June 2026); confirm it at onboarding. - Incremental by `modificationDate`, to the day: the day of the last run is read again, and unchanged records are not rewritten. - A scroll stops on an empty page or when the total is reached; more than `max_pages` (1000) pages fails the run. ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never an occurrence or a reporter. - Reporters are protected by default: reporters’ names, who submitted or created a record, and everyone’s email, phone and contact details are left out of every record before it is written, as are travel document numbers and dates of birth. Just culture and data protection both need a reporter kept from anyone who does not need them. Names are matched whatever the case, spacing, `_` or `-`, so `reporterName` also catches an export’s `Reporter Name`. - `exclude_fields` adds paths (for example `**.contact`); `keep_fields` takes a default back by its exact name, and that choice is your record of the decision. Free-text narratives are indexed as written and may still name people: add the fields that hold them to `exclude_fields`. - Nothing is cached raw, and a failure names the host and the status, never the URL. ## Troubleshooting | What you see | What it means | What to do | | ---------------------------------------------------------------- | --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | `credential variable 'ECCAIRS_CLIENT_ID' is not set` | The deployment has not been given the client | Connect the credential again | | `POST api.aviationreporting.eu: HTTP 401` | EASA refused the client or the token | Check the client has not been revoked and that EASA has allow-listed your deployment’s address | | `POST api.aviationreporting.eu: HTTP 403` | The organisation’s role cannot read these endpoints | Ask EASA’s ECCAIRS2 support (see Limits) | | `POST api.aviationreporting.eu: no access token` | The token path is not the one EASA uses for you | Ask EASA for the token path and set `token_url` | | `ECCAIRS 2 is reached on EASA's aviationreporting.eu hosts only` | `base_url` or `token_url` is another host, or `base_url` is not https | Use the addresses EASA gave you | | `page_size is 1 to 10000 and days_back 1 to 3650` | A setting is out of range | Correct it | | `eccairs: more than 1000 pages; raise max_pages` | The scroll did not end | Narrow `days_back`, or raise `max_pages` after checking the query | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ------------------------------------------------ | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | E2 API Guide v4.19; OAuth 2.0 client credentials | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/eccairs/