ECCAIRS 2

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads your organisation’s occurrence reports from EASA’s ECCAIRS 2 (E2), read-only, inside your deployment, with reporters left out.

At a glance

Collector	ECCAIRS 2, version 1.0.0
Reads	EASA (European Union Aviation Safety Agency): ECCAIRS 2 (E2) API (the vendor's documentation)
Family	Aviation
Kind	Occurrences
Ways to connect	OAuth approval
Scopes	Read:
Read only	Yes, except: [object Object]; [object Object]
Vendor's API can move money	No
Personal data	Identity, Contact
Hosts it may contact	api.aviationreporting.eu, *.aviationreporting.eu
Vendor API versions	E2 API Guide v4.19, OAuth 2.0 client credentials (EASA's 2026 change)
Lowest engine version	0.46.0

What it reads

• Occurrence reports modified since the last run (on the first run, within the last days_back days: 1 to 3650, default 365), through POST /occurrences/readable/result/bool/scroll, a query with a range on modificationDate, paged by scrollId (valid 30 minutes) in pages of page_size (1 to 10000, default 200).
• One record per occurrence, keyed by E2’s e2Id, with its status, version and type.
• These POSTs are queries: the only calls this source makes besides the token request.

How to connect

1. Ask EASA’s ECCAIRS2 support for an API client for your organisation. Access needs your organisation’s E2 roles, and EASA allow-lists your deployment’s address.
2. In LightHouse, open Setup and admin, Connectors, choose ECCAIRS 2, and leave the access level at Read.
3. Name token_url only if EASA gave you one; otherwise E2’s own ({base}/idp/oauth2/token) is used. Name the reporter attributes of your taxonomy version in exclude_fields (for example **.ATTRIBUTES.<attribute id>): E2 holds values under numeric ids, and this collector does not guess them.
4. Paste the client id and then the secret. Your browser seals them to your deployment, which hands them to the collector as ECCAIRS_CLIENT_ID and ECCAIRS_CLIENT_SECRET.

Permissions

• OAuth client credentials only, as EASA’s 2026 change requires. The collector requests no scope and refuses a token whose granted scope names a write; the credential check says so.
• It sends POST only to the two reads in the manifest’s read_operations: the token request and the occurrence query.
• Your deployment refuses to store this credential at read and write. Only hosts ending .aviationreporting.eu are accepted.

Limits

• The E2 API Guide (v4.19) is written for authorities. Whether an organisation’s role can read its own submitted reports through these endpoints, the token path under the API base and the IP allow-list are the questions onboarding settles with EASA’s ECCAIRS2 support.
• The token path follows the French DSAC’s webinar of 24 March 2026 (organisations to move to client credentials by June 2026); confirm it at onboarding.
• Incremental by modificationDate, to the day: the day of the last run is read again, and unchanged records are not rewritten.
• A scroll stops on an empty page or when the total is reached; more than max_pages (1000) pages fails the run.

Data handling

• Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never an occurrence or a reporter.
• Reporters are protected by default: reporters’ names, who submitted or created a record, and everyone’s email, phone and contact details are left out of every record before it is written, as are travel document numbers and dates of birth. Just culture and data protection both need a reporter kept from anyone who does not need them. Names are matched whatever the case, spacing, _ or -, so reporterName also catches an export’s Reporter Name.
• exclude_fields adds paths (for example **.contact); keep_fields takes a default back by its exact name, and that choice is your record of the decision. Free-text narratives are indexed as written and may still name people: add the fields that hold them to exclude_fields.
• Nothing is cached raw, and a failure names the host and the status, never the URL.

Troubleshooting

What you see	What it means	What to do
credential variable 'ECCAIRS_CLIENT_ID' is not set	The deployment has not been given the client	Connect the credential again
POST api.aviationreporting.eu: HTTP 401	EASA refused the client or the token	Check the client has not been revoked and that EASA has allow-listed your deployment’s address
POST api.aviationreporting.eu: HTTP 403	The organisation’s role cannot read these endpoints	Ask EASA’s ECCAIRS2 support (see Limits)
POST api.aviationreporting.eu: no access token	The token path is not the one EASA uses for you	Ask EASA for the token path and set token_url
ECCAIRS 2 is reached on EASA's aviationreporting.eu hosts only	base_url or token_url is another host, or base_url is not https	Use the addresses EASA gave you
page_size is 1 to 10000 and days_back 1 to 3650	A setting is out of range	Correct it
eccairs: more than 1000 pages; raise max_pages	The scroll did not end	Narrow days_back, or raise max_pages after checking the query

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.47.0	E2 API Guide v4.19; OAuth 2.0 client credentials	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only