# FlightAware AeroAPI > FlightAware AeroAPI: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads an operator’s and an airport’s flights (schedule, gates, delays, diversions and cancellations) from FlightAware AeroAPI v4, read-only, inside your deployment. ## At a glance | Collector | FlightAware AeroAPI, version `1.0.0` | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Reads | FlightAware: FlightAware AeroAPI v4 ([the vendor's documentation](https://static.flightaware.com/rsrc/aeroapi/aeroapi-openapi.yml)) | | Family | Aviation | | Kind | Flights | | Ways to connect | Access token | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `aeroapi.flightaware.com` | | Vendor API versions | AeroAPI 4.30.0 (OpenAPI document) | | Lowest engine version | `0.46.0` | ## What it reads - **Operators:** `GET /operators/{id}/flights`: scheduled, arrived and en-route flights of each operator you name (ICAO codes are preferred, as FlightAware advises). - **Airports:** `GET /airports/{id}/flights`: scheduled and actual arrivals and departures of each airport you name. - One record per flight, keyed by `fa_flight_id`, FlightAware’s id for the flight, with its route, status, registration and whether it was cancelled or diverted. - The window runs from `hours_back` (1 to 240, default 24) before now to `hours_ahead` (0 to 48, default 48) after; AeroAPI serves at most 10 days back and 2 ahead. You must name operators or airports: a whole feed is never the default. ## How to connect 1. Make an AeroAPI key at FlightAware (Personal tier for testing, Standard for production). 2. In LightHouse, open **Setup and admin, Connectors**, choose **FlightAware AeroAPI**, and leave the access level at **Read**. 3. Name the `operators` and `airports`, and set `per_second` to your tier’s rate: 0.1 for Personal (10 a minute), 5 for Standard, up to 100 for Premium. 4. Paste the key. Your browser seals it to your deployment, which hands it to the collector as `AEROAPI_KEY` (`credential_env`). ## Permissions - `GET` only, with the key as `x-apikey`. The only writes AeroAPI has are alert configurations, and nothing here calls them. - Your deployment refuses to store this credential at read and write. - Only `aeroapi.flightaware.com` is contacted. The read-only test proves it on every change. ## Limits - **Cost is bounded per run.** AeroAPI bills per result set (a page of up to 15 records). `max_result_sets` (200 by default) stops a run first and fails it, rather than indexing half a window as if it were all of it. - AeroAPI offers no changed-since. Each run reads from the previous run’s start, less an hour’s overlap, to `hours_ahead`; a flight whose record has not changed is not rewritten. - `per_second` sets the pace (default 0.1, one request every ten seconds); set it to your tier or you will be throttled. - Paging follows the opaque cursor in `links.next`. ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight record. - Nothing is cached raw, and a failure names the host and the status, never the URL. - Flight status carries no passenger data. The standard exclusions still apply to every record before it is written (travel document numbers, dates of birth, health or disability special service requests); `exclude_fields` adds paths and `keep_fields` takes a default back by its exact name. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------- | --------------------------------------------------------------------------------------- | | `credential variable 'AEROAPI_KEY' is not set` | The deployment has not been given the key | Connect the credential again | | `GET aeroapi.flightaware.com: HTTP 401` | FlightAware refused the key | It may be revoked or for another product; make a new one | | `GET aeroapi.flightaware.com: HTTP 429` | Your tier’s rate limit, after the retries | Lower `per_second`, or move up a tier | | `flightaware: max_result_sets (200) reached before the window was read; raise it or narrow the window` | The window holds more pages than the cap allows | Narrow `hours_back`, name fewer airports, or raise the cap knowing every page is billed | | `name operators or airports; a whole feed is never the default` | Neither was named | Name at least one | | `hours_back is 1 to 240 and hours_ahead 0 to 48 (AeroAPI's window)` | The window is outside what AeroAPI serves | Narrow it | | `per_second is the account tier's rate, above 0 and at most 100` | An impossible rate | Use your tier’s rate | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | -------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | AeroAPI 4.30.0 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/flightaware/