FlightAware AeroAPI

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads an operator’s and an airport’s flights (schedule, gates, delays, diversions and cancellations) from FlightAware AeroAPI v4, read-only, inside your deployment.

At a glance

Collector	FlightAware AeroAPI, version 1.0.0
Reads	FlightAware: FlightAware AeroAPI v4 (the vendor's documentation)
Family	Aviation
Kind	Flights
Ways to connect	Access token
Scopes	Read:
Read only	Yes
Vendor's API can move money	No
Personal data	None
Hosts it may contact	aeroapi.flightaware.com
Vendor API versions	AeroAPI 4.30.0 (OpenAPI document)
Lowest engine version	0.46.0

What it reads

• Operators: GET /operators/{id}/flights: scheduled, arrived and en-route flights of each operator you name (ICAO codes are preferred, as FlightAware advises).
• Airports: GET /airports/{id}/flights: scheduled and actual arrivals and departures of each airport you name.
• One record per flight, keyed by fa_flight_id, FlightAware’s id for the flight, with its route, status, registration and whether it was cancelled or diverted.
• The window runs from hours_back (1 to 240, default 24) before now to hours_ahead (0 to 48, default 48) after; AeroAPI serves at most 10 days back and 2 ahead. You must name operators or airports: a whole feed is never the default.

How to connect

1. Make an AeroAPI key at FlightAware (Personal tier for testing, Standard for production).
2. In LightHouse, open Setup and admin, Connectors, choose FlightAware AeroAPI, and leave the access level at Read.
3. Name the operators and airports, and set per_second to your tier’s rate: 0.1 for Personal (10 a minute), 5 for Standard, up to 100 for Premium.
4. Paste the key. Your browser seals it to your deployment, which hands it to the collector as AEROAPI_KEY (credential_env).

Permissions

• GET only, with the key as x-apikey. The only writes AeroAPI has are alert configurations, and nothing here calls them.
• Your deployment refuses to store this credential at read and write.
• Only aeroapi.flightaware.com is contacted. The read-only test proves it on every change.

Limits

• Cost is bounded per run. AeroAPI bills per result set (a page of up to 15 records). max_result_sets (200 by default) stops a run first and fails it, rather than indexing half a window as if it were all of it.
• AeroAPI offers no changed-since. Each run reads from the previous run’s start, less an hour’s overlap, to hours_ahead; a flight whose record has not changed is not rewritten.
• per_second sets the pace (default 0.1, one request every ten seconds); set it to your tier or you will be throttled.
• Paging follows the opaque cursor in links.next.

Data handling

• Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight record.
• Nothing is cached raw, and a failure names the host and the status, never the URL.
• Flight status carries no passenger data. The standard exclusions still apply to every record before it is written (travel document numbers, dates of birth, health or disability special service requests); exclude_fields adds paths and keep_fields takes a default back by its exact name.

Troubleshooting

What you see	What it means	What to do
credential variable 'AEROAPI_KEY' is not set	The deployment has not been given the key	Connect the credential again
GET aeroapi.flightaware.com: HTTP 401	FlightAware refused the key	It may be revoked or for another product; make a new one
GET aeroapi.flightaware.com: HTTP 429	Your tier’s rate limit, after the retries	Lower per_second, or move up a tier
flightaware: max_result_sets (200) reached before the window was read; raise it or narrow the window	The window holds more pages than the cap allows	Narrow hours_back, name fewer airports, or raise the cap knowing every page is billed
name operators or airports; a whole feed is never the default	Neither was named	Name at least one
hours_back is 1 to 240 and hours_ahead 0 to 48 (AeroAPI's window)	The window is outside what AeroAPI serves	Narrow it
per_second is the account tier's rate, above 0 and at most 100	An impossible rate	Use your tier’s rate

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.47.0	AeroAPI 4.30.0	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only