# OAG Flight Info > OAG Flight Info: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads flight instances by departure airport and date from OAG’s Flight Info API, read-only, inside your deployment. ## At a glance | Collector | OAG Flight Info, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------------- | | Reads | OAG Aviation Worldwide: OAG Flight Info API ([the vendor's documentation](https://developers.oag.com/)) | | Family | Aviation | | Kind | Flights | | Ways to connect | Access token | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `api.oag.com`, `{host}` | | Vendor API versions | Flight Info API v2 (query parameter version=v2) | | Lowest engine version | `0.46.0` | ## What it reads - For each airport you name (departure airport) and each date from `days_back` (0 to 7, default 0) to `days_ahead` (0 to 14, default 2): the flight instances OAG returns (`GET /flight-instances/`). - OAG’s item reference is behind sign-in, so **no field of an item is assumed**. A record is the item as served, with personal fields still left out. It is keyed by the field you name in `id_field` once onboarding has read OAG’s reference, and until then by a hash of the item within its airport and date. - A changed item is therefore a new record and the old one is withdrawn, so the index never holds both. ## How to connect 1. Make a developer account at OAG and a subscription key (the free tier allows 1,000 calls a month and 10 results a call). 2. In LightHouse, open **Setup and admin, Connectors**, choose **OAG Flight Info**, and leave the access level at **Read**. 3. Name the `airports`. Set `limit` (results per page, 1 to 1000; the free tier serves 10) and, once known, `id_field`. 4. Paste the subscription key. Your browser seals it to your deployment, which hands it to the collector as `OAG_SUBSCRIPTION_KEY`. If your key’s portal shows `Ocp-Apim-Subscription-Key`, set `key_header` to that. ## Permissions - `GET` only. The subscription key is sent in the header OAG’s sample uses, `Subscription-Key`; `key_header` can name `Ocp-Apim-Subscription-Key`, the only other value accepted. - A `paging.next` link to any other host is refused. - Your deployment refuses to store this credential at read and write. Only `api.oag.com` is contacted. ## Limits - OAG offers no changed-since: each run reads the window’s dates again, and unchanged items are not rewritten. - Pages follow `paging.next` up to `max_pages` (200); a listing that does not end fails rather than loops. - Rate limits are not published beyond the free tier’s monthly calls; the default pace is one request a second (`delay_s`). - Without `id_field`, a record’s id is a hash of the item, so it is stable only while the item is unchanged. ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight record. - Nothing is cached raw, and a failure names the host and the status, never the URL. - Flight status carries no passenger data. The standard exclusions still apply to every record before it is written (travel document numbers, dates of birth, health or disability special service requests); `exclude_fields` adds paths and `keep_fields` takes a default back by its exact name. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------------------ | ------------------------------------------ | ------------------------------------------------------------------ | | `credential variable 'OAG_SUBSCRIPTION_KEY' is not set` | The deployment has not been given the key | Connect the credential again | | `GET api.oag.com: HTTP 401` | OAG refused the key | Check the key and which header your portal shows | | `GET api.oag.com: a next page on another host was refused` | A `paging.next` link pointed away from OAG | Report it to us; nothing was followed | | `oag: more than 200 pages; raise max_pages` | The listing did not end | Raise `limit`, or `max_pages`, after checking the airport and date | | `name the departure airports to read` | No airport was named | Name at least one | | `key_header is one of Subscription-Key, Ocp-Apim-Subscription-Key` | Any other header name | Use one of the two | | `days_back 0 to 7, days_ahead 0 to 14, limit 1 to 1000` | A setting is out of range | Correct it | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ----------------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | Flight Info API v2 (query parameter version=v2) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/oag/