OAG Flight Info

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads flight instances by departure airport and date from OAG’s Flight Info API, read-only, inside your deployment.

At a glance

Collector	OAG Flight Info, version 1.0.0
Reads	OAG Aviation Worldwide: OAG Flight Info API (the vendor's documentation)
Family	Aviation
Kind	Flights
Ways to connect	Access token
Scopes	Read:
Read only	Yes
Vendor's API can move money	No
Personal data	None
Hosts it may contact	api.oag.com, {host}
Vendor API versions	Flight Info API v2 (query parameter version=v2)
Lowest engine version	0.46.0

What it reads

• For each airport you name (departure airport) and each date from days_back (0 to 7, default 0) to days_ahead (0 to 14, default 2): the flight instances OAG returns (GET /flight-instances/).
• OAG’s item reference is behind sign-in, so no field of an item is assumed. A record is the item as served, with personal fields still left out. It is keyed by the field you name in id_field once onboarding has read OAG’s reference, and until then by a hash of the item within its airport and date.
• A changed item is therefore a new record and the old one is withdrawn, so the index never holds both.

How to connect

1. Make a developer account at OAG and a subscription key (the free tier allows 1,000 calls a month and 10 results a call).
2. In LightHouse, open Setup and admin, Connectors, choose OAG Flight Info, and leave the access level at Read.
3. Name the airports. Set limit (results per page, 1 to 1000; the free tier serves 10) and, once known, id_field.
4. Paste the subscription key. Your browser seals it to your deployment, which hands it to the collector as OAG_SUBSCRIPTION_KEY. If your key’s portal shows Ocp-Apim-Subscription-Key, set key_header to that.

Permissions

• GET only. The subscription key is sent in the header OAG’s sample uses, Subscription-Key; key_header can name Ocp-Apim-Subscription-Key, the only other value accepted.
• A paging.next link to any other host is refused.
• Your deployment refuses to store this credential at read and write. Only api.oag.com is contacted.

Limits

• OAG offers no changed-since: each run reads the window’s dates again, and unchanged items are not rewritten.
• Pages follow paging.next up to max_pages (200); a listing that does not end fails rather than loops.
• Rate limits are not published beyond the free tier’s monthly calls; the default pace is one request a second (delay_s).
• Without id_field, a record’s id is a hash of the item, so it is stable only while the item is unchanged.

Data handling

• Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight record.
• Nothing is cached raw, and a failure names the host and the status, never the URL.
• Flight status carries no passenger data. The standard exclusions still apply to every record before it is written (travel document numbers, dates of birth, health or disability special service requests); exclude_fields adds paths and keep_fields takes a default back by its exact name.

Troubleshooting

What you see	What it means	What to do
credential variable 'OAG_SUBSCRIPTION_KEY' is not set	The deployment has not been given the key	Connect the credential again
GET api.oag.com: HTTP 401	OAG refused the key	Check the key and which header your portal shows
GET api.oag.com: a next page on another host was refused	A paging.next link pointed away from OAG	Report it to us; nothing was followed
oag: more than 200 pages; raise max_pages	The listing did not end	Raise limit, or max_pages, after checking the airport and date
name the departure airports to read	No airport was named	Name at least one
key_header is one of Subscription-Key, Ocp-Apim-Subscription-Key	Any other header name	Use one of the two
days_back 0 to 7, days_ahead 0 to 14, limit 1 to 1000	A setting is out of range	Correct it

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.47.0	Flight Info API v2 (query parameter version=v2)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only