# SITA BagJourney > SITA BagJourney: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads the bags of the flights you name, with their loading status, from SITA’s BagJourney API, read-only, inside your deployment. ## At a glance | Collector | SITA BagJourney, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------- | | Reads | SITA: SITA BagJourney API ([the vendor's documentation](https://www.developer.aero/)) | | Family | Aviation | | Kind | Baggage | | Ways to connect | Access token | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Travel, Identity | | Hosts it may contact | `bagjourney.sita.aero`, `{host}` | | Vendor API versions | BagJourney API (bagsforflight v1.0) | | Lowest engine version | `0.46.0` | ## What it reads - For each flight you name (airport, direction `A` or `D`, airline, number) and each date from `days_back` (0 to 7, default 1) to today: the flight’s bags (`GET /bagsforflight/v1.0/...`). - One record per bag tag and date, with the flight, airport, loading status and rush indicator. - BagJourney has no read without a flight, so you must name flights. ## How to connect 1. Make an application at developer.aero and request access to BagJourney. 2. In LightHouse, open **Setup and admin, Connectors**, choose **SITA BagJourney**, and leave the access level at **Read**. 3. Name the `flights`, for example `{airport: DUB, direction: D, airline: XX, number: "101"}`. To leave passenger names out, set `exclude_fields` to `["**.passenger_first_name", "**.passenger_last_name"]`. 4. Paste the API key. Your browser seals it to your deployment, which hands it to the collector as `SITA_BAGS_API_KEY`. Because there is no read without a flight, your deployment checks the key at the first sync. ## Permissions - `GET` only, with the key in the `api_key` header. The API also documents a `POST` that creates a delayed bag report; nothing here calls it. - Your deployment refuses to store this credential at read and write. Only `bagjourney.sita.aero` is contacted. ## Limits - No paging or changed-since is documented: the named flights are read for each date in the window on every run. - A bag with no bag tag is skipped. - The default pace is one request a second (`delay_s`); `429` and `5xx` are retried with backoff and `Retry-After`. ## Data handling - A bag record is personal data: the passenger’s name, PNR and seat. It is read and indexed in your deployment only; LightHouse receives ids, hashes and counts, never a bag or a passenger. - Nothing is cached raw, and a failure names the host and the status, never the URL (which carries the flight). - Travel document numbers, dates of birth and health or disability special service requests are left out by default. Passenger names are not, unless you add them to `exclude_fields`; `keep_fields` takes a default back by its exact name. ## Troubleshooting | What you see | What it means | What to do | | ---------------------------------------------------- | ----------------------------------------- | ----------------------------------- | | `credential variable 'SITA_BAGS_API_KEY' is not set` | The deployment has not been given the key | Connect the credential again | | `GET bagjourney.sita.aero: HTTP 401` | SITA refused the key | Check it is approved for BagJourney | | \`a flight is {airport, direction: A | D, airline, number}\` | A flight is malformed | | `name the flights whose bags to read` | No flights were named | Name at least one | | `days_back is 0 to 7` | A longer look-back | Use 7 or fewer | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ----------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | BagJourney API (bagsforflight v1.0) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/sita-bags/