SITA BagJourney

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the bags of the flights you name, with their loading status, from SITA’s BagJourney API, read-only, inside your deployment.

At a glance

Collector	SITA BagJourney, version 1.0.0
Reads	SITA: SITA BagJourney API (the vendor's documentation)
Family	Aviation
Kind	Baggage
Ways to connect	Access token
Scopes	Read:
Read only	Yes
Vendor's API can move money	No
Personal data	Travel, Identity
Hosts it may contact	bagjourney.sita.aero, {host}
Vendor API versions	BagJourney API (bagsforflight v1.0)
Lowest engine version	0.46.0

What it reads

• For each flight you name (airport, direction A or D, airline, number) and each date from days_back (0 to 7, default 1) to today: the flight’s bags (GET /bagsforflight/v1.0/...).
• One record per bag tag and date, with the flight, airport, loading status and rush indicator.
• BagJourney has no read without a flight, so you must name flights.

How to connect

1. Make an application at developer.aero and request access to BagJourney.
2. In LightHouse, open Setup and admin, Connectors, choose SITA BagJourney, and leave the access level at Read.
3. Name the flights, for example {airport: DUB, direction: D, airline: XX, number: "101"}. To leave passenger names out, set exclude_fields to ["**.passenger_first_name", "**.passenger_last_name"].
4. Paste the API key. Your browser seals it to your deployment, which hands it to the collector as SITA_BAGS_API_KEY. Because there is no read without a flight, your deployment checks the key at the first sync.

Permissions

• GET only, with the key in the api_key header. The API also documents a POST that creates a delayed bag report; nothing here calls it.
• Your deployment refuses to store this credential at read and write. Only bagjourney.sita.aero is contacted.

Limits

• No paging or changed-since is documented: the named flights are read for each date in the window on every run.
• A bag with no bag tag is skipped.
• The default pace is one request a second (delay_s); 429 and 5xx are retried with backoff and Retry-After.

Data handling

• A bag record is personal data: the passenger’s name, PNR and seat. It is read and indexed in your deployment only; LightHouse receives ids, hashes and counts, never a bag or a passenger.
• Nothing is cached raw, and a failure names the host and the status, never the URL (which carries the flight).
• Travel document numbers, dates of birth and health or disability special service requests are left out by default. Passenger names are not, unless you add them to exclude_fields; keep_fields takes a default back by its exact name.

Troubleshooting

What you see	What it means	What to do
credential variable 'SITA_BAGS_API_KEY' is not set	The deployment has not been given the key	Connect the credential again
GET bagjourney.sita.aero: HTTP 401	SITA refused the key	Check it is approved for BagJourney
`a flight is {airport, direction: A	D, airline, number}`	A flight is malformed
name the flights whose bags to read	No flights were named	Name at least one
days_back is 0 to 7	A longer look-back	Use 7 or fewer

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.47.0	BagJourney API (bagsforflight v1.0)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only