# SITA Flight Status > SITA Flight Status: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads flight status at the airports you name from SITA’s Flight Status API (FLIFO), kept current from SITA’s change feed, read-only, inside your deployment. ## At a glance | Collector | SITA Flight Status, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------ | | Reads | SITA: SITA Flight Status API (FLIFO) ([the vendor's documentation](https://www.developer.aero/)) | | Family | Aviation | | Kind | Flights | | Ways to connect | Access token, OAuth approval | | Scopes | - Read: | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `sitaopen.api.aero`, `{host}` | | Vendor API versions | Flight Status API (flightinfo v2) | | Lowest engine version | `0.46.0` | ## What it reads - **First run:** each airport’s departures and arrivals for the day (`GET /flightinfo/v2/flights/airport/{airport}/direction/{D|A}`), optionally one airline’s only. - **Every run after:** only what changed, from the previous run’s end to a minute ago (`GET /flightinfo/v2/flights/updates/airport/{airport}[/airline/{airline}]` with `from` and `to`), in windows of at most `window_minutes` (1 to 240, default 60). - One record per flight, keyed by SITA’s `flightId`, with its route and status text. ## How to connect 1. Make an application at developer.aero and request access to the Flight Status API (SITA approves each API; some are charged). 2. In LightHouse, open **Setup and admin, Connectors**, choose **SITA Flight Status**, and leave the access level at **Read**. 3. Name the `airports` (IATA codes) and, optionally, one `airline`. 4. Paste the API key. For OAuth, add the client id and secret on a second and third line and set `oauth: true`. Your browser seals them to your deployment, which hands them to the collector as `SITA_API_KEY`, or `SITA_CLIENT_ID` and `SITA_CLIENT_SECRET`. ## Permissions - `GET` only. The API key goes in `x-apikey`; with OAuth the one `POST` is the token request to `/flifo/oauth/token`, listed in the manifest’s `read_operations`. - A token whose granted scope names a write is refused before it is used; the credential check says so. - Your deployment refuses to store this credential at read and write. Only `sitaopen.api.aero` is contacted. ## Limits - Rate limits are SITA’s, stated in `X-RateLimit-*` headers; once exceeded, `retry-after` is an epoch time. The backoff reads both (capped at two minutes). - A flight is rewritten only when its content changes. - The default pace is one request a second (`delay_s`). - The first run reads the day only; the change feed carries the rest. ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight record. - Flight status carries no passenger data. The standard exclusions still apply to every record before it is written; `exclude_fields` adds paths and `keep_fields` takes a default back by its exact name. - Nothing is cached raw, and a failure names the host and the status, never the URL. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------------ | ----------------------------------------------- | --------------------------------------------------- | | `credential variable 'SITA_API_KEY' is not set` | The deployment has not been given the key | Connect the credential again | | `GET sitaopen.api.aero: HTTP 401` | SITA refused the key or token | Check the key is approved for the Flight Status API | | `GET sitaopen.api.aero: HTTP 429` | SITA’s rate limit, after the retries | Read less often, or name fewer airports | | `the credential grants writes; this release reads only: ...` | An OAuth token’s scope names a write | Ask SITA for a read-only client | | `airports are IATA airport codes, at least one` | No airport, or a code that is not three letters | Name airports as IATA codes | | `airline is a two-character IATA airline code` | Any other airline value | Use the two-character code | | `window_minutes is 1 to 240` | A window outside the range | Choose between 1 and 240 | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | --------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | Flight Status API (flightinfo v2) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/sita-flights/