SITA Flight Status

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads flight status at the airports you name from SITA’s Flight Status API (FLIFO), kept current from SITA’s change feed, read-only, inside your deployment.

At a glance

Collector	SITA Flight Status, version 1.0.0
Reads	SITA: SITA Flight Status API (FLIFO) (the vendor's documentation)
Family	Aviation
Kind	Flights
Ways to connect	Access token, OAuth approval
Scopes	Read:
Read only	Yes, except: [object Object]
Vendor's API can move money	No
Personal data	None
Hosts it may contact	sitaopen.api.aero, {host}
Vendor API versions	Flight Status API (flightinfo v2)
Lowest engine version	0.46.0

What it reads

• First run: each airport’s departures and arrivals for the day (GET /flightinfo/v2/flights/airport/{airport}/direction/{D|A}), optionally one airline’s only.
• Every run after: only what changed, from the previous run’s end to a minute ago (GET /flightinfo/v2/flights/updates/airport/{airport}[/airline/{airline}] with from and to), in windows of at most window_minutes (1 to 240, default 60).
• One record per flight, keyed by SITA’s flightId, with its route and status text.

How to connect

1. Make an application at developer.aero and request access to the Flight Status API (SITA approves each API; some are charged).
2. In LightHouse, open Setup and admin, Connectors, choose SITA Flight Status, and leave the access level at Read.
3. Name the airports (IATA codes) and, optionally, one airline.
4. Paste the API key. For OAuth, add the client id and secret on a second and third line and set oauth: true. Your browser seals them to your deployment, which hands them to the collector as SITA_API_KEY, or SITA_CLIENT_ID and SITA_CLIENT_SECRET.

Permissions

• GET only. The API key goes in x-apikey; with OAuth the one POST is the token request to /flifo/oauth/token, listed in the manifest’s read_operations.
• A token whose granted scope names a write is refused before it is used; the credential check says so.
• Your deployment refuses to store this credential at read and write. Only sitaopen.api.aero is contacted.

Limits

• Rate limits are SITA’s, stated in X-RateLimit-* headers; once exceeded, retry-after is an epoch time. The backoff reads both (capped at two minutes).
• A flight is rewritten only when its content changes.
• The default pace is one request a second (delay_s).
• The first run reads the day only; the change feed carries the rest.

Data handling

• Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a flight record.
• Flight status carries no passenger data. The standard exclusions still apply to every record before it is written; exclude_fields adds paths and keep_fields takes a default back by its exact name.
• Nothing is cached raw, and a failure names the host and the status, never the URL.

Troubleshooting

What you see	What it means	What to do
credential variable 'SITA_API_KEY' is not set	The deployment has not been given the key	Connect the credential again
GET sitaopen.api.aero: HTTP 401	SITA refused the key or token	Check the key is approved for the Flight Status API
GET sitaopen.api.aero: HTTP 429	SITA’s rate limit, after the retries	Read less often, or name fewer airports
the credential grants writes; this release reads only: ...	An OAuth token’s scope names a write	Ask SITA for a read-only client
airports are IATA airport codes, at least one	No airport, or a code that is not three letters	Name airports as IATA codes
airline is a two-character IATA airline code	Any other airline value	Use the two-character code
window_minutes is 1 to 240	A window outside the range	Choose between 1 and 240

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.47.0	Flight Status API (flightinfo v2)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only