Developers Beta

Developer API Reference

Base URL: /api/ext/v2

Overview

HTTP JSON API at /api/ext/v2. Static /data/... routes mirror the public data API. /sessions and /sessions/{sessionId}/flights provide session and flight access when your key's scopes allow it. Join codes, client IP addresses, and ACARS tokens are never included in responses. Flight updates (PUT) and session/flight deletes (DELETE) are only allowed on sessions created with the same API key. Each key can only call the endpoints covered by its granted scopes. /api/ext/v1 remains available and serves every endpoint listed here except the two marked "v2+ only" (session and flight deletion).

Base URL

/api/ext/v2

Legacy base URL

/api/ext/v1 serves everything except endpoints marked v2+ only.

Spec v2

Generated

Authentication & limits

API key

Use a developer API key issued from the Developers portal after your application is approved. Keys start with pfc_live_ (legacy pf_live_ keys still work until rotated). Either header style works; do not send cookies for machine clients.

Authorization

Bearer pfc_live_…

X-Api-Key

Raw secret string (same value as after Bearer).

120 requests per minute by default

Per API key, per minute sliding window. HTTP 429 with Retry-After when exceeded.

Account

1

Your API key info

self.read
GET/me

Information about the calling API key itself: id, name, key prefix, owning user id, granted scopes (with labels/descriptions), effective rate limit, and which API version this request used. Always available regardless of scopes. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/me"

Data

11

Airport directory

data.airports
GET/data/airports

JSON array of airport objects (static dataset). Returns application/json.

ParameterInRequiredDescription
searchqueryOptionalCase-insensitive substring match against ICAO code, name, or controller name. e.g. punta
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports"

Airport directory

data.airports
GET/data/airports/{icao}

Single airport object by ICAO code (case-insensitive), or 404 if not found. Uses the same scope as the full airport list. Returns application/json.

ParameterInRequiredDescription
icaopathRequiredAirport ICAO code (case-insensitive). e.g. EGKK
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK"

Aircraft types

data.aircrafts
GET/data/aircrafts

JSON array of aircraft reference records. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/aircrafts"

Airlines

data.airlines
GET/data/airlines

JSON array of airline reference records. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airlines"

Frequencies summary

data.frequencies
GET/data/frequencies

JSON array of per-airport frequency summaries. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/frequencies"

Background assets

data.backgrounds
GET/data/backgrounds

JSON array of background image metadata (filename, path, extension). Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/backgrounds"

Route finder

data.find_route
GET/data/findRoute

JSON object with path (waypoint ids), distance, success. success is false (not a 400) if from/to aren't airports the route graph recognizes. Returns application/json.

ParameterInRequiredDescription
fromqueryRequiredDeparture airport ICAO (see GET /data/airports) — must be an airport. e.g. EGKK
toqueryRequiredArrival airport ICAO (see GET /data/airports) — must be an airport. e.g. MDPC
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/findRoute?from=EGKK&to=MDPC"

Airport runways

data.airport_runways
GET/data/airports/{icao}/runways

JSON array of runway strings/objects for the airport. Returns application/json.

ParameterInRequiredDescription
icaopathRequiredAirport ICAO code (case-insensitive in URL). e.g. EGKK
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK/runways"

Airport SIDs

data.airport_sids
GET/data/airports/{icao}/sids

JSON array of SID definitions for the airport. Returns application/json.

ParameterInRequiredDescription
icaopathRequiredAirport ICAO code. e.g. EGKK
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK/sids"

Airport STARs

data.airport_stars
GET/data/airports/{icao}/stars

JSON array of STAR definitions for the airport. Returns application/json.

ParameterInRequiredDescription
icaopathRequiredAirport ICAO code. e.g. EGKK
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK/stars"

Airport status

data.airport_status
GET/data/airports/{icao}/status

JSON with active PFATC/Advanced session summary, controller, departureRunway, arrivalRunway (activeRunway kept for backwards compatibility, same value as departureRunway), flight count, METAR when available. Returns application/json.

ParameterInRequiredDescription
icaopathRequiredAirport ICAO code. e.g. EGKK
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK/status"

Sessions

9

PFATC sessions

sessions.network_pfatc
GET/sessions/network/pfatc/{sessionId}

One PFATC network session (sanitized): airport, runway, counts, controller public profile. Not limited to sessions you own. Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession identifier. e.g. f0a25bbc
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/network/pfatc/f0a25bbc"

PFATC sessions

sessions.network_pfatc
GET/sessions/network/pfatc

JSON array of PFATC network sessions (sanitized). Optional airport (ICAO), page, limit. Returns application/json.

ParameterInRequiredDescription
airportqueryOptionalFilter to one airport ICAO (4 letters). e.g. EGKK
pagequeryOptionalPage number (default 1). e.g. 1
limitqueryOptionalPage size (max 100, default 50). e.g. 50
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/network/pfatc"

Network overview

sessions.network_overview
GET/sessions/network/overviewv2+ only

Every PFATC session network-wide that was created in the last 4 hours or has had flight activity in the last 4 hours. A live connected controller is not required. Each session includes nested flights updated in the last 30 minutes (sanitized), connected-controller list (if any), and decoded ATIS. Also includes totalActiveSessions, totalFlights, arrivalsByAirport (flights grouped by arrival ICAO across every session), and lastUpdated. Not limited to sessions you own. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/network/overview"

Network overview

sessions.network_overview
GET/sessions/network/flightsv2+ only

Flat JSON array of every flight updated in the last 30 minutes, across every PFATC session network-wide that was created or flight-active in the last 4 hours. Each flight is annotated with sessionId and departureAirport. Not limited to sessions you own. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/network/flights"

Read session

sessions.read
GET/sessions/{sessionId}

Session metadata without accessId — the join code is only ever returned once, from POST /sessions at creation time. Save it then if you'll need it. Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession identifier. e.g. f0a28bac
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f0a28bac"

Update session

sessions.update
PUT/sessions/{sessionId}

Updates a session you own. Returns the updated session (same shape as GET /sessions/{sessionId}), plus a decoded atis object ({ letter, text }) reflecting the current ATIS after the update. Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession you own. e.g. f0a25bac
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).

Request body

Every field is optional so send only what changed, but at least one must be present (400 if the body has none of these). customName (letters/digits/spaces/hyphens/underscores only, max 50 chars — other characters are stripped), activeRunway (departure runway — see GET /data/airports/{icao}/runways; rejected with 400 if not a real runway at this session's airport), arrivalRunway (same validation as activeRunway), atisLetter + atisText (must be sent together — 400 if only one is present; atisLetter is a single A-Z letter, atisText max 2000 characters, free text — this sets a custom ATIS directly, it does not call the ATIS generator). airportIcao cannot be changed here.

Request body
{
  "customName": "hykkas wet dream of a session",
  "activeRunway": "26L",
  "arrivalRunway": "26L",
  "atisLetter": "C",
  "atisText": "LONDON GATWICK AIRPORT INFORMATION C...  0150Z...  WIND CALM...  CAVOK...  TEMPERATURE 11, DEWPOINT 8...  QNH 1022, ALTIMETER 3018...  LANDING AND DEPARTING RUNWAY 26L...  EXPECT SIMULTANEOUS ILS AND VISUAL APPROACH RUNWAY 26L...  ADVISE CONTROLLER ON INITIAL CONTACT THAT YOU HAVE INFORMATION C... "
}
cURL
curl -sS -X PUT -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"customName":"hykkas wet dream of a session","activeRunway":"26L","arrivalRunway":"26L","atisLetter":"C","atisText":"LONDON GATWICK AIRPORT INFORMATION C...  0150Z...  WIND CALM...  CAVOK...  TEMPERATURE 11, DEWPOINT 8...  QNH 1022, ALTIMETER 3018...  LANDING AND DEPARTING RUNWAY 26L...  EXPECT SIMULTANEOUS ILS AND VISUAL APPROACH RUNWAY 26L...  ADVISE CONTROLLER ON INITIAL CONTACT THAT YOU HAVE INFORMATION C... "}' "https://pfcontrol.com/api/ext/v2/sessions/f0a25bac"

List my sessions

sessions.list
GET/sessions

JSON array of sessions you created. Includes apiManaged when the session was created via the developer API. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions"

Create session

sessions.create
POST/sessions

Creates a session tied to your user and this API key (API-managed). Returns session id and metadata, plus accessId (the join code) — this is the only endpoint that returns it; GET /sessions and GET /sessions/{sessionId} omit it, so save it from this response if you want to open the session in the web UI yourself. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).

Request body

airportIcao (required — see GET /data/airports for valid ICAO codes; rejected with 400 if not an available airport), activeRunway (required — departure runway; see GET /data/airports/{icao}/runways for valid runways at this airport; rejected if not valid, also requires a departure runway to create a session), optional isPFATC, arrivalRunway (rejected if not valid; defaults to activeRunway when omitted).

Request body
{
  "airportIcao": "MDPC",
  "isPFATC": false,
  "isAdvancedATC": false,
  "activeRunway": "08",
  "arrivalRunway": "09"
}
cURL
curl -sS -X POST -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"airportIcao":"MDPC","isPFATC":false,"isAdvancedATC":false,"activeRunway":"08","arrivalRunway":"09"}' "https://pfcontrol.com/api/ext/v2/sessions"

Delete session

sessions.delete
DELETE/sessions/{sessionId}v2+ only

Deletes a session created with this same API key. Flights already logged in the session are not deleted — they remain in place, no longer attached to a live session. Session deletion itself is not recorded in GET /flight-logs (that endpoint only covers flight-level actions); the flights left behind keep their own history. Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession you own, created with this same API key. e.g. f0a25bat
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -X DELETE -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f0a25bat"

Flights

6

Manage network flights

flights.network_manage
PUT/sessions/network/flightsv2+ only

Batch-updates flights on any PFATC session network-wide. Is not limited to sessions created with this API key. Returns { results: [...] }, one entry per requested update in the same order, each either { sessionId, flightId, ok: true, flight } or { sessionId, flightId, ok: false, error }. A failure on one item does not affect the others. Max 25 updates per request. Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).

Request body

JSON object: { "updates": [{ "sessionId", "flightId", "fields": { ... } }, ...] }, max 25 updates. fields uses the same camelCase names the API returns, restricted to: callsign, remark, squawk, cruisingFL, clearedFL, runway (see GET /data/airports/{icao}/runways — rejected for that item if not a runway at the flight's current departure airport), stand, gate, sid, star (see GET /data/airports/{icao}/sids and /stars), reqAt (ISO timestamp or null), reqPhase (one of C, P, T, G, or null), clearance (boolean) — the same set an event controller can edit from the live Overview page. Any other field is silently ignored. This action is logged — see GET /flight-logs.

Request body
{
  "updates": [
    {
      "sessionId": "f0a25bbc",
      "flightId": "da8dd215",
      "fields": {
        "runway": "26L",
        "clearance": true
      }
    },
    {
      "sessionId": "ccf3ad9f",
      "flightId": "cdd08ab1",
      "fields": {
        "squawk": "2265"
      }
    }
  ]
}
cURL
curl -sS -X PUT -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"updates":[{"sessionId":"f0a25bbc","flightId":"da8dd215","fields":{"runway":"26L","clearance":true}},{"sessionId":"ccf3ad9f","flightId":"cdd08ab1","fields":{"squawk":"2265"}}]}' "https://pfcontrol.com/api/ext/v2/sessions/network/flights"

Read flight

flights.read
GET/sessions/{sessionId}/flights/{flightId}

Single flight JSON (sanitized). Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession identifier. e.g. f0a25bbc
flightIdpathRequiredFlight identifier (8-character alphanumeric). e.g. da8dd255
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f0a25bbc/flights/da8dd255"

Update flight

flights.update
PUT/sessions/{sessionId}/flights/{flightId}

Updated flight JSON (sanitized). Only allowed for sessions created with this same API key. Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession identifier. e.g. f0a25bbc
flightIdpathRequiredFlight identifier (8-character alphanumeric). e.g. da8dd255
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).

Request body

Every field is optional; send only what changed. Complete accepted field list: callsign, aircraft, departure, arrival (ICAO — see GET /data/airports; rejected with 400 if not a real airport), flightType (IFR/VFR), route, sid, star (see GET /data/airports/{icao}/sids and /stars), runway (see GET /data/airports/{icao}/runways — rejected with 400 if not a real runway at the flight's departure airport, using the new departure if you're also changing it in the same request), cruisingFL, clearedFL, squawk, wtc, status, remark, clearance (boolean), stand, gate, hidden (boolean), pdcRemarks, reqAt (ISO timestamp or null), reqPhase (one of C, P, T, G, or null). Unrecognized fields are silently ignored. This action is logged — see GET /flight-logs.

Request body
{
  "status": "ACTIVE",
  "runway": "26L",
  "squawk": "1234"
}
cURL
curl -sS -X PUT -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"status":"ACTIVE","runway":"26L","squawk":"1234"}' "https://pfcontrol.com/api/ext/v2/sessions/f0a25bbc/flights/da8dd255"

List session flights

flights.list
GET/sessions/{sessionId}/flights

JSON array of flights Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession you own (created_by matches key owner). e.g. f1a25bac
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f1a25bac/flights"

Create flight

flights.create
POST/sessions/{sessionId}/flights

Creates a flight; returns sanitized flight (no ACARS token in response). Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession you own. e.g. f0a25bac
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).

Request body

Required: callsign, aircraft, arrival (ICAO — see GET /data/airports; rejected with 400 if not real), cruisingFL. Rejected with 400 if any are missing. Everything else is optional. Accepted fields: callsign, aircraft, flightType (IFR/VFR, defaults to IFR when omitted), arrival (ICAO; rejected if not real), alternate (ICAO; rejected if not real), route, sid (see GET /data/airports/{icao}/sids — auto-generated from the session's airport when omitted), star (see GET /data/airports/{icao}/stars — not auto-filled, null unless you set it), runway (see GET /data/airports/{icao}/runways — defaults to the session's active runway when omitted; rejected with 400 if not a real runway at the session's airport), cruisingFL, clearedFL, stand, gate, remark, flightPlanTime (ISO timestamp, defaults to now), status (defaults to PENDING when omitted), clearance (boolean, defaults to false), hidden (boolean). departure, squawk, wtc, and id are always server-generated, and any value you send for departure/squawk/wtc/id is ignored. This action is logged — see GET /flight-logs.

Request body
{
  "callsign": "BAW123",
  "aircraft": "A320",
  "flightType": "IFR",
  "arrival": "MDPC",
  "cruisingFL": "350"
}
cURL
curl -sS -X POST -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"callsign":"BAW123","aircraft":"A320","flightType":"IFR","arrival":"MDPC","cruisingFL":"350"}' "https://pfcontrol.com/api/ext/v2/sessions/f0a25bac/flights"

Delete flight

flights.delete
DELETE/sessions/{sessionId}/flights/{flightId}v2+ only

Deletes one flight. Only allowed for sessions created with this same API key (same rule as flight updates). This action is logged — see GET /flight-logs. Returns application/json.

ParameterInRequiredDescription
sessionIdpathRequiredSession you own, created with this same API key. e.g. f0a25bac
flightIdpathRequiredFlight identifier to delete (8-character alphanumeric). e.g. da8dd215
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -X DELETE -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f0a25bac/flights/da8dd215"

Ratings

1

Controller rating stats

ratings.controller_stats
GET/ratings/controllers/{controllerId}/stats

Aggregate rating count and average for a controller, keyed by their app user id. 404 if controllerId does not match a real user; averageRating/ratingCount are 0 for a real user with no ratings yet. Returns application/json.

ParameterInRequiredDescription
controllerIdpathRequiredThe controller's user id e.g. 123456789012345678
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/ratings/controllers/123456789012345678/stats"

Notifications

1

Active notifications

notifications.read
GET/notifications/active

Public active announcements (same fields as web homepage feed; no admin-only data). Returns application/json.

ParameterInRequiredDescription
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/notifications/active"

Flight logs

1

Own session flight logs (metadata)

flight_logs.read
GET/flight-logs

Sanitized flight change audit entries for sessions you own (id, timestamps, action, session/flight ids only; no IP, no old/new payload text). Returns application/json.

ParameterInRequiredDescription
sessionIdqueryOptionalFilter to one owned session. e.g. f0a25bbc
pagequeryOptionalPage number (default 1). e.g. 1
limitqueryOptionalPage size (max 100, default 50). e.g. 50
AuthorizationheaderOptionalBearer token: Authorization: Bearer pfc_live_...
X-Api-KeyheaderOptionalAlternative to Authorization: send the raw pfc_live_... secret in this header.
AcceptheaderOptionalOptional; responses are JSON (application/json).
cURL
curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/flight-logs"

WebSockets

1

Network Flights (live push)

sessions.network_overview
WS/sockets/ext/network-flights

Server-to-server push channel for GET /sessions/network/flights, use this instead of polling that endpoint. Read-only: there is no client-to-server event on this socket. Requires the same sessions.network_overview scope as the REST endpoint. Not for browser clients, listeners with Origin headers will be rejected. Max 5 concurrent connections per API key.

Authentication

Pass your key as the socket.io auth.token option (or a token query param as a fallback) — the same pfc_live_... secret used for REST calls. Connections with a missing, invalid, or a under-scoped key are rejected before any data is sent. Connections with Origin headers are rejected before any data is sent.

EventDirectionDescription
flightsServer to clientSame JSON array shape as GET /sessions/network/flights. Sent once immediately on connect, then again every ~5 seconds while connected.
connect_errorServer to clientFired instead of a successful connection if auth fails; err.message explains why (invalid/missing key, missing scope, or too many concurrent connections for this key).
Node / socket.io-client
import { io } from 'socket.io-client';

const socket = io('https://pfcontrol.com', {
  path: '/sockets/ext/network-flights',
  auth: { token: 'pfc_live_...' },
  transports: ['websocket'],
});

socket.on('flights', (flights) => {
  // same shape as GET /sessions/network/flights
});
socket.on('connect_error', (err) => console.error(err.message));