Developers BETA

Developer API Reference

Base URL: /api/ext/v2

Overview
Authentication & limits
WebSockets

Account

Data

Sessions

Flights

Ratings

Notifications

Flight logs

Spec

9/12/2026, 7:45:25 AM

Base URL

/api/ext/v2

Legacy base still active: /api/ext/v1 — serves everything except endpoints tagged v2+ only.

HTTP JSON API at /api/ext/v2. Static /data/... routes mirror the public data API. /sessions and /sessions/{sessionId}/flights provide session and flight access when your key's scopes allow it. Join codes, client IP addresses, and ACARS tokens are never included in responses. Flight updates (PUT) and session/flight deletes (DELETE) are only allowed on sessions created with the same API key. Each key can only call the endpoints covered by its granted scopes. /api/ext/v1 remains available and serves every endpoint listed here except the two marked "v2+ only" (session and flight deletion).

Authentication

Use a developer API key issued from the Developers portal after your application is approved. Keys start with `pfc_live_` (legacy `pf_live_` keys still work until rotated). Either header style works; do not send cookies for machine clients.

Authorization	Bearer pfc_live_…
X-Api-Key	Raw secret string (same value as after Bearer).

Rate limits

Per API key, per minute sliding window. HTTP 429 with Retry-After when exceeded.

Default 120/min

Account(1)

Your API key info

·self.read

GET/me

Information about the calling API key itself: id, name, key prefix, owning user id, granted scopes (with labels/descriptions), effective rate limit, and which API version this request used. Always available regardless of scopes.

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/me"

Data(11)

Airport directory

·data.airports

GET/data/airports

JSON array of airport objects (static dataset).

Returns application/json

Query parameters

Optional · Case-insensitive substring match against ICAO code, name, or controller name. · e.g. punta

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports"

Airport directory

·data.airports

GET/data/airports/{icao}

Single airport object by ICAO code (case-insensitive), or 404 if not found. Uses the same scope as the full airport list.

Returns application/json

Path parameters

icao	Airport ICAO code (case-insensitive). · e.g. EGKK

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK"

Aircraft types

·data.aircrafts

GET/data/aircrafts

JSON array of aircraft reference records.

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/aircrafts"

Airlines

·data.airlines

GET/data/airlines

JSON array of airline reference records.

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airlines"

Frequencies summary

·data.frequencies

GET/data/frequencies

JSON array of per-airport frequency summaries.

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/frequencies"

Background assets

·data.backgrounds

GET/data/backgrounds

JSON array of background image metadata (filename, path, extension).

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/backgrounds"

Route finder

·data.find_route

GET/data/findRoute

JSON object with path (waypoint ids), distance, success. success is false (not a 400) if from/to aren't airports the route graph recognizes.

Returns application/json

Query parameters

from	Required · Departure airport ICAO (see GET /data/airports) — must be an airport. · e.g. EGKK
to	Required · Arrival airport ICAO (see GET /data/airports) — must be an airport. · e.g. MDPC

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/findRoute?from=EGKK&to=MDPC"

Airport runways

·data.airport_runways

GET/data/airports/{icao}/runways

JSON array of runway strings/objects for the airport.

Returns application/json

Path parameters

icao	Airport ICAO code (case-insensitive in URL). · e.g. EGKK

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK/runways"

Airport SIDs

·data.airport_sids

GET/data/airports/{icao}/sids

JSON array of SID definitions for the airport.

Returns application/json

Path parameters

icao	Airport ICAO code. · e.g. EGKK

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK/sids"

Airport STARs

·data.airport_stars

GET/data/airports/{icao}/stars

JSON array of STAR definitions for the airport.

Returns application/json

Path parameters

icao	Airport ICAO code. · e.g. EGKK

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK/stars"

Airport status

·data.airport_status

GET/data/airports/{icao}/status

JSON with active PFATC/Advanced session summary, controller, departureRunway, arrivalRunway (activeRunway kept for backwards compatibility, same value as departureRunway), flight count, METAR when available.

Returns application/json

Path parameters

icao	Airport ICAO code. · e.g. EGKK

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/data/airports/EGKK/status"

Sessions(9)

PFATC sessions

·sessions.network_pfatc

GET/sessions/network/pfatc/{sessionId}

One PFATC network session (sanitized): airport, runway, counts, controller public profile. Not limited to sessions you own.

Returns application/json

Path parameters

sessionId

Session identifier. · e.g. f0a25bbc

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/network/pfatc/f0a25bbc"

PFATC sessions

·sessions.network_pfatc

GET/sessions/network/pfatc

JSON array of PFATC network sessions (sanitized). Optional airport (ICAO), page, limit.

Returns application/json

Query parameters

airport	Optional · Filter to one airport ICAO (4 letters). · e.g. EGKK
page	Optional · Page number (default 1). · e.g. 1
limit	Optional · Page size (max 100, default 50). · e.g. 50

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/network/pfatc"

Network overview

·sessions.network_overview

GET/sessions/network/overviewv2+ only

Every PFATC session network-wide that was created in the last 4 hours or has had flight activity in the last 4 hours. A live connected controller is not required. Each session includes nested flights updated in the last 30 minutes (sanitized), connected-controller list (if any), and decoded ATIS. Also includes totalActiveSessions, totalFlights, arrivalsByAirport (flights grouped by arrival ICAO across every session), and lastUpdated. Not limited to sessions you own.

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/network/overview"

Network overview

·sessions.network_overview

GET/sessions/network/flightsv2+ only

Flat JSON array of every flight updated in the last 30 minutes, across every PFATC session network-wide that was created or flight-active in the last 4 hours. Each flight is annotated with sessionId and departureAirport. Not limited to sessions you own.

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/network/flights"

Read session

·sessions.read

GET/sessions/{sessionId}

Session metadata without accessId — the join code is only ever returned once, from POST /sessions at creation time. Save it then if you'll need it.

Returns application/json

Path parameters

sessionId

Session identifier. · e.g. f0a28bac

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f0a28bac"

Update session

·sessions.update

PUT/sessions/{sessionId}

Updates a session you own. Returns the updated session (same shape as GET /sessions/{sessionId}), plus a decoded atis object ({ letter, text }) reflecting the current ATIS after the update.

Returns application/json

Path parameters

sessionId

Session you own. · e.g. f0a25bac

Request body

Every field is optional so send only what changed, but at least one must be present (400 if the body has none of these). customName (letters/digits/spaces/hyphens/underscores only, max 50 chars — other characters are stripped), activeRunway (departure runway — see GET /data/airports/{icao}/runways; rejected with 400 if not a real runway at this session's airport), arrivalRunway (same validation as activeRunway), atisLetter + atisText (must be sent together — 400 if only one is present; atisLetter is a single A-Z letter, atisText max 2000 characters, free text — this sets a custom ATIS directly, it does not call the ATIS generator). airportIcao cannot be changed here.

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -X PUT -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"customName":"hykkas wet dream of a session","activeRunway":"26L","arrivalRunway":"26L","atisLetter":"C","atisText":"LONDON GATWICK AIRPORT INFORMATION C...  0150Z...  WIND CALM...  CAVOK...  TEMPERATURE 11, DEWPOINT 8...  QNH 1022, ALTIMETER 3018...  LANDING AND DEPARTING RUNWAY 26L...  EXPECT SIMULTANEOUS ILS AND VISUAL APPROACH RUNWAY 26L...  ADVISE CONTROLLER ON INITIAL CONTACT THAT YOU HAVE INFORMATION C... "}' "https://pfcontrol.com/api/ext/v2/sessions/f0a25bac"

Request body example

{"customName":"hykkas wet dream of a session","activeRunway":"26L","arrivalRunway":"26L","atisLetter":"C","atisText":"LONDON GATWICK AIRPORT INFORMATION C...  0150Z...  WIND CALM...  CAVOK...  TEMPERATURE 11, DEWPOINT 8...  QNH 1022, ALTIMETER 3018...  LANDING AND DEPARTING RUNWAY 26L...  EXPECT SIMULTANEOUS ILS AND VISUAL APPROACH RUNWAY 26L...  ADVISE CONTROLLER ON INITIAL CONTACT THAT YOU HAVE INFORMATION C... "}

List my sessions

·sessions.list

GET/sessions

JSON array of sessions you created. Includes apiManaged when the session was created via the developer API.

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions"

Create session

·sessions.create

POST/sessions

Creates a session tied to your user and this API key (API-managed). Returns session id and metadata, plus accessId (the join code) — this is the only endpoint that returns it; GET /sessions and GET /sessions/{sessionId} omit it, so save it from this response if you want to open the session in the web UI yourself.

Returns application/json

Request body

airportIcao (required — see GET /data/airports for valid ICAO codes; rejected with 400 if not an available airport), activeRunway (required — departure runway; see GET /data/airports/{icao}/runways for valid runways at this airport; rejected if not valid, also requires a departure runway to create a session), optional isPFATC, arrivalRunway (rejected if not valid; defaults to activeRunway when omitted).

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -X POST -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"airportIcao":"MDPC","isPFATC":false,"isAdvancedATC":false,"activeRunway":"08","arrivalRunway":"09"}' "https://pfcontrol.com/api/ext/v2/sessions"

Request body example

{"airportIcao":"MDPC","isPFATC":false,"isAdvancedATC":false,"activeRunway":"08","arrivalRunway":"09"}

Delete session

·sessions.delete

DELETE/sessions/{sessionId}v2+ only

Deletes a session created with this same API key. Flights already logged in the session are not deleted — they remain in place, no longer attached to a live session. Session deletion itself is not recorded in GET /flight-logs (that endpoint only covers flight-level actions); the flights left behind keep their own history.

Returns application/json

Path parameters

sessionId

Session you own, created with this same API key. · e.g. f0a25bat

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -X DELETE -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f0a25bat"

Flights(6)

Manage network flights

·flights.network_manage

PUT/sessions/network/flightsv2+ only

Batch-updates flights on any PFATC session network-wide. Is not limited to sessions created with this API key. Returns { results: [...] }, one entry per requested update in the same order, each either { sessionId, flightId, ok: true, flight } or { sessionId, flightId, ok: false, error }. A failure on one item does not affect the others. Max 25 updates per request.

Returns application/json

Request body

JSON object: { "updates": [{ "sessionId", "flightId", "fields": { ... } }, ...] }, max 25 updates. fields uses the same camelCase names the API returns, restricted to: callsign, remark, squawk, cruisingFL, clearedFL, runway (see GET /data/airports/{icao}/runways — rejected for that item if not a runway at the flight's current departure airport), stand, gate, sid, star (see GET /data/airports/{icao}/sids and /stars), reqAt (ISO timestamp or null), reqPhase (one of C, P, T, G, or null), clearance (boolean) — the same set an event controller can edit from the live Overview page. Any other field is silently ignored. This action is logged — see GET /flight-logs.

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -X PUT -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"updates":[{"sessionId":"f0a25bbc","flightId":"da8dd215","fields":{"runway":"26L","clearance":true}},{"sessionId":"ccf3ad9f","flightId":"cdd08ab1","fields":{"squawk":"2265"}}]}' "https://pfcontrol.com/api/ext/v2/sessions/network/flights"

Request body example

{"updates":[{"sessionId":"f0a25bbc","flightId":"da8dd215","fields":{"runway":"26L","clearance":true}},{"sessionId":"ccf3ad9f","flightId":"cdd08ab1","fields":{"squawk":"2265"}}]}

Read flight

·flights.read

GET/sessions/{sessionId}/flights/{flightId}

Single flight JSON (sanitized).

Returns application/json

Path parameters

sessionId	Session identifier. · e.g. f0a25bbc
flightId	Flight identifier (8-character alphanumeric). · e.g. da8dd255

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f0a25bbc/flights/da8dd255"

Update flight

·flights.update

PUT/sessions/{sessionId}/flights/{flightId}

Updated flight JSON (sanitized). Only allowed for sessions created with this same API key.

Returns application/json

Path parameters

sessionId	Session identifier. · e.g. f0a25bbc
flightId	Flight identifier (8-character alphanumeric). · e.g. da8dd255

Request body

Every field is optional; send only what changed. Complete accepted field list: callsign, aircraft, departure, arrival (ICAO — see GET /data/airports; rejected with 400 if not a real airport), flightType (IFR/VFR), route, sid, star (see GET /data/airports/{icao}/sids and /stars), runway (see GET /data/airports/{icao}/runways — rejected with 400 if not a real runway at the flight's departure airport, using the new departure if you're also changing it in the same request), cruisingFL, clearedFL, squawk, wtc, status, remark, clearance (boolean), stand, gate, hidden (boolean), pdcRemarks, reqAt (ISO timestamp or null), reqPhase (one of C, P, T, G, or null). Unrecognized fields are silently ignored. This action is logged — see GET /flight-logs.

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -X PUT -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"status":"ACTIVE","runway":"26L","squawk":"1234"}' "https://pfcontrol.com/api/ext/v2/sessions/f0a25bbc/flights/da8dd255"

Request body example

{"status":"ACTIVE","runway":"26L","squawk":"1234"}

List session flights

·flights.list

GET/sessions/{sessionId}/flights

JSON array of flights

Returns application/json

Path parameters

sessionId

Session you own (created_by matches key owner). · e.g. f1a25bac

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f1a25bac/flights"

Create flight

·flights.create

POST/sessions/{sessionId}/flights

Creates a flight; returns sanitized flight (no ACARS token in response).

Returns application/json

Path parameters

sessionId

Session you own. · e.g. f0a25bac

Request body

Required: callsign, aircraft, arrival (ICAO — see GET /data/airports; rejected with 400 if not real), cruisingFL. Rejected with 400 if any are missing. Everything else is optional. Accepted fields: callsign, aircraft, flightType (IFR/VFR, defaults to IFR when omitted), arrival (ICAO; rejected if not real), alternate (ICAO; rejected if not real), route, sid (see GET /data/airports/{icao}/sids — auto-generated from the session's airport when omitted), star (see GET /data/airports/{icao}/stars — not auto-filled, null unless you set it), runway (see GET /data/airports/{icao}/runways — defaults to the session's active runway when omitted; rejected with 400 if not a real runway at the session's airport), cruisingFL, clearedFL, stand, gate, remark, flightPlanTime (ISO timestamp, defaults to now), status (defaults to PENDING when omitted), clearance (boolean, defaults to false), hidden (boolean). departure, squawk, wtc, and id are always server-generated, and any value you send for departure/squawk/wtc/id is ignored. This action is logged — see GET /flight-logs.

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -X POST -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"callsign":"BAW123","aircraft":"A320","flightType":"IFR","arrival":"MDPC","cruisingFL":"350"}' "https://pfcontrol.com/api/ext/v2/sessions/f0a25bac/flights"

Request body example

{"callsign":"BAW123","aircraft":"A320","flightType":"IFR","arrival":"MDPC","cruisingFL":"350"}

Delete flight

·flights.delete

DELETE/sessions/{sessionId}/flights/{flightId}v2+ only

Deletes one flight. Only allowed for sessions created with this same API key (same rule as flight updates). This action is logged — see GET /flight-logs.

Returns application/json

Path parameters

sessionId	Session you own, created with this same API key. · e.g. f0a25bac
flightId	Flight identifier to delete (8-character alphanumeric). · e.g. da8dd215

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -X DELETE -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/sessions/f0a25bac/flights/da8dd215"

Ratings(1)

Controller rating stats

·ratings.controller_stats

GET/ratings/controllers/{controllerId}/stats

Aggregate rating count and average for a controller, keyed by their app user id. 404 if controllerId does not match a real user; averageRating/ratingCount are 0 for a real user with no ratings yet.

Returns application/json

Path parameters

controllerId

The controller's user id · e.g. 123456789012345678

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/ratings/controllers/123456789012345678/stats"

Notifications(1)

Active notifications

·notifications.read

GET/notifications/active

Public active announcements (same fields as web homepage feed; no admin-only data).

Returns application/json

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/notifications/active"

Flight logs(1)

Own session flight logs (metadata)

·flight_logs.read

GET/flight-logs

Sanitized flight change audit entries for sessions you own (id, timestamps, action, session/flight ids only; no IP, no old/new payload text).

Returns application/json

Query parameters

sessionId	Optional · Filter to one owned session. · e.g. f0a25bbc
page	Optional · Page number (default 1). · e.g. 1
limit	Optional · Page size (max 100, default 50). · e.g. 50

Headers

Authorization	Optional · Bearer token: `Authorization: Bearer pfc_live_...`
X-Api-Key	Optional · Alternative to Authorization: send the raw `pfc_live_...` secret in this header.
Accept	Optional · Optional; responses are JSON (`application/json`).

cURL

curl -sS -H "Authorization: Bearer YOUR_PFC_LIVE_KEY" -H "Accept: application/json" "https://pfcontrol.com/api/ext/v2/flight-logs"

WebSockets(1)

Network Flights (live push)

·sessions.network_overview

WS/sockets/ext/network-flights

Server-to-server push channel for GET /sessions/network/flights, use this instead of polling that endpoint. Read-only: there is no client-to-server event on this socket. Requires the same sessions.network_overview scope as the REST endpoint. Not for browser clients, listeners with Origin headers will be rejected. Max 5 concurrent connections per API key.

Authentication

Pass your key as the socket.io `auth.token` option (or a `token` query param as a fallback) — the same pfc_live_... secret used for REST calls. Connections with a missing, invalid, or a under-scoped key are rejected before any data is sent. Connections with Origin headers are rejected before any data is sent.

Events

flights	server-to-client · Same JSON array shape as GET /sessions/network/flights. Sent once immediately on connect, then again every ~5 seconds while connected.
connect_error	server-to-client · Fired instead of a successful connection if auth fails; err.message explains why (invalid/missing key, missing scope, or too many concurrent connections for this key).

Example (Node / socket.io-client)

import { io } from 'socket.io-client';

const socket = io('https://pfcontrol.com', {
  path: '/sockets/ext/network-flights',
  auth: { token: 'pfc_live_...' },
  transports: ['websocket'],
});

socket.on('flights', (flights) => {
  // same shape as GET /sessions/network/flights
});
socket.on('connect_error', (err) => console.error(err.message));