Developer API

API documentation

Read a user's aircraft airworthiness data, with their per-aircraft consent, over OAuth 2.1 (Authorization Code + PKCE). Register an app →

Discovery

Server metadata (endpoints, scopes, PKCE methods):

https://mytaillog.com/.well-known/oauth-authorization-server
https://mytaillog.com/api/oidc/.well-known/openid-configuration

1 · Register

Create an app under Developer API: a name, exact redirect URI(s), and the scopes you need. You get a client_id. Apps are public clients — no secret; use PKCE.

2 · Authorize

Send the user to the authorization endpoint with a PKCE challenge:

https://mytaillog.com/api/oidc/auth
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REGISTERED_URI
  &scope=openid airworthiness:read
  &code_challenge=BASE64URL(SHA256(verifier))
  &code_challenge_method=S256

They sign in, pick which aircraft to share, and are redirected back with ?code=….

3 · Exchange the code for a token

curl -X POST https://mytaillog.com/api/oidc/token \
  -d grant_type=authorization_code \
  -d code=THE_CODE \
  -d redirect_uri=YOUR_REGISTERED_URI \
  -d client_id=YOUR_CLIENT_ID \
  -d code_verifier=THE_VERIFIER

4 · Call the API

Send the access token as a bearer:

curl https://mytaillog.com/api/v1/aircraft \
  -H "Authorization: Bearer ACCESS_TOKEN"

Per-aircraft endpoints (only aircraft the user granted you):

GET /api/v1/aircraft
GET /api/v1/aircraft/{id}/airworthiness
GET /api/v1/aircraft/{id}/equipment
GET /api/v1/aircraft/{id}/hours
GET /api/v1/aircraft/{id}/oil
GET /api/v1/aircraft/{id}/weightbalance

A request for an aircraft the user didn't grant returns 404; a missing scope returns 403; a bad/expired token returns 401.

Confidential (server-to-server) apps

Check Confidential when registering to get a client secret (shown once — rotate it anytime). Server apps authenticate the token request with HTTP Basic (client_id:client_secret) in addition to PKCE:

curl -X POST https://mytaillog.com/api/oidc/token \
  -u YOUR_CLIENT_ID:YOUR_CLIENT_SECRET \
  -d grant_type=authorization_code \
  -d code=THE_CODE \
  -d redirect_uri=YOUR_REGISTERED_URI \
  -d code_verifier=THE_VERIFIER

Public apps (default) skip the secret and rely on PKCE. Either way, access is still per-aircraft and read-only.

Scopes

airworthiness:read — Airworthiness — AD/inspection status, due dates, current hours
aircraft:read — Aircraft details — tail, make/model, serial numbers, home base
equipment:read — Installed equipment & components
hours:read — Current hours (hobbs / tach)
hours:write — Add hobbs / tach readings to your aircraft (e.g. synced flight hours)
oil:read — Oil-analysis samples & wear-metal trends
weightbalance:read — Weight & balance

Log entries (the transcribed history) are never shared. All access is read-only.