Introduction & Authentication

The Prostagma API allows you to integrate your club's flight data, aircraft, members, templates, documents, and subscription management with external tools, mobile apps, or custom dashboards. The API is RESTful, accepts and returns JSON, and requires an API key for access.

Authentication:
You can generate API keys from your Account page. Each key can be scoped to specific granular permissions per category: read, write (create/update), and delete. Include this key in the header of every HTTP request you make:

Authorization: Bearer sk_your_api_key_here

Clubs:
If your account belongs to multiple clubs, you can specify which club to query by appending ?club_id=X to the URL. If omitted, the API defaults to your primary club. You cannot access data for clubs you are not a member of.

Response Format:
Every response from the API is formatted as JSON. A successful request returns HTTP 200/201 and a "status": "success" field. A failed request returns HTTP 4xx/5xx and an "error" field.

Subscription tier:
API access is a Professional-tier feature. Every endpoint checks this live against the club being queried (?club_id=), not just at the moment a key was generated - if a club's subscription is downgraded below Professional, its existing keys stop working against every endpoint except Subscription, so an admin can still use the API to upgrade back.

Roles:
Every endpoint also checks the caller's actual role in the club, in addition to the key's own read/write/delete scope - a key can never do more than its owner's role allows on the web. In particular: pilots get read-only access, and only ever to their own flights; actions the web app restricts to admins (inviting/removing members, changing roles, viewing billing details, editing club settings) are admin-only via the API too.

Inactive membership:
A club can have suspended ("inactive") members - this happens automatically when a club is downgraded to Basic and has more than 3 active accounts (see the account cap under Adding Member). If the API key's owner has an inactive role in the club being queried, every endpoint rejects the request with 403, the same as if they weren't a member at all - reactivating them (back to dispatcher/pilot/admin) has to happen through Updating Member Role first.