API reference

Machine-readable reference for the BravoEcho aviation data API. Written for coding agents and for people who prefer one file to a docs site. Everything here is the current contract; fields may be added, existing fields will not be renamed or removed without a version bump.

Status, per product (the same on the REST API and, for agents, on the MCP server; see MCP):

  • Available (production): RAIM prediction, route check, trajectory and world map, and the RAIM reference endpoints. Counted for pricing. The flight briefing pack and alerts count as the services they use: one request for each part they run, each counted as its own service is (so today only their RAIM part is counted).
  • Beta (live, free while in beta, not counted or billed; answers may change shape and coverage may be partial; before a beta service starts counting, the organisation gets at least 7 days' notice by email): the NOTAM archive (search, route, detail, history), the weather archive (METAR, TAF, hazards, weather along a route, winds aloft along a route), the airspace a flight enters (special use airspace, Class B, C and D, TFRs; United States), airports, navaids and route strings, mass and balance and a navlog on the aircraft data you send, and alerts by webhook on a flight.

Every /v1 response says which it is in two headers: X-Product-Status (ga or beta) and X-Metered (true or false). The OpenAPI 3.1 description, https://bravoecho.ai/openapi.json, has every Available and Beta endpoint with x-status: available | beta on each operation.

Coverage: RAIM is worldwide. METAR and TAF are worldwide (every station NOAA's Aviation Weather Center reports). NOTAMs (the FAA's domestic set and the international NOTAMs the FAA distributes), route strings (named fixes, airways and procedures come from the FAA CIFP, US only) and en-route weather advisories (G-AIRMET and CWA are US products; international SIGMETs are worldwide) are fullest in the United States for now.

Server-side only: call the API from server-side code (a backend route or an edge function), never from a browser, and keep the key in a secret. The API sends no CORS headers, so a browser on another origin cannot read its answers; a key in a web page or a client bundle is a leaked key.