One endpoint, one response shape.

curl -sG "https://flight-api.dev/api/v1/flights/status" \
  -H "Authorization: Bearer $FLIGHT_API_KEY" \
  --data-urlencode "flightNumber=BA249" \
  --data-urlencode "flightDate=2026-08-14"

const params = new URLSearchParams({
  flightNumber: 'BA249',
  flightDate: '2026-08-14',
})

const response = await fetch(`https://flight-api.dev/api/v1/flights/status?${params}`, {
  headers: { Authorization: `Bearer ${process.env.FLIGHT_API_KEY}` },
})

const { success, data, message } = await response.json()
if (!success) throw new Error(message)

// data.selected is the resolved record.
console.log(data.selected?.status, data.selected?.delayMinutes, data.meta.cached)

{
  "id": "whd_7Qw1pKcRr8mF3xTz",
  "event": "clz9k2f9a0004qw2h8vjd1m0p",
  "type": "flight.delayed",
  "createdAt": "2026-09-03T11:42:07.318Z",
  "webhook": {
    "id": "clz8k2f9a0002qw2h",
    "name": "ops",
    "airports": [
      "OTP",
      "CLJ"
    ]
  },
  "airport": {
    "iata": "OTP",
    "name": "Bucharest Otopeni",
    "city": "Bucharest",
    "country": "Romania",
    "timezone": "Europe/Bucharest"
  },
  "data": {
    "flight": {
      "id": "clz9k1v2b0001qw2h",
      "flightNumber": "RO301",
      "callsign": "ROT301",
      "direction": "departure",
      "airline": {
        "name": "TAROM",
        "iata": "RO"
      },
      "aircraftType": "B738",
      "registration": null,
      "operation": "passenger",
      "origin": {
        "iata": "OTP"
      },
      "destination": {
        "iata": "LHR"
      },
      "divertedTo": null,
      "scheduledAt": "2026-09-03T12:50:00.000Z",
      "estimatedAt": "2026-09-03T13:37:00.000Z",
      "delayMinutes": 47,
      "status": "Estimated departure 16:37",
      "disruption": "delayed",
      "isCancelled": false,
      "isDiverted": false,
      "runway": null,
      "firstSeenAt": "2026-09-03T05:12:44.010Z",
      "lastSeenAt": "2026-09-03T11:42:07.301Z"
    },
    "previous": {
      "status": "Scheduled 15:50",
      "estimatedAt": null,
      "delayMinutes": null,
      "disruption": "scheduled"
    }
  }
}

import { createHmac, timingSafeEqual } from 'node:crypto'

const TOLERANCE_SECONDS = 300

export function verify(rawBody: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=', 2)))
  const timestamp = Number(parts.t)
  if (!Number.isFinite(timestamp)) return false

  // Bound the age first: the timestamp is inside the MAC, so an attacker
  // cannot backdate a captured request to keep replaying it.
  if (Math.abs(Date.now() / 1000 - timestamp) > TOLERANCE_SECONDS) return false

  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')

  const a = Buffer.from(parts.v1 ?? '')
  const b = Buffer.from(expected)
  return a.length === b.length && timingSafeEqual(a, b)
}