Integration lifecycle for third-party providers
This page describes what it takes to become an approved Leon integration partner: how the process starts, what happens at each stage, what we check before we let an integration go live, what it costs, and what limits and rules apply once you are in production.
It is aimed at third-party software providers — companies whose product is used by Leon operators (marketplaces, EFBs, crew training or rostering tools, flight support providers, technical logbooks, SMS systems, and so on).
Everything below applies when your software is offered to Leon operators as a product. In that case OAuth 2.0 Authorization Code Grant is mandatory — static API keys are not permitted.
Lifecycle at a glance
| # | Stage | Who drives it | Environment | Typical outcome |
|---|---|---|---|---|
| 1 | Registration | You (registration form) | — | client_id, client_secret, scope set, developer account |
| 2 | Development & testing | You | Sandbox only | Working integration |
| 3 | Sign-off (demo) | You + Leon | Sandbox → Production | Approval, production redirect URIs, final scopes |
| 4 | Customer onboarding | You + operators | Production | Operators connect via Add-ons |
| 5 | Operation & maintenance | You | Production | Ongoing use, schema tracking |
| 6 | Change or termination | Either party | — | Scope/URI changes, or access revoked |
At any point in this process, if you have questions or run into problems, contact us through the Customer Portal.
Stage 1 — Registration
Registration is done through the Leon Customer Portal: OAuth Client Registration form. If you open a different request type by mistake, ask Support to convert it — the correct type is API — OAuth Client Registration. The API Terms of Service are accepted in the service desk as part of this request; we record the date and scope of your acceptance.
By accepting the Terms you also represent that you already have at least two clients in common with Leon Software — prospects do not count. We may ask you for evidence of this, and we verify it before granting production sign-off.
Warning [Acceptance of the Terms is not an approval] Accepting the API Terms of Service does not guarantee that your integration will be approved, implemented or maintained. Leon decides at its sole discretion whether and to what extent to proceed, and acceptance gives rise to no claim against Leon in this respect.
What you provide
- Application name
- Application type (marketplace, flight support, EFB, SMS, pilot's logbook, crew rostering, technical logbook, other)
- Redirect URI(s) — where Leon sends the browser after authorization. All redirect URIs must use
https:// - Description and a short lead — this is what operators will read in the Add-ons panel
- Application / company logo
- Phone number used to secure the delivery of your client secret
- Contact details and company website
What you receive
| Item | Notes |
|---|---|
client_id | Sent by e-mail to the person who requested registration |
client_secret | Sent separately as a one-time link to the e-mail address given in the form. It can be opened only once and is not recoverable afterwards — store it immediately in your secret manager |
| Scope set | The list of permissions available to your integration, based on your application type |
| Developer account | A user account on the sandbox environment, usable from the next day, for building and testing |
The scope set is derived from what your category of application genuinely needs. We do not grant scopes "just in case" — if your integration later needs an additional scope, ask for it and explain the use case.
Stage 2 — Development and testing on the sandbox
Until you are signed off, your client works only against the sandbox:
https://{oprId}.sandbox.leon.aero
- The sandbox contains a copy of production data and is refreshed once a day at 03:00 UTC.
- Production (
https://{oprId}.leon.aero) will reject your client until sign-off. - If you do not yet have an operator willing to lend you a sandbox account, ask Support — test accounts with dummy data can be arranged for integrators.
The technical details of the flow — authorization endpoint, token endpoint, token lifetimes, example requests — are on the Authentication with OAuth2 code grant page. Two things worth internalising early, because they come up in the sign-off:
- Your backend must be able to store the client secret safely. All third-party clients are registered as confidential clients.
- Access tokens must be reused for their full validity. Requesting a fresh token per API call
will hit the token limit and start returning
429.
Who authorizes your application
| Authorization model | Approved by | Typical use |
|---|---|---|
| Operator-level access | An operator admin user | Standard operator-facing integrations |
| Personal access | The individual user | Personal apps — pilot logbooks, crew-facing tools |
| Full user-permission access | The individual user, limited to their own current Leon privileges | AI assistants / MCP-type clients |
For most integrations only users with System Admin privileges can grant consent.
Stage 3 — Production sign-off
You must not deploy your integration to production without Leon's prior sign-off. Until it is granted, the sandbox is the only environment you may use. Leon may grant, withhold or condition sign-off at its sole discretion.
When development is finished, contact Customer Support and request a demo meeting. The meeting is recorded and kept internally as reference documentation of how your system works.
What we look at
- What your product does. A short walkthrough of the application itself, not just the API calls — we need to understand what operators are buying and where Leon data ends up.
- A correctly implemented Authorization Code Grant. You demonstrate a live authorization: the consent screen, admin approval, redirect back to your app, token exchange, and a successful API call.
- Token handling. Access tokens reused until expiry, refresh token rotation working, sensible
behaviour on
401and429. - Scope discipline. The scopes you actually use match what we are about to grant you; anything unused is dropped.
- Redirect URIs. Final production URIs, all over
https://. - Add-ons presentation. Name, lead, description and logo as operators will see them.
- Eligibility evidence, if we have asked for it (the two common clients).
What changes after approval
- Your client is switched out of development mode and can authenticate against production.
- Your production redirect URIs are registered.
- Your scope set is narrowed from the permissive development set to the agreed production set.
- If your integration is public, it appears in the Add-ons panel for Leon operators. Integrations built for a single operator stay private and are not listed.
Stage 4 — Onboarding your customers
From your customers' point of view the connection looks like this:
- The operator asks you to connect their Leon account — ideally by clicking a button in your own UI.
- You redirect their admin to Leon's authorization page, built with their
oprId. The page shows your application name and the list of resources you are requesting. - The admin reviews the request and confirms with their Leon credentials. Operators using SAML SSO can confirm through their identity provider.
- The admin is redirected back to your application and the connection is live.
Operators can see the permissions granted to your application in the Add-ons panel, and can disconnect it at any time. Because the integration is built and maintained by you, you are the operator's first point of contact for connection issues — Leon Support will redirect them to you.
Stage 5 — Operating the integration
Rate limits
The total volume of all API requests made by your integration must not exceed:
| Window | Limit |
|---|---|
| Per minute | 150 requests |
| Per hour | 4 500 requests |
| Per 24 hours | 54 000 requests |
Handling higher volumes requires prior approval from Leon and may be subject to additional arrangements — ask before you build something that needs them. If you exceed the limits, we will notify you and ask you to stop; you then have 14 days from receipt of that notice to bring your usage back in line.
Leon reserves the right to monitor your use of the API.
Token limits
These are separate from the request limits above and are enforced by the OAuth server:
| Item | Limit |
|---|---|
| Authorization code | Single use, valid 10 minutes |
| Access token | Valid 30 minutes |
| Active access tokens per refresh token | 500 — exceeding it returns 429 Too Many Requests with a Retry-After header |
| Refresh token | Valid 30 days from its last use |
Keeping up with schema changes
A new Leon version is released every two weeks. We aim to keep changes backward compatible, but a breaking change can occasionally occur. Validate your queries automatically against the staging schema:
http://api-schema-doc.s3-website-eu-west-1.amazonaws.com/schema-staging.json
The staging schema is generated daily after 07:00 UTC. See the validation example.
Changing an existing integration
Adding a redirect URI, requesting an additional scope, changing your Add-ons description or logo, or rotating your client secret — all of these go through Customer Support. Significant changes in what your integration does with Leon data may require a fresh demo.
Stage 6 — Change and termination
- The Terms run for an indefinite period and either party may terminate with one month's notice.
- Leon may terminate without notice if you breach any material provision, including the confidentiality obligations.
- Leon may terminate with immediate effect where it decides not to proceed with the integration — for example if you do not provide the evidence of two common clients, or do not obtain sign-off.
- Using the API in a way that amounts to charter brokerage or availability aggregation (see Prohibited use) is a material breach and allows Leon to revoke the licence immediately, without notice.
- On termination you must immediately stop using the API and delete all copies of the API and related documentation, or return them to Leon.
Leon may amend the API Terms of Service. You will be notified, and the amended Terms take effect 14 days after notification. If you do not accept an amendment you may terminate with immediate effect before that period lapses, in which case the amendment does not bind you.
Commercial terms
The API licence is free of charge. No licence fees, no setup fees, no other payments are due for the licence granted under the API Terms of Service. You are responsible for any taxes arising in connection with your own use.
Two carve-outs, repeated here because they are the ones integrators most often miss:
- Marketplace and flight support / supplier integrations require a separate agreement with Leon and are subject to a fee.
- Access to empty legs and aircraft availability data requires a separate, paid agreement.
If either applies to your product, raise it through the Customer Portal and we will route you to the right people.
The licence is limited, non-exclusive, non-transferable, revocable, and carries no right to sub-license. Leon owns and retains all intellectual property rights to the API.
Prohibited use
The API may not be used to operate — or to supply data to — services that:
- let end users search, compare, request quotes for, or book charter flights or aircraft services from multiple operators;
- aggregate or display aircraft availability to third parties;
- otherwise act as an intermediary between aircraft operators and potential customers in connection with flight bookings;
- extract aircraft availability data in order to enable any of the above.
Doing so is a material breach and results in immediate revocation of the licence without notice. If your product is a marketplace, this is exactly what the separate agreement described in Commercial terms exists for — contact us through the Customer Portal first.
Also prohibited:
- Any use that undermines, or could undermine, the security of Leon's services.
- Defeating, avoiding, bypassing, removing, deactivating or otherwise circumventing API protection mechanisms.
- Authenticating by any method other than the one designated by Leon. For third-party providers that means OAuth only — static API keys are not permitted.
- Deploying to production before sign-off.
AI agents and MCP
Leon may expose the API through the Model Context Protocol (MCP) or another protocol that lets AI models, tools or agents call the API. Under the Terms this is treated as part of the API and is subject to everything on this page — licence scope, security restrictions and the sign-off requirement included. See Using the MCP Server in Leon.
Three consequences worth flagging if you plan to put an LLM in front of Leon data:
- Anything an agent sends is treated as sent by you. Data, instructions and requests transmitted by a model, tool or agent that you use, configure or instruct count as your own, even when the model generated them autonomously. You are responsible for supervising, verifying and validating them before they reach the API.
- No warranty on third-party AI components. Leon does not warrant the interoperability, accuracy, security or reliability of any third-party model, tool, protocol implementation or agent, and does not endorse any particular one.
- You carry the risk. Leon is not liable for data corruption, data loss or incorrect processing resulting from your use of an AI integration, and you indemnify Leon against claims arising from inaccurate, corrupted or unlawful data sent to the API through it — including claims raised by other Leon clients.
Compliance of your AI usage with applicable law, and obtaining any required consents or legal bases, is your responsibility.
Confidentiality and secrets
You undertake to keep confidential any non-public information about Leon, its customers and its cooperating entities that you obtain during the cooperation — know-how, customer and business data, internal documents, and financial information. The obligation applies during the term and for five years after expiry or termination, and you are fully liable for damages caused by its breach.
Practically:
- Treat
client_secretas a production credential. It is delivered once, via a single-use link, and cannot be retrieved later. If it leaks, tell us and request a rotation. - Never embed the secret in a mobile app, browser bundle or public repository. Third-party clients are confidential clients; the secret belongs on your server.
- Operator data you fetch through the API belongs to that operator. Do not reuse it across customers.
Liability — summary
Leon's cumulative liability for all claims arising out of or in connection with the API Terms of Service is capped at EUR 2 500, and Leon is not liable for lost profits (lucrum cessans). These limits do not apply to damage caused intentionally by Leon or to personal injury. The free-of-charge licence is granted in reliance on these limitations.
Getting help
| Need | Where to go |
|---|---|
| Register a new OAuth client | Registration form |
| Sign-off / demo meeting, scope or redirect URI changes, sandbox accounts | Customer Portal |
| Marketplace, flight support, empty legs or availability access | Customer Portal |
| Anything else, at any stage | Customer Portal |
| Technical reference | API reference, Scope list, Sample queries |
Info This page is a practical summary written for integrators. It does not replace the API Terms of Service, which is the binding document and prevails in case of any discrepancy. The Terms are accepted electronically in the Leon service desk when you request an integration, and Leon records the date and scope of that acceptance. The Terms are governed by Polish law, with jurisdiction at the court competent for Leon Software's registered seat in Warsaw.