Checklist Management API
Create, edit, delete and list user, virtual-airline and community-shared checklists, and let aircraft profiles reference any checklist — built-in or custom — by a single stable id.
Overview
A checklist is a titled set of challenge/response pages (see the Checklist JSON Format for the full schema). There are four kinds of checklists:
| Kind | Owner | Editable by |
|---|---|---|
| User | Individual user |
That user via checklistSave /
checklistDelete
|
| VA | Virtual airline | VA admin with matching VA scope only |
| Community | Any user with shareCommunity = true |
Read-only by everyone; edited only by the owner |
| Default |
Built into the API version folder
(AcftChecklists/*.json)
|
Read-only for everyone. Listable, rateable and cloneable, but never editable or deletable through this API. |
Concepts & Data Model
Every checklist — regardless of where it is stored — is identified by a single checklist id, the value that aircraft profiles reference (see Aircraft Profile Integration):
| Id form | Meaning |
|---|---|
<uuid> |
A user, VA, or community checklist stored in the database
(e.g. 15c60bc5-57b9-47bd-af0f-f250f903798c).
|
default:{folder}:{file}
|
A built-in default checklist shipped inside a given API
version folder (e.g.
default:API_1_3_6:380_generic_checklist).
|
Fields
| Field | Type | Description |
|---|---|---|
checklistId |
string | Stable id — a uuid or a synthetic default id. |
name |
string | Display name. Required, max 150 chars. |
version |
string |
Free-form version tag chosen by the author, e.g.
"1.0". Max 30 chars.
|
description |
string|null | Optional description. Max 255 chars. |
basedOn |
string|null |
Optional provenance: the source checklistId
this one was cloned from (see
Cloning a default checklist).
|
shareCommunity |
boolean |
When true, appears in
communityChecklists for every user and can be
rated by other users.
|
ratingAverage |
number |
Average of all 1–5 star ratings, rounded to 2 decimals.
0 when unrated.
|
ratingCount |
integer | Number of ratings received. |
isDefault |
boolean |
true for built-in checklists. Read-only:
checklistSave/checklistDelete reject
these ids with READ_ONLY_DEFAULT.
|
isMine |
boolean |
Computed per caller. true when the checklist is
owned by the caller (or their active VA).
|
Storage Model & Unified Resolver
User, VA and community checklists are stored in the database (full
JSON + metadata), keyed by a UUID
checklistId. The built-in
default checklists are deliberately
not migrated into the database — they remain
version-folder files (AcftChecklists/*.json), exactly
like every other version-scoped asset in this API, so they stay
git-authored, version-isolated, and fully backward-compatible with
older clients.
What makes this "one way of handling it" despite the two storage locations is that every read — every endpoint below and the aircraft profile loader — goes through a single resolver function, and every write is validated by a single structure validator. Only the storage location differs; the code path does not.
To customize a built-in checklist, call checklistGet
with the default's synthetic id, then
checklistSave the returned JSON as a new checklist
with basedOn set to that same synthetic id. The
original default file is never modified.
VA & Admin Rules
VA checklist writes (checklistSave /
checklistDelete with isVA: true) use the
exact same admin gate as
VA fleet management:
-
VA-scoped admin (
va_scope = VA_ONLY): can only manage checklists for their own virtual airline.vaNameis optional; it must match their VA if provided. -
Full-scope admin / superadmin
(
va_scope = FULL): can manage any VA's checklists, but must passvaNameexplicitly.
Regular users attempting isVA: true receive
403 FORBIDDEN. VA members who are not admins can read
their VA's checklists but cannot edit or delete them.
Community Sharing & Ratings
Sharing is opt-in: a checklist only appears in
communityChecklists when its owner sets
shareCommunity: true. Community checklists (and every
default checklist) can be rated 1–5 stars via
checklistRate. Rules:
- You cannot rate a checklist you own.
- A non-shared user or VA checklist cannot be rated by anyone other than its owner — and owners cannot rate their own.
- Re-rating updates your existing rating rather than adding a duplicate (one rating per user per checklist).
-
communityChecklistsis sorted by average rating, then by rating count, so the best-rated shared checklists surface first.
checklistList
Return the authenticated user's checklists, their active VA's checklists, the community pool, and the built-in default checklists shipped with the active API version.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
query |
string | Required | Must be "checklistList" |
Example
curl -X POST "https://api.virtualperformancetool.com/api" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "Content-Type: application/json" \
-d '{ "query": "checklistList" }'
Response
{
"success": true,
"data": {
"userChecklists": [
{
"checklist_id": "15c60bc5-57b9-47bd-af0f-f250f903798c",
"name": "737-600W Custom",
"version": "1.1",
"share_community": 0,
"ratingAverage": 0,
"rating_count": 0,
"isMine": true
}
],
"vaChecklists": [],
"communityChecklists": [],
"defaultChecklists": [
{
"file": "380_generic_checklist",
"checklistId": "default:API_1_3_6:380_generic_checklist",
"name": "380 Airbus Checklist",
"description": "A generic checklist for the Airbus 380.",
"version": "1.0",
"ratingAverage": 0,
"ratingCount": 0
}
]
}
}
checklistGet
Fetch one checklist by id — a database uuid, a default synthetic id, or (for back-compat) a bare default filename.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
query |
string | Required | Must be "checklistGet" |
data.checklistId |
string | Required |
uuid or
default:{folder}:{file}
|
Example
curl -X POST "https://api.virtualperformancetool.com/api" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "checklistGet",
"data": { "checklistId": "default:API_1_3_6:380_generic_checklist" }
}'
Response
{
"success": true,
"data": {
"checklistId": "default:API_1_3_6:380_generic_checklist",
"name": "380 Airbus Checklist",
"version": "1.0",
"description": "A generic checklist for the Airbus 380.",
"basedOn": null,
"isDefault": true,
"isMine": false,
"shareCommunity": true,
"ratingAverage": 0,
"ratingCount": 0,
"checklist": {
"name": "380 Airbus Checklist",
"checklists": [
{
"title": "BEFORE START",
"order": 0,
"items": [
{ "challenge": "SECURITY INSPECTION", "order": 0, "response": "COMPLETE (BOTH)", "isLine": false, "selfDetected": false, "note": null }
]
}
]
}
}
}
A non-shared user or VA checklist can only be fetched by its
owner (or, for VA checklists, a member of that VA). Everyone
else receives 403 FORBIDDEN.
checklistSave
Create a new checklist (omit checklistId) or update an
existing one you own. The full checklist JSON is validated for
structural integrity before being stored — see
Checklist JSON Format.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
query |
string | Required | Must be "checklistSave" |
data.checklistId |
string | Optional | Omit to create a new checklist; provide a uuid you own to update it. |
data.name |
string | Required | Display name, max 150 chars. |
data.version |
string | Optional | Defaults to "1.0". Max 30 chars. |
data.description |
string | Optional | Max 255 chars. |
data.basedOn |
string | Optional | Provenance id (e.g. the default id you cloned from). |
data.isVA |
boolean | Optional |
true to save a VA-owned checklist. Requires
VA admin privileges.
|
data.vaName |
string | Optional |
Target VA name; required for full-scope admins when
isVA = true.
|
data.shareCommunity |
boolean | Optional |
When true, appears in
communityChecklists and becomes rateable.
|
data.checklist |
object | Required |
The full checklist JSON (authored client-side). Must
contain a non-empty checklists array; see
Checklist JSON Format.
|
Example — create
curl -X POST "https://api.virtualperformancetool.com/api" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "checklistSave",
"data": {
"name": "737-600W Custom",
"version": "1.1",
"shareCommunity": false,
"checklist": {
"version": "1.1",
"checklists": [
{
"title": "COCKPIT PREPARATION",
"order": 0,
"items": [
{ "challenge": "FUEL QUANTITY", "order": 0, "response": "___KG/LB" }
]
}
]
}
}
}'
Response
{
"success": true,
"data": {
"checklistId": "15c60bc5-57b9-47bd-af0f-f250f903798c",
"saved": true
}
}
checklistDelete
Remove a checklist you own (or, with isVA: true, one
your VA owns). Also removes its ratings. Default checklists cannot
be deleted — the request is rejected with
READ_ONLY_DEFAULT.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
query |
string | Required | Must be "checklistDelete" |
data.checklistId |
string | Required | uuid of the checklist to delete. |
data.isVA |
boolean | Optional |
true to delete a VA-owned checklist. Requires
VA admin privileges.
|
data.vaName |
string | Optional |
Target VA name; required for full-scope admins when
isVA = true.
|
Example
curl -X POST "https://api.virtualperformancetool.com/api" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "checklistDelete",
"data": { "checklistId": "15c60bc5-57b9-47bd-af0f-f250f903798c" }
}'
Response
{
"success": true,
"data": {
"checklistId": "15c60bc5-57b9-47bd-af0f-f250f903798c",
"deleted": true
}
}
checklistRate
Rate a community-shared or default checklist 1–5 stars. Re-rating updates your existing rating.
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
query |
string | Required | Must be "checklistRate" |
data.checklistId |
string | Required | uuid or default synthetic id. |
data.rating |
integer | Required | Integer from 1 to 5. |
Example
curl -X POST "https://api.virtualperformancetool.com/api" \
-H "Authorization: Bearer YOUR_JWT_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "checklistRate",
"data": {
"checklistId": "default:API_1_3_6:380_generic_checklist",
"rating": 5
}
}'
Response
{
"success": true,
"data": {
"checklistId": "default:API_1_3_6:380_generic_checklist",
"rating": 5,
"ratingAverage": 5,
"ratingCount": 1
}
}
Aircraft Profile Integration
An aircraft profile's checklists block gains an
optional checklistId field. When present, the
performance API resolves it through the exact same unified resolver
used by checklistGet, and populates
checklists.data with the result:
{
"checklists": {
"isChecklistAvailable": true,
"isChecklistActive": true,
"checklistId": "15c60bc5-57b9-47bd-af0f-f250f903798c"
}
}
When checklistId is omitted, profiles fall back to the
legacy checklists.file field (a bare default filename)
— existing profiles keep working unchanged.
A profile referencing a private checklist only resolves
checklists.data when the caller is the checklist's
owner, a member of its owning VA, or the checklist is
community-shared or a default. Otherwise
checklists.data is left unset.
Error Codes
| Code | HTTP | Description |
|---|---|---|
AUTH_REQUIRED |
401 | No valid JWT token provided. |
MISSING_CHECKLIST_ID |
400 |
checklistId is required but was not provided.
|
INVALID_CHECKLIST_ID |
400 | The provided id is not a valid uuid. |
READ_ONLY_DEFAULT |
403 |
Attempted to save or delete a default
(default:...) checklist id.
|
INVALID_NAME |
400 | name is missing or exceeds 150 characters. |
INVALID_VERSION |
400 | version exceeds 30 characters. |
INVALID_STRUCTURE |
400 |
The checklist payload failed structural
validation (missing/invalid checklists,
title, or challenge fields, or
exceeds size limits).
|
INVALID_RATING |
400 | rating is not an integer between 1 and 5. |
NOT_SHARED |
403 | Attempted to rate a checklist that is not community-shared (and is not a default). |
CANNOT_RATE_OWN |
403 | Attempted to rate a checklist you (or your VA) own. |
FORBIDDEN |
403 | VA checklist write attempted without admin privileges, a VA-scoped admin targeted a different VA, or the caller lacks access to a private checklist. |
MISSING_VA_NAME |
400 |
vaName must be provided when the caller is a
full-scope VA admin.
|
NO_VA_ASSIGNED |
403 | The VA-scoped admin account has no virtual airline assigned. |
NOT_FOUND |
404 | No checklist matches the given id, or it is not accessible to the caller. |
DB_ERROR |
500 | Database insert / update / delete failed. |