Checklist Management API

Create, edit, delete and list user, virtual-airline and community-shared checklists, and let aircraft profiles reference any checklist — built-in or custom — by a single stable id.

Overview

A checklist is a titled set of challenge/response pages (see the Checklist JSON Format for the full schema). There are four kinds of checklists:

Kind Owner Editable by
User Individual user That user via checklistSave / checklistDelete
VA Virtual airline VA admin with matching VA scope only
Community Any user with shareCommunity = true Read-only by everyone; edited only by the owner
Default Built into the API version folder (AcftChecklists/*.json) Read-only for everyone. Listable, rateable and cloneable, but never editable or deletable through this API.

Concepts & Data Model

Every checklist — regardless of where it is stored — is identified by a single checklist id, the value that aircraft profiles reference (see Aircraft Profile Integration):

Id form Meaning
<uuid> A user, VA, or community checklist stored in the database (e.g. 15c60bc5-57b9-47bd-af0f-f250f903798c).
default:{folder}:{file} A built-in default checklist shipped inside a given API version folder (e.g. default:API_1_3_6:380_generic_checklist).

Fields

Field Type Description
checklistId string Stable id — a uuid or a synthetic default id.
name string Display name. Required, max 150 chars.
version string Free-form version tag chosen by the author, e.g. "1.0". Max 30 chars.
description string|null Optional description. Max 255 chars.
basedOn string|null Optional provenance: the source checklistId this one was cloned from (see Cloning a default checklist).
shareCommunity boolean When true, appears in communityChecklists for every user and can be rated by other users.
ratingAverage number Average of all 1–5 star ratings, rounded to 2 decimals. 0 when unrated.
ratingCount integer Number of ratings received.
isDefault boolean true for built-in checklists. Read-only: checklistSave/checklistDelete reject these ids with READ_ONLY_DEFAULT.
isMine boolean Computed per caller. true when the checklist is owned by the caller (or their active VA).

Storage Model & Unified Resolver

User, VA and community checklists are stored in the database (full JSON + metadata), keyed by a UUID checklistId. The built-in default checklists are deliberately not migrated into the database — they remain version-folder files (AcftChecklists/*.json), exactly like every other version-scoped asset in this API, so they stay git-authored, version-isolated, and fully backward-compatible with older clients.

What makes this "one way of handling it" despite the two storage locations is that every read — every endpoint below and the aircraft profile loader — goes through a single resolver function, and every write is validated by a single structure validator. Only the storage location differs; the code path does not.

Cloning a default checklist

To customize a built-in checklist, call checklistGet with the default's synthetic id, then checklistSave the returned JSON as a new checklist with basedOn set to that same synthetic id. The original default file is never modified.

VA & Admin Rules

VA checklist writes (checklistSave / checklistDelete with isVA: true) use the exact same admin gate as VA fleet management:

  • VA-scoped admin (va_scope = VA_ONLY): can only manage checklists for their own virtual airline. vaName is optional; it must match their VA if provided.
  • Full-scope admin / superadmin (va_scope = FULL): can manage any VA's checklists, but must pass vaName explicitly.

Regular users attempting isVA: true receive 403 FORBIDDEN. VA members who are not admins can read their VA's checklists but cannot edit or delete them.

Community Sharing & Ratings

Sharing is opt-in: a checklist only appears in communityChecklists when its owner sets shareCommunity: true. Community checklists (and every default checklist) can be rated 1–5 stars via checklistRate. Rules:

  • You cannot rate a checklist you own.
  • A non-shared user or VA checklist cannot be rated by anyone other than its owner — and owners cannot rate their own.
  • Re-rating updates your existing rating rather than adding a duplicate (one rating per user per checklist).
  • communityChecklists is sorted by average rating, then by rating count, so the best-rated shared checklists surface first.

checklistList

Return the authenticated user's checklists, their active VA's checklists, the community pool, and the built-in default checklists shipped with the active API version.

POST /api

Request Body

Parameter Type Required Description
query string Required Must be "checklistList"

Example

cURL
curl -X POST "https://api.virtualperformancetool.com/api" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "query": "checklistList" }'

Response

JSON
{
  "success": true,
  "data": {
    "userChecklists": [
      {
        "checklist_id": "15c60bc5-57b9-47bd-af0f-f250f903798c",
        "name": "737-600W Custom",
        "version": "1.1",
        "share_community": 0,
        "ratingAverage": 0,
        "rating_count": 0,
        "isMine": true
      }
    ],
    "vaChecklists": [],
    "communityChecklists": [],
    "defaultChecklists": [
      {
        "file": "380_generic_checklist",
        "checklistId": "default:API_1_3_6:380_generic_checklist",
        "name": "380 Airbus Checklist",
        "description": "A generic checklist for the Airbus 380.",
        "version": "1.0",
        "ratingAverage": 0,
        "ratingCount": 0
      }
    ]
  }
}

checklistGet

Fetch one checklist by id — a database uuid, a default synthetic id, or (for back-compat) a bare default filename.

POST /api

Request Body

Parameter Type Required Description
query string Required Must be "checklistGet"
data.checklistId string Required uuid or default:{folder}:{file}

Example

cURL
curl -X POST "https://api.virtualperformancetool.com/api" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "checklistGet",
    "data": { "checklistId": "default:API_1_3_6:380_generic_checklist" }
  }'

Response

JSON
{
  "success": true,
  "data": {
    "checklistId": "default:API_1_3_6:380_generic_checklist",
    "name": "380 Airbus Checklist",
    "version": "1.0",
    "description": "A generic checklist for the Airbus 380.",
    "basedOn": null,
    "isDefault": true,
    "isMine": false,
    "shareCommunity": true,
    "ratingAverage": 0,
    "ratingCount": 0,
    "checklist": {
      "name": "380 Airbus Checklist",
      "checklists": [
        {
          "title": "BEFORE START",
          "order": 0,
          "items": [
            { "challenge": "SECURITY INSPECTION", "order": 0, "response": "COMPLETE (BOTH)", "isLine": false, "selfDetected": false, "note": null }
          ]
        }
      ]
    }
  }
}
Private checklists

A non-shared user or VA checklist can only be fetched by its owner (or, for VA checklists, a member of that VA). Everyone else receives 403 FORBIDDEN.

checklistSave

Create a new checklist (omit checklistId) or update an existing one you own. The full checklist JSON is validated for structural integrity before being stored — see Checklist JSON Format.

POST /api

Request Body

Parameter Type Required Description
query string Required Must be "checklistSave"
data.checklistId string Optional Omit to create a new checklist; provide a uuid you own to update it.
data.name string Required Display name, max 150 chars.
data.version string Optional Defaults to "1.0". Max 30 chars.
data.description string Optional Max 255 chars.
data.basedOn string Optional Provenance id (e.g. the default id you cloned from).
data.isVA boolean Optional true to save a VA-owned checklist. Requires VA admin privileges.
data.vaName string Optional Target VA name; required for full-scope admins when isVA = true.
data.shareCommunity boolean Optional When true, appears in communityChecklists and becomes rateable.
data.checklist object Required The full checklist JSON (authored client-side). Must contain a non-empty checklists array; see Checklist JSON Format.

Example — create

cURL
curl -X POST "https://api.virtualperformancetool.com/api" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "checklistSave",
    "data": {
      "name": "737-600W Custom",
      "version": "1.1",
      "shareCommunity": false,
      "checklist": {
        "version": "1.1",
        "checklists": [
          {
            "title": "COCKPIT PREPARATION",
            "order": 0,
            "items": [
              { "challenge": "FUEL QUANTITY", "order": 0, "response": "___KG/LB" }
            ]
          }
        ]
      }
    }
  }'

Response

JSON
{
  "success": true,
  "data": {
    "checklistId": "15c60bc5-57b9-47bd-af0f-f250f903798c",
    "saved": true
  }
}

checklistDelete

Remove a checklist you own (or, with isVA: true, one your VA owns). Also removes its ratings. Default checklists cannot be deleted — the request is rejected with READ_ONLY_DEFAULT.

POST /api

Request Body

Parameter Type Required Description
query string Required Must be "checklistDelete"
data.checklistId string Required uuid of the checklist to delete.
data.isVA boolean Optional true to delete a VA-owned checklist. Requires VA admin privileges.
data.vaName string Optional Target VA name; required for full-scope admins when isVA = true.

Example

cURL
curl -X POST "https://api.virtualperformancetool.com/api" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "checklistDelete",
    "data": { "checklistId": "15c60bc5-57b9-47bd-af0f-f250f903798c" }
  }'

Response

JSON
{
  "success": true,
  "data": {
    "checklistId": "15c60bc5-57b9-47bd-af0f-f250f903798c",
    "deleted": true
  }
}

checklistRate

Rate a community-shared or default checklist 1–5 stars. Re-rating updates your existing rating.

POST /api

Request Body

Parameter Type Required Description
query string Required Must be "checklistRate"
data.checklistId string Required uuid or default synthetic id.
data.rating integer Required Integer from 1 to 5.

Example

cURL
curl -X POST "https://api.virtualperformancetool.com/api" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "checklistRate",
    "data": {
      "checklistId": "default:API_1_3_6:380_generic_checklist",
      "rating": 5
    }
  }'

Response

JSON
{
  "success": true,
  "data": {
    "checklistId": "default:API_1_3_6:380_generic_checklist",
    "rating": 5,
    "ratingAverage": 5,
    "ratingCount": 1
  }
}

Aircraft Profile Integration

An aircraft profile's checklists block gains an optional checklistId field. When present, the performance API resolves it through the exact same unified resolver used by checklistGet, and populates checklists.data with the result:

JSON
{
  "checklists": {
    "isChecklistAvailable": true,
    "isChecklistActive": true,
    "checklistId": "15c60bc5-57b9-47bd-af0f-f250f903798c"
  }
}

When checklistId is omitted, profiles fall back to the legacy checklists.file field (a bare default filename) — existing profiles keep working unchanged.

Access is enforced

A profile referencing a private checklist only resolves checklists.data when the caller is the checklist's owner, a member of its owning VA, or the checklist is community-shared or a default. Otherwise checklists.data is left unset.

Error Codes

Code HTTP Description
AUTH_REQUIRED 401 No valid JWT token provided.
MISSING_CHECKLIST_ID 400 checklistId is required but was not provided.
INVALID_CHECKLIST_ID 400 The provided id is not a valid uuid.
READ_ONLY_DEFAULT 403 Attempted to save or delete a default (default:...) checklist id.
INVALID_NAME 400 name is missing or exceeds 150 characters.
INVALID_VERSION 400 version exceeds 30 characters.
INVALID_STRUCTURE 400 The checklist payload failed structural validation (missing/invalid checklists, title, or challenge fields, or exceeds size limits).
INVALID_RATING 400 rating is not an integer between 1 and 5.
NOT_SHARED 403 Attempted to rate a checklist that is not community-shared (and is not a default).
CANNOT_RATE_OWN 403 Attempted to rate a checklist you (or your VA) own.
FORBIDDEN 403 VA checklist write attempted without admin privileges, a VA-scoped admin targeted a different VA, or the caller lacks access to a private checklist.
MISSING_VA_NAME 400 vaName must be provided when the caller is a full-scope VA admin.
NO_VA_ASSIGNED 403 The VA-scoped admin account has no virtual airline assigned.
NOT_FOUND 404 No checklist matches the given id, or it is not accessible to the caller.
DB_ERROR 500 Database insert / update / delete failed.