vAMSYS Integration#

Required roles: none
Base endpoint: https://auth.ibosoft.net.tr/link/vamsys/{CODE}
Reference documents: vAMSYS Owner Terms · vAMSYS Data Sharing Agreement · vAMSYS Orwell API
Attribution: none
Data sources: none
Last updated: 18 OCT 2026

For virtual airlines (VAs) that run on vAMSYS and want their pilots to get access to Ibosoft services (for example ibonav.aero) through their airline membership.

What the integration does#

• A pilot links their vAMSYS pilot account at your airline to their Ibosoft account, through vAMSYS's own consent screen (vAMSYS Pilot API, OAuth 2.0 Authorization Code with PKCE; Ibosoft holds no client secret).
• Ibosoft accepts the link only if vAMSYS confirms an active pilot of your airline: the pilot record exists and is neither frozen nor banned. Rank does not matter.
• Active pilots receive the Ibosoft service roles agreed with your airline. When a pilot is no longer active, those roles are removed automatically.
• Ibosoft re-checks every linked pilot every hour.
• A vAMSYS link cannot be used to sign in to Ibosoft. Pilots sign in with their Ibosoft account (password, Google or Discord); the link only grants service access.

Data sharing#

The same information is given to pilots in the Ibosoft privacy policy: https://auth.ibosoft.net.tr/privacy (section 5 "Data Retention" and the "vAMSYS Airline Membership" subsection of section 9 "Third-Party Services").

Permissions requested: identity:basic and pilot:read only.

What vAMSYS sends when a pilot authorizes: the pilot's vAMSYS user ID, name and email address, and their pilot record at your airline (pilot ID, pilot username, rank, join date, frozen / banned flags).

What Ibosoft stores:

What Ibosoft does not store: the pilot's name, email address, rank, join date or any other pilot data. Ibosoft does not request or use flight, statistics or other data, does not use the data for marketing and does not share it with other airlines.

Purpose: only to verify the pilot's membership of your airline and to grant or remove the Ibosoft service access agreed with your airline.

Retention and deletion:

Unlinking or deleting on the Ibosoft side does not contact vAMSYS: the authorization the pilot gave stays in vAMSYS until the pilot revokes it there or you disable the client.

Responsibilities under the vAMSYS terms#

A short summary of the vAMSYS documents that apply. It is not legal advice; the documents themselves are authoritative.

• The Pilot API works only with the pilot's explicit consent. A pilot can withdraw access at any time, and you as VA owner can disable the client at any time (Owner Terms §6.2).
• Under vAMSYS's model the data is disclosed to your airline. Your VA is an independent data controller of that data and is responsible for third parties you give access to (here: Ibosoft) as for its own acts (Owner Terms §6.3, Data Sharing Agreement §4.1, §6.6). This is why the vAMSYS consent screen shows your airline's name.
• The licence covers only the intended integration; collecting or scraping identity data is not allowed; the rate limit is 100 requests per minute per VA (Owner Terms §6.3).
• When you activate the client you confirm that the Privacy Policy URL entered for it covers the data shared through the Pilot API (Orwell API documentation). For this integration that is the Ibosoft privacy policy.
• On termination the shared data must be deleted (Data Sharing Agreement §14). See Ending the partnership.

Prerequisites#

• A paid vAMSYS plan. Virtual airlines on a free trial have no API access; the API page does not appear in Orwell until the VA subscribes.
• Access to Orwell as the VA owner (the owner has to activate the client).

1. Create the Pilot API client in Orwell#

1. In Orwell open Settings → API → API v3.

2. Create a new Pilot API client:

   Field	Value
   Name	Ibosoft
   Grant type	Authorization Code + PKCE (public client, no secret)
   Redirect URI	https://auth.ibosoft.net.tr/account/vamsys/callback (exactly this; the same URI for every partner airline)
   Scopes	identity:basic and pilot:read
   Privacy Policy URL	https://auth.ibosoft.net.tr/privacy

3. As VA owner, review and activate the client (this is where you attest the privacy policy).

4. Send Ibosoft, through our contact addresses:

   • the Client ID (a number, e.g. 1237). It is not a secret; there is no client secret to send,
   • the airline name and the short code you want in the link URL (letters and digits, up to 10, e.g. TWS),
   • optionally a logo URL and your website URL (both starting with https://; the website URL is used for the "Back to …" button after a quick link).

2. Ibosoft sets up your airline#

1. Ibosoft adds your airline with your Client ID and code.
2. Ibosoft selects the Ibosoft service roles your pilots receive.
3. Test connection: Ibosoft only opens your consent screen to confirm the client is registered and activated (an invalid_client page means it is not). Nothing is authorized during the test.
4. Ibosoft activates the airline. From then on your pilots can link.

3. Add a link button to your website#

Every partner airline has a fixed quick-link URL; the code is not case-sensitive:

https://auth.ibosoft.net.tr/link/vamsys/{CODE}

A ready-made button for the code TWS; you may restyle it, only the URL matters:

<a href="https://auth.ibosoft.net.tr/link/vamsys/TWS"
   style="display:inline-block;padding:10px 20px;border-radius:8px;background:#7ff0cf;color:#05140F;font-family:system-ui,sans-serif;font-weight:600;text-decoration:none;">Link your account to Ibosoft</a>

What a pilot experiences after clicking:

1. If not signed in to Ibosoft, they sign in first (password, Google or Discord) and come back to this page automatically.
2. A confirmation page shows your logo and name and the Ibosoft account they are signed in as ("Not you? Switch account"). They click Continue (nothing starts without this click) or Cancel.
3. They pass your vAMSYS consent screen.
4. A result page: on success "Go to ibonav.aero" and, if you gave a website URL, "Back to {your airline}". On failure the reason, "Back to {your airline}" (again only with a website URL) and "Linked Accounts".

The link works only while your airline is active on Ibosoft. If it is not, or the pilot already has an active link to your airline, they are taken to their Linked Accounts page with a message. A pilot whose link is inactive or revoked can link again through the confirmation page.

The vAMSYS consent screen#

The consent screen shows your airline's name and logo, not "Ibosoft", even though the client is named Ibosoft in Orwell. This is how vAMSYS presents Pilot API clients (it matches the legal model above) and cannot be changed. The screen lists the requested permissions ("name and email" and "pilot profile, rank, stats, badges (read)"). Before redirecting, Ibosoft tells the pilot that they will see your airline's vAMSYS consent screen and that this permission lets Ibosoft verify their pilot membership.

A pilot who already authorized the client is not asked again; vAMSYS returns to Ibosoft without a click.

Linking and unlinking without the button#

• Link: Ibosoft → Account → Linked Accounts → Link a new vAMSYS airline → select one or more airlines → pass each airline's consent screen in turn.
• Unlink: on the same page each airline is its own row (vAMSYS · {airline}, pilot username, link date) with an Unlink button. Unlinking one airline does not affect the others.
• A link is refused if the pilot has no active pilot record at your airline, if the vAMSYS account is already linked to another Ibosoft account, if the pilot record is already linked to another Ibosoft account, or if the pilot's Ibosoft account is already linked to a different vAMSYS account (they must unlink their vAMSYS airlines first).

When a pilot leaves, is frozen or banned#

• The check runs every hour. A pilot who left your airline, was frozen or banned loses the roles at the next check, normally within about one hour.
• Airline roles are time-limited and only extended by a successful check, so even if checks cannot reach vAMSYS, the roles lapse at most 3 hours after the last successful check. The exception is a rejected client (invalid_client, e.g. the client was disabled in Orwell): then the roles of active links are kept (extended every hour without contacting vAMSYS) until Ibosoft deactivates your airline.
• If you unfreeze a pilot, the next check restores the roles.
• If you or the pilot revoke the authorization at vAMSYS, the next check deletes the tokens and removes the roles; the pilot has to link again.

Rate limits#

vAMSYS allows 100 requests per minute per VA, shared by all API clients of your airline. The hourly check of Ibosoft waits 4 seconds between two pilots of the same airline (normally about 30 requests per minute) and stops checking your airline until the next hourly run if vAMSYS answers "too many requests".

Ending the partnership#

• Tell Ibosoft that the partnership ends. Ibosoft removes your airline: all links of your airline, their tokens and the roles they granted are deleted (Data Sharing Agreement §14).
• You can also disable the client in Orwell. The hourly check can then no longer verify your pilots. Depending on how vAMSYS answers, the links are marked revoked (tokens deleted, roles removed) or your airline is flagged to Ibosoft as "Client rejected" (invalid_client); then links and roles are kept until Ibosoft deactivates or removes your airline, but new pilots cannot link while the client is disabled. Disabling the client does not delete the data Ibosoft holds, so please still tell Ibosoft.
• Ibosoft can also pause the integration (deactivate the airline): roles are removed at once, links are kept, and nothing is checked until the airline is activated again.