Is there a free tier?

No, but you can apply for access to try it before subscribing, or to ask for a custom limit.

Does the API cover every country on the map?

It covers the sources whose licence allows commercial use and redistribution. Zones from other sources stay on the map but are not served through the API.

Do I need a map plan as well?

No. API access is billed on its own; an account needs only API access to create keys.

Drone no-fly zone API: getting started

Updated September 27, 2026

The GeoPilot public API serves the map’s drone-zone data for every source whose licence permits redistribution, as GeoJSON over HTTPS. Send your API key as a bearer token to /api/v1/public and you can list zones by country or area, ask which zones apply at a point or within a radius, check a flight area or route, and convert between ED-269, ED-318, KML and GeoJSON. API access is a separate product from the map plans.

Get a key

Subscribe on the API access page — or, to try it first or ask for a higher limit, apply for access.
On your profile, open the API Access tab and create a key: give it a name and choose only the scopes it needs.
Copy the key when it is shown. It is shown exactly once; if you lose it, revoke it and create another.

Scope	Allows
`RESTRICTIONS_READ`	Listing zones, point and radius lookups, one zone by id
`CONFLICT_CHECK`	Checking an area or route against active zones
`CONVERT_ED269`	Converting to or from ED-269
`CONVERT_ED318`	Converting to or from ED-318
`CONVERT_KML`	Converting to or from KML

Your first request: what applies here?

Keep the key in an environment variable and ask for every zone at a point:

curl "https://geopilot.space/api/v1/public/restrictions/at?lat=44.43&lon=26.10" \
  -H "Authorization: Bearer $GEOPILOT_API_KEY"

The answer is a GeoJSON FeatureCollection with a meta block beside it. Each feature carries the zone’s effect (PROHIBITED, AUTHORIZATION_REQUIRED, COORDINATION_REQUIRED, INFORMATION_ONLY or UNKNOWN), its type, whether it is activeNow, and ids for its source and authority — the same facts the map’s click panel shows.

The endpoints

Request	Returns	Scope
`GET /restrictions`	Zones filtered by country, bounding box, type, effect…	`RESTRICTIONS_READ`
`GET /restrictions/at`	Every zone stacked at one point	`RESTRICTIONS_READ`
`GET /restrictions/near`	Zones within a radius, nearest first	`RESTRICTIONS_READ`
`GET /restrictions/:id`	One zone	`RESTRICTIONS_READ`
`POST /restrictions/intersect`	What an area or route meets	`CONFLICT_CHECK`
`POST /convert/:from-:to`	A document in another format	See the conversion guide

Check a flight area

curl -X POST "https://geopilot.space/api/v1/public/restrictions/intersect" \
  -H "Authorization: Bearer $GEOPILOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"geometry":{"type":"Polygon","coordinates":[[[26.05,44.40],[26.15,44.40],[26.15,44.47],[26.05,44.47],[26.05,44.40]]]}}'

The response lists each zone the shape meets with its effect, whether it is active at the evaluated time, intersectionAreaM2 and intersectionRatio (the share of your area it covers; null for a route), plus a summary of counts by effect. Pass activeAt to evaluate a future time. Like the map, it lists and does not conclude — there is no “allowed” field, by design.

Errors, limits and licensing

401 — the key is missing, malformed, unknown, revoked or expired. 403 — the key is valid but its owner’s API access has lapsed, or it lacks the scope the endpoint needs (the response names it).
Every error, from every endpoint, is one JSON shape: RFC 9457 problem details, with field-level errors on a 400 or 422.
Limits are counted per key over a rolling minute — 60 requests by default for each of reads, conflict checks and conversions. Every response carries X-RateLimit-Limit and X-RateLimit-Remaining; a 429 adds Retry-After.
Restriction reads only return data from sources whose licence allows commercial use and redistribution. An excluded source behaves as if it did not exist.

Machine-readable description

The API is described as OpenAPI 3.1, generated from the same schemas the API validates requests with, so a client generator stays in step with it. A health probe answers without a key, and both are listed in an RFC 9727 API catalog:

GET https://geopilot.space/api/v1/public/openapi.json
GET https://geopilot.space/api/v1/public/health
GET https://geopilot.space/.well-known/api-catalog

The API reports what national authorities publish, with dates. It does not authorize a flight, and your users should be told so.

Frequently asked questions

Is there a free tier?: No, but you can apply for access to try it before subscribing, or to ask for a custom limit.
Does the API cover every country on the map?: It covers the sources whose licence allows commercial use and redistribution. Zones from other sources stay on the map but are not served through the API.
Do I need a map plan as well?: No. API access is billed on its own; an account needs only API access to create keys.

Read the API reference