Treat migration as a reconciled data program, not a single import button. Use a non-production FlightStudio tenant first and preserve the source system until acceptance is signed.
Inventory what the API exposes
List the source organizations, projects, devices, aircraft, docks, users, completed flight tasks, telemetry tracks, media, and wayline files in scope. For each class, record whether the API provides full history, partial metadata, or nothing usable.
Agree what will be imported, referenced, exported by another method, or explicitly left behind. The gap list belongs in the cutover decision.
Fix identity and mapping rules
Create an immutable mapping from source identifiers to FlightStudio identifiers. Define how projects become Sites, how devices and aircraft enter the fleet, how source users are attributed, and how duplicate serial numbers are handled.
Never use display names as durable keys. Preserve original identifiers and source timestamps in provenance metadata without allowing them to override tenant ownership.
Backfill in bounded batches
Import reference data before dependent history. Pull completed operations and telemetry in time-bounded pages with retry checkpoints. Hash or count each batch, record API pagination tokens, and make the import idempotent.
Throttle within published source limits and stop on systematic validation failure. A partial batch is quarantined for review rather than silently treated as success.
Reconcile records and gaps
Compare source and target counts by class, site, and time range. Sample full records, not only totals. Check timezones, coordinates, units, status mappings, telemetry point order, and links between operations and aircraft.
Produce a signed exception list for missing media, unavailable waylines, corrupt source records, and source fields with no safe target meaning.
Run both systems side by side
Choose a coexistence window and system of record for each workflow. During the window, keep pull sync scheduled and outbound writes disabled unless a separately approved need exists. Operators must know where to plan, authorize, and close an operation.
Monitor lag, duplicates, changed source records, and credential expiry. Rehearse recovery from a missed sync before the final cutover.
Cut over with a recovery point
Freeze source changes for the agreed final window, run the last pull, reconcile, take a target backup, and capture the signed mapping report. Activate target workflows only after acceptance criteria pass.
If acceptance fails, return to the documented source workflow and retain the target as a labelled incomplete import. Do not delete imported evidence to make retry easier.
Disconnect without deleting ownership
Revoking the connector stops new synchronization; it does not remove Sites, fleet assets, operations, or telemetry already imported into the customer-owned database. Store the final sync time, revoked credential reference, reconciliation pack, and source retention decision.
Reconnect using the existing identifier map and checkpoints. A reauthorization must not create a second copy of every source record.