Advance Passenger Information (API) explained
- What it is
- Passenger and crew biographic, travel document and flight information sent before departure or arrival 1
- Who sends it
- Airlines (aircraft operators) 1
- Who receives it
- Border authorities 1
- Message standard
- UN/EDIFACT PAXLST 1
- UN mandate
- Security Council resolution 2396 (2017), paragraph 11 3
- ICAO rule
- Annex 9 Amendment 26 requires each state to establish an API system 4
- EU retention (2004 directive)
- Border authorities delete within 24 hours of transmission, carriers within 24 hours of arrival 2
Which data fields API contains
The 2004 EU directive gives a short closed list of fields that carriers send 2. The list below is that legal text.
The United States list
The US rule for flights arriving in the United States asks for more. It covers full name, date of birth, gender, citizenship, country of residence, travel document type, passport number, issuing country and expiry date 5. It adds a US address for most foreign visitors, the PNR record locator if available, and the airline code, flight number and ports 5.
Who sends it, who receives it, and when
The airline collects the data at check-in and sends it to border authorities. IATA guidance says API should travel as UN/EDIFACT PAXLST messages and describes a passenger data single window, a single entry point for submitting standard passenger data 1.
Timing differs by country. The 2004 EU directive asks carriers to send the data by the end of check-in, on request of the authorities 2. US batch manifests are due no later than 30 minutes before the aircraft doors are closed and secured, and single passenger transmissions no later than the moment the doors close 5. Canada requires API and available PNR for all travellers before a flight arrives, provided at the last international airport before Canada 7.
Legal basis
Resolution 2396 (2017), paragraph 11, decides that member states shall require airlines operating in their territories to provide API to the appropriate national authorities, and refers to the API standard set by ICAO 3. ICAO Annex 9 Amendment 26 requires each state to establish an API system and to support it with legal authority. It added a recommended practice encouraging states to consider interactive API 4.
In the EU, Directive 2004/82/EC of 29 April 2004 sets the duty. Each state must set penalties per journey, with a maximum of not less than EUR 5,000 or a minimum of not less than EUR 3,000 2. Regulation (EU) 2025/12 repeals that directive. It requires carriers to read passport data by automated means and sets up a central router developed by eu-LISA. It applies from the date the router is put into service 6.
Country examples
| Jurisdiction | Rule or system | What the record says |
|---|---|---|
| European Union 2 | Directive 2004/82/EC, to be replaced by Regulation (EU) 2025/12 6 | New regulation sends data per passenger at check-in, no earlier than 48 hours before departure, and for all boarded passengers at flight closure 6 |
| United States 5 | 19 CFR 122.49a 5 | Carrier must not issue a boarding pass to a passenger subject to a not-cleared instruction 5 |
| Canada 7 | CBSA API/PNR program 7 | API/PNR kept three and a half years from receipt, up to six years if moved to an enforcement database 7 |
| Philippines 8 | UN goTravel software, launched 20 March 2025 8 | Department of Justice and Bureau of Immigration led the work. Australia funded it. Seventh UN member state to go live with goTravel 8 |
UN technical help
The UN Office of Counter-Terrorism runs the Countering Terrorist Travel Programme, launched on 7 May 2019. It works with 91 member states, 69 of them beneficiaries of full technical assistance. It deploys its goTravel software free of charge to collect and process passenger data 9.
Common questions
Is API the same as PNR?
No. API is travel document and flight data. PNR is reservation data held in airline reservation systems 1.
When does my airline send my API data?
It depends on the country. In the EU it is by the end of check-in 2. For US arrivals it is before the aircraft doors close 5.
Does API include fingerprints or photos?
The field lists in the EU directive and the US rule do not include fingerprints or photos 2,5.
What happens if an airline does not send API?
EU states must set penalties per journey, with a maximum of at least EUR 5,000 or a minimum of at least EUR 3,000 2.
Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.
Sources
- IATA: Implementation of API, iAPI and PNR programs, key considerations for governments (version 1, 2026)
- Council Directive 2004/82/EC on the obligation of carriers to communicate passenger data (29 April 2004, text as adopted)
- UN Meetings Coverage: Security Council adopts resolution 2396 (2017) on returning foreign terrorist fighters (December 2017)
- ICAO EUR/NAT Office: Newsletter 2, Annex 9 facilitation (2021)
- eCFR: 19 CFR 122.49a, electronic manifest for passengers on commercial aircraft arriving in the United States
- European Parliament Legislative Observatory: summary of Regulation (EU) 2025/12 on advance passenger information for external border controls
- Canada Border Services Agency: Advance Passenger Information and Passenger Name Record data
- UNOCT: UNOCT and the Philippines celebrate the launch of the UN goTravel software (20 March 2025)
- UNOCT: Countering Terrorist Travel Programme
Related
- Passenger Name Record (PNR) data explained
What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.
- API and PNR compared
How Advance Passenger Information differs from Passenger Name Record data in source, fields, timing, recipient, legal basis and retention.
- Interactive API and board or no-board decisions
How interactive Advance Passenger Information lets border authorities answer board or no-board at check-in, with US, Canadian and UK examples.
- UN Security Council Resolution 2396 and ICAO Annex 9
What Resolution 2396 (2017) asks of states on API, PNR, watch lists and biometrics, and how ICAO Annex 9 sets the passenger data standards.
- Passenger data retention
How long governments keep PNR, API and biometric records about air travellers, what must be masked or deleted, and what the EU Court of Justice ruled.
- Airlines and passenger data
What airlines and their system providers collect, carrier duties and fines for API and PNR, and what airline privacy notices say.