API and PNR compared
- API source
- Travel document and flight data 1
- PNR source
- Airline reservation systems 1
- API message
- UN/EDIFACT PAXLST 1
- PNR message
- PNRGOV 1
- EU API law
- Directive 2004/82/EC 2
- EU PNR law
- Directive (EU) 2016/681 3
Side by side
The table compares the two data sets using EU law as the main reference, with the US and Canada where their rules say so.
| Point | API | PNR |
|---|---|---|
| Where the data comes from 1 | Passenger, crew, travel document and flight information 1 | Reservation data in airline systems 1 |
| Typical fields 2 | Names, nationality, date of birth, document number and type, flight details 2 | 19 elements including payment, contact, itinerary, seat, baggage and travel agent 3 |
| Who receives it in the EU 2 | Border authorities 2 | Passenger Information Unit 3 |
| When it is sent in the EU 2 | By the end of check-in 2 | 24 to 48 hours before departure and after flight closure 3 |
| EU retention 2 | Deleted within 24 hours of transmission by authorities, with exceptions 2 | Five years, masked after six months 3 |
| UN mandate 4 | Resolution 2396, paragraph 11 4 | Resolution 2396, paragraph 12 4 |
| ICAO rules 9 | Annex 9 Amendment 26 9 | Annex 9 Amendment 28 and Doc 9944 9 |
Why the fields differ
API fields are a closed list set by law. The EU list covers document number and type, nationality, names, date of birth, entry point, flight code and times 2. PNR holds whatever the booking contains. The US rule gives access only to elements the carrier in fact holds and does not require carriers to collect more 6.
PNR can carry data a passport never shows, such as payment details, contact details, travel agent and other travellers on the same booking 3. The EU directive lists sensitive data that the PIU must delete immediately, such as religion, health and political opinions 3.
Where the two overlap
The two are not fully separate. Item 18 of the EU PNR list is any API data the carrier collected 3. The US API manifest asks for the PNR record locator where available 5. Canada asks for API and available PNR together, before a flight arrives 7.
How each is used
The EU PNR directive lets the PIU assess passengers before arrival or departure to find people who may be involved in terrorist offences or serious crime and need further checks 3. The US API rule lets the government return a not-cleared instruction, after which the carrier must not issue a boarding pass 5.
PNR retention has been tested in court. In Case C-817/19 on 21 June 2022, the EU Court of Justice ruled out a general five-year retention for all passengers and required human review of automated matches 8.
Retention outside the EU
Canada keeps API and PNR data for three and a half years from receipt, and up to six years where data moves to an enforcement database for an active investigation 7.
Common questions
Which one has my credit card details?
PNR. Payment information is one of the 19 EU PNR elements 3. It is not on the EU API list 2.
Which one is kept longer?
In the EU, PNR. It can be kept five years 3. API is deleted within 24 hours of transmission, with exceptions 2.
Are states required to collect both?
Yes. Resolution 2396 (2017) requires API and requires states to develop PNR capability 4.
Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.
Sources
- IATA: Implementation of API, iAPI and PNR programs, key considerations for governments (version 1, 2026)
- Council Directive 2004/82/EC on the obligation of carriers to communicate passenger data (29 April 2004, text as adopted)
- Directive (EU) 2016/681 on the use of passenger name record (PNR) data (27 April 2016, text as adopted)
- UN Meetings Coverage: Security Council adopts resolution 2396 (2017) on returning foreign terrorist fighters (December 2017)
- eCFR: 19 CFR 122.49a, electronic manifest for passengers on commercial aircraft arriving in the United States
- eCFR: 19 CFR 122.49d, Passenger Name Record (PNR) information
- Canada Border Services Agency: Advance Passenger Information and Passenger Name Record data
- Court of Justice of the EU: Press release 105/22, judgment in Case C-817/19 Ligue des droits humains (21 June 2022)
- ICAO EUR/NAT Office: Newsletter 2, Annex 9 facilitation (2021)
Related
- Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
- Passenger Name Record (PNR) data explained
What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.
- Interactive API and board or no-board decisions
How interactive Advance Passenger Information lets border authorities answer board or no-board at check-in, with US, Canadian and UK examples.
- Passenger data retention
How long governments keep PNR, API and biometric records about air travellers, what must be masked or deleted, and what the EU Court of Justice ruled.
- The EU PNR Directive (Directive (EU) 2016/681)
What the EU PNR Directive requires of airlines and Member States, the 19 data elements it covers, retention rules, and what the EU Court of Justice ruled.
- US passenger data rules: APIS, Secure Flight and ATS
How CBP's APIS, TSA's Secure Flight and the Automated Targeting System collect air passenger data, the legal basis, retention periods and audit findings.