Interactive API and board or no-board decisions
- What it is
- Real-time exchange between airline and border authority during check-in 1
- Possible responses
- Board, no-board or advisory 1
- ICAO status
- Recommended practice added by Annex 9 Amendment 26 2
- UN rule
- Resolution 2396 requires API, not iAPI 8
- UK penalty
- Up to £50,000 per breach of the Authority to Carry Scheme 5
How it differs from batch API
With batch API the airline sends one list for the whole flight. With iAPI the airline sends each passenger's data at check-in and waits for an answer 1. The US rule shows both. Batch manifests are due no later than 30 minutes before the aircraft doors are closed. Single passenger transmissions are due no later than the moment the doors close 3.
The new EU API regulation moves to per-passenger sending. Data goes at check-in, no earlier than 48 hours before departure, and for all boarded passengers once the flight closes 7.
Who makes the decision
The government decides and the airline acts on the answer. In the United States, the carrier must not issue a boarding pass to, or load the baggage of, a passenger subject to a not-cleared instruction. It must contact TSA to resolve the instruction 3. For connecting passengers under the interactive options, the carrier must wait for a cleared or selectee response 3.
In Canada, a 2016 CBSA privacy assessment said iAPI covers all international commercial flights coming to Canada. Matches are manually reviewed for a Minister's declaration or an enforced removal order, and CBSA targeting officers review the work list 4. Check-in data collection normally begins 24 hours before departure 4.
United Kingdom: Authority to Carry
The Authority to Carry Scheme 2023 came into force on 3 April 2023. It is the third scheme made under the Counter-Terrorism and Security Act 2015 5. It replaced the 2021 scheme, which ran from 6 April 2021 6. Carriers in scope must seek authority to carry passengers and crew on journeys to and from the UK. Carriers with systems compatible with the Government's border system receive refusals electronically. Others get a phone call followed by an email 5.
The carrier must tell the passenger about a refusal using a Home Office form of words that includes contact details 5.
Grounds for a UK refusal
- Travel to the UK: people assessed as a direct security threat, subjects of temporary exclusion orders, people under exclusion or deportation, and people refused visas, entry clearance or travel authorisations 5
- Travel to the UK: people refused leave to enter and people with invalid or falsified travel documents 5
- Travel from the UK: people assessed as a direct security threat, UN-listed travel-restricted people, and children believed to be leaving for terrorism-related activity 5
- Travel from the UK: people under travel restrictions, people whose passports were refused or cancelled on public-interest grounds, and people with invalid travel documents 5
Penalties for airlines
Under the UK scheme, a carrier can face a civil penalty of up to £50,000 for each breach. A carrier can avoid liability by showing a reasonable excuse 5. Under the US rule, the duty not to issue a boarding pass to a not-cleared passenger falls on the carrier 3.
Common questions
Can a government message stop me from boarding?
Yes, where the law requires it. In the US a carrier must not issue a boarding pass to a passenger with a not-cleared instruction 3. UK carriers must seek authority to carry 5.
Who tells me why I was refused?
In the UK the carrier tells you, using Home Office wording with contact details 5.
Is iAPI required by international law?
No. The UN resolution requires API 8. ICAO lists iAPI as a recommended practice 2.
What messages can come back?
IATA describes board, no-board and advisory responses 1.
Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email [email protected] with the official link.
Sources
- IATA: Implementation of API, iAPI and PNR programs, key considerations for governments (version 1, 2026)
- ICAO EUR/NAT Office: Newsletter 2, Annex 9 facilitation (2021)
- eCFR: 19 CFR 122.49a, electronic manifest for passengers on commercial aircraft arriving in the United States
- Canada Border Services Agency: Privacy Impact Assessment executive summary, Interactive Advance Passenger Information (1 July 2016, archived)
- Home Office: Authority to Carry Scheme 2023 (3 April 2023)
- Home Office: Authority to Carry Scheme 2021 (30 March 2021, withdrawn 3 April 2023)
- European Parliament Legislative Observatory: summary of Regulation (EU) 2025/12 on advance passenger information for external border controls
- UN Meetings Coverage: Security Council adopts resolution 2396 (2017) on returning foreign terrorist fighters (December 2017)
Related
- Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
- API and PNR compared
How Advance Passenger Information differs from Passenger Name Record data in source, fields, timing, recipient, legal basis and retention.
- Passenger Name Record (PNR) data explained
What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.
- Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.
- Watch-list matching of passenger data
How API and PNR data are compared with INTERPOL, national and UN lists, what happens after a hit, how false matches are handled and how to seek redress.
- Airlines and passenger data
What airlines and their system providers collect, carrier duties and fines for API and PNR, and what airline privacy notices say.