Advance passenger information: what API and PNR mean

Last checked: 19 October 2026 · How border data works

Advance passenger information, or API, is identity and flight data that an airline sends to border authorities before arrival or departure. It commonly includes your name, birth date, nationality and passport details ¹. Passenger name record data, or PNR, comes from the booking record and can include itinerary, contact, payment, seat and baggage details ^1,5. The UN Security Council and ICAO require states to develop passenger-data capabilities for border and security checks ^2,3.

API: Identity, travel-document and flight data created at check-in ¹
PNR: Booking data held in an airline reservation record ¹
Who sends it: Air carriers send data to the destination or departure authority ^1,4
UN basis: Security Council Resolution 2396, adopted 21 December 2017 ²
ICAO basis: Annex 9 Standard 9.7 requires an API system ³
EU rules: Regulations (EU) 2025/12 and 2025/13 ^4,5
Checked: 19 October 2026

What API contains

ICAO says API is generated during check-in. It identifies a passenger through data such as full name, date of birth, sex, nationality and travel-document details. Most of this information comes from the machine-readable zone of a passport ¹.

The EU list in Regulation (EU) 2025/12 includes the passenger's names, date of birth, sex, nationality, document type and number, issuing country, document expiry date and PNR locator. Where available, it can include seat and checked-baggage details. The flight portion includes the flight number, departure and arrival airports, and local departure and arrival times ⁴.

How PNR is different

PNR is made during booking and kept in the airline's reservation system. ICAO says it can contain a name, itinerary and ticket indicator, and may hold contact, payment, seat, baggage and service information. The amount differs between airlines and bookings ¹.

API is a defined identity and flight dataset. PNR can show how a journey was booked and changed. Regulation (EU) 2025/13 joins API with other PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime ⁵.

Why governments receive it before travel

The UN Security Council adopted Resolution 2396 on 21 December 2017. Paragraph 11 requires UN member states to develop API systems and use the data to stop the travel of foreign terrorist fighters. Paragraph 12 requires states to develop the ability to collect, process and analyse PNR data, with respect for human rights and fundamental freedoms ².

ICAO's Annex 9 Standard 9.7 says each state must establish an API system. Standard 9.8 requires a legal basis and consistency with international API standards. The ICAO passenger-data guidance says advance transmission lets border agencies run targeted controls before the traveller arrives ^1,3.

What the EU rules say

Regulation (EU) 2025/12 covers API for external border checks. It requires air carriers to collect API for passengers on flights into the EU and send it through an EU router to competent border authorities. The regulation limits the dataset to the passenger and flight fields set out in Article 4 ⁴.

Regulation (EU) 2025/13 covers API and PNR for terrorist offences and serious crime. It applies to extra-EU flights and to selected intra-EU flights. Both regulations entered into force on 28 January 2025. Most operational duties depend on the EU router becoming operational and later application dates in the regulations ^5,6.

What this means for a traveller

Your airline may scan the machine-readable part of your passport or ask for the same details during online check-in ^1,4.
A carrier may have to send a manifest before departure and receive a response from a border authority ¹.
API does not replace a visa, travel authorisation or arrival card. Those are separate entry requirements ¹.
Data rules differ by country. Check the privacy notice for the government system that receives your information.

Common questions

Is API the same as an arrival card?

No. API is normally sent by the carrier from check-in and flight records. An arrival card is a separate declaration made by the traveller ¹.

Is API the same as PNR?

No. API mainly identifies the traveller and flight. PNR is the airline booking record and may contain itinerary, contact, payment, seat and baggage information ^1,5.

Can API include my passport number?

Yes. ICAO and the EU rules list travel-document data, including the document number and issuing country ^1,4.

Why is API sent before arrival?

It gives border authorities time to check passengers before the flight arrives and, in some systems, before boarding ^1,2.

What is the international legal basis?

ICAO Annex 9 contains the aviation standard. UN Security Council Resolution 2396 requires member states to develop API and PNR capabilities for the stated security purposes ^2,3.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email [email protected] with the official link.

Sources

What governments say happens to arrival card data
The data, uses, access rules and published retention terms for eight official digital arrival systems, checked against government notices.
EU Entry/Exit System (EES)
EES has been fully operational since 10 April 2026. Who is registered, what border data it stores, exemptions and retention periods.
US ESTA (Electronic System for Travel Authorization)
ESTA costs US$40.62 from 16 October 2026 and lasts two years. Who needs it under the Visa Waiver Program, when to apply and the official site.
UK Electronic Travel Authorisation (ETA)
A UK ETA costs £20 and lasts 2 years or until your passport expires. Who needs one, who is exempt, how to apply and how to avoid paying extra.