US CBP Advance Passenger Information System (APIS) and TSA Secure Flight

APIS manifests for flights arriving in the United States

Section 122.49a of title 19 of the Code of Federal Regulations requires carriers to transmit an electronic passenger arrival manifest to APIS, the CBP system ¹. The section was added on 7 April 2005 and has amendments through May 2009 ¹. It exempts active-duty US military personnel on arriving Department of Defense chartered aircraft ¹.

The rule allows four ways to transmit, once the carrier is certified for the interactive ones ¹.

• Non-interactive batch: a full manifest sent no later than 30 minutes before the aircraft is secured. CBP returns not-cleared and selectee instructions ¹.
• Interactive batch: a single complete manifest sent through an interactive system no later than 30 minutes before the aircraft is secured. CBP returns cleared, not-cleared or selectee instructions ¹.
• Interactive individual transmission: data sent for each passenger as they check in, no later than the securing of the aircraft ¹.
• Combined use of the two interactive options, for the same flight or different flights ¹.

What APIS contains

The required data starts with full name, date of birth and gender. It runs through citizenship, country of residence, travel document type, passport number, issuing country and expiry date ¹. It includes a US address, which US citizens, lawful permanent residents and passengers in transit do not need to give, plus the PNR record locator if available, airport codes, the carrier code, flight number and date of arrival ¹.

A carrier must not issue a boarding pass or load baggage for a passenger who receives a not-cleared instruction ¹. Under interactive options, carriers send a no-show report no later than 30 minutes after the aircraft is secured ¹. CBP's 2023 proposal says TSA may set a passenger's boarding status in the APIS response, for example prohibited from boarding based on security status ².

Proposed travel document validation

On 2 February 2023 CBP published a proposed rule, Advance Passenger Information System: Electronic Validation of Travel Documents ². It would add checks on whether passengers hold valid, authentic travel documents before boarding. If CBP cannot validate the documents after contact with the carrier, it would recommend not to board. The notice says the carrier would decide whether to board the passenger ². Comments closed on 3 April 2023 ². A final rule was not found in the records opened for this page.

The notice says carriers submit passenger data to CBP between 72 hours and 30 minutes before departure ². It gives these figures, each from CBP ².

Secure Flight

TSA's Secure Flight final rule was published on 28 October 2008 and took effect on 29 December 2008 ³. It implements a 2004 law that moved pre-flight comparison of airline passenger information against federal watch lists from airlines to the Department of Homeland Security ³. The rule planned two phases. The first covered domestic flights. The second added flights to and from the United States and flights overflying the continental United States ³.

Under 49 CFR 1560.101, covered aircraft operators must request the full name, sex, date of birth and Redress Number of passengers. For reservations made 72 hours or more before departure, name, sex and date of birth must be collected no later than 72 hours before departure ⁴. They must send the data to TSA before the scheduled departure of each covered flight ⁴. A Known Traveler Number is covered under paragraph (a)(2), after TSA gives written notice ⁴. The section was last amended on 21 May 2025 ⁴.

GAO findings on Secure Flight

The Government Accountability Office published report GAO-14-531 on 9 September 2014 ⁵. It found that Secure Flight had moved from screening passengers only against the No Fly and Selectee Lists to assigning each passenger a high, low or unknown risk category ⁵. It found screening errors at checkpoints from May 2012 through February 2014 and said TSA had no process to evaluate their root causes ⁵. It said Secure Flight had no measures of system matching errors ⁵.

GAO made four recommendations to TSA. DHS concurred with them, and GAO lists all four as closed and implemented. Its updates cite a root-cause process from August 2014, a matching-error tracking tool in November 2015 and a test data set in spring 2018 ⁵.