IATA Resolution 824

Industry policy — not law International

A binding rule made and enforced by a private trade association through membership and licensing, not by a legislature or regulator.

Resolution 824 establishes the Passenger Sales Agency Agreement — the standard contract between IATA member airlines and accredited travel agencies, and the basis of the accreditation regime that determines who may issue airline tickets at all. It is industry rule rather than law, and it is the single most binding access control in travel distribution.

Resolution 824 is the reason travel is the least agent-reachable sector in the API Evangelist series, and it is not a technical obstacle at all.

The resolution establishes the Passenger Sales Agency Agreement and the accreditation regime beneath it. An IATA, ARC, TIDS or equivalent number is what permits an agency to issue a ticket and settle through BSP or ARC. No amount of API access substitutes for it, and no API key confers it.

Accreditation is the precondition - not documentation, not a developer account. A number.
Airlines retain discretion - ticketing authority can be granted, refused, suspended and revoked under the agreement.
Enforced financially - Resolution 850m Agency Debit Memos are how breaches are actually punished.

The binding constraint on the agentic turn

An agent can parse an OpenAPI, follow a discovery document and invoke an MCP tool. It cannot obtain IATA accreditation.

The four State of Travel APIs reports measured how much of the sector sits behind that kind of gate. Across forty newly researched organizations: thirteen gate access behind a commercial agreement, seven more behind accreditation or a licence, three are partner-only, three require application approval — and only seven are self-serve.

The airline terms make the mechanism explicit:

Virgin Australia’s Travel Agent Main Agreement requires current IATA or ATIS accreditation and states “You must have GDS access for BSP Sales”, with refusal at Virgin’s absolute discretion, third-party credit assessment, and removal of ticketing authority after sixty days of inactivity.
Jetstar restricts registered agents to its API, GDS and Agent Hub, making commercial booking through its own consumer website an express breach of the agency terms.
Rex ties commission to logged-in portal sessions and fixes the accreditation number permanently at registration — an identifier the customer can never move.
Porter reserves immediate termination at sole discretion with no notice period, claims ownership of all PNR data, and revokes data rights on suspension.

Why it belongs in a regulations catalog

Because it functions as one. A reader assessing whether a travel API is usable will find the specification, the authentication scheme and the rate limits documented, and will discover only at contracting that the actual gate is a private industry agreement with a discretionary approval step.

This is the same lesson US real estate teaches through IDX and VOW agreements, and it generalises: in intermediated industries, the access rule is private, the technical surface is public, and only the first one decides whether anything can be built.

Referenced in API Evangelist papers

This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.

The State of Australian Travel APIs

The gate an agent cannot pass — Virgin Australia's agency terms require IATA or ATIS accreditation and mandate GDS access for BSP sales, at the airline's absolute discretion.

The State of US Travel APIs

Across forty organizations researched, only seven are self-serve; thirteen gate behind a commercial agreement and seven more behind accreditation or a licence.

Browse all API Evangelist papers →

Implemented by these standards

A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.