UTA Partner API Documentation

The UTA Partner API lets approved travel partners sell and manage UTA services from their own websites, apps and back-office systems. Every request is authenticated with a partner API key and authorized against the services assigned to that partner.

• Visa: document upload, application submission, status tracking, application listing, fee catalogue and quotes.
• Flights: search, offer & bundles, reprice, book / hold, retrieve and cancel.
• Hotels: search, property details, room availability, book, retrieve and cancel.
• Attractions: activity search, details, availability, book, retrieve and cancel.
• Pricing: every service above also exposes a price-only endpoint for fast customer quoting, documented inside its own service section.

All services share the same authentication, sandbox behaviour and service authorization. There are two response shapes: the core Visa endpoints (visa-upload, visa-apply, visa-status, visa-applications) return a flat body such as { success, reference, … }, while every other endpoint (Flights, Hotels, Attractions and the /visa/… helpers) returns the standard envelope { success, data, errors, meta }.

Architecture

Partner Website
        |
        | API Request + x-api-key
        v
UTA Partner API
        |
        v
Authentication          (is the API key valid and active?)
        |
        v
Service Authorization   (is this service assigned to the partner?)
        |
        v
UTA Services            (visa, flights, hotels, attractions)

Step 1 — Partner account creation

• Your partner account is created by a UTA administrator.
• The admin assigns the services your account may access — Visa, Flights, Hotels and Attractions.
• A secure API key is generated and shown once. Store it immediately in your secret manager — UTA cannot show it again, only regenerate it.

Step 2 — API authentication

Every request must send your key in the `x-api-key` header.

x-api-key: YOUR_PARTNER_API_KEY

curl https://uta.online/api/public/visa-applications \
  -H "x-api-key: uta_live_xxxxxxxxx" \
  -H "Content-Type: application/json"

https://uta.online/api/public/

https://sandbox.uta.online/api/public/

All endpoints accept and return JSON (`visa-upload` accepts `multipart/form-data`) and support `OPTIONS` pre-flight requests.

Method: API key authentication via the required `x-api-key` request header. Keys are issued per partner, can be regenerated, and can be revoked at any time.

A missing, malformed, revoked or deactivated key returns HTTP 401.

{
  "success": false,
  "error": "Invalid API key."
}

Every partner account belongs to exactly one environment. Sandbox lets you build and test a full integration — visa applications, flight, hotel and attraction bookings — without creating real submissions or supplier reservations.

Environment isolation: a sandbox key used against the production base URL (or a production key against the sandbox base URL) returns HTTP 403. Request and response shapes, validation, pricing and error codes are identical in both environments, so switching to production only requires swapping the base URL and the API key.

curl -X GET "https://sandbox.uta.online/api/public/visa-applications?page=1&pageSize=10" \
  -H "x-api-key: uta_test_xxxxxxxxx"

{
  "success": true,
  "applicationId": "8f1c…",
  "reference": "TEST-VSA-000001",
  "status": "waiting_verification",
  "total_aed": 1350
}

{
  "success": false,
  "error": "Sandbox API keys can only be used against the sandbox base URL."
}

Authentication proves who you are; authorization decides what you may call. Each partner record carries a list of assigned services and endpoints check it on every request.

[
  "visa",
  "flights",
  "hotels",
  "attractions"
]

If an authenticated partner calls an endpoint for a service that is not assigned, the API returns HTTP 403 and no business logic runs. Pricing endpoints are authorized against the same service — /hotels/pricing requires hotels, /visa/quote requires visa, and so on.

{
  "success": false,
  "error": "Partner is not authorized for the \"visa\" service."
}

Uploads a single applicant document (passport copy, photo, Emirates ID, Ejari, hotel booking, etc.) into UTA's private document storage. Send one request per file.

curl -X POST https://uta.online/api/public/visa-upload \
  -H "x-api-key: YOUR_KEY" \
  -F "file=@passport.jpg" \
  -F "document_type=passport-copy"

Creates a visa application for one or more applicants using the same payload shape the UTA website submits. Upload documents first, then reference their storage paths here.

Top-level fields

applicants[]

documents[]

billing

{
  "service_slug": "uae-tourist-visa-30-days",
  "selected_options": {
    "processing": "standard"
  },
  "applicants": [
    {
      "first_name": "John",
      "last_name": "Smith",
      "passport_number": "P123456"
    }
  ],
  "documents": [
    {
      "storage_path": "guests/path/passport.jpg"
    }
  ]
}

Returns the current processing state of one application owned by your partner account.

curl "https://uta.online/api/public/visa-status?reference=VSA-100001" \
  -H "x-api-key: YOUR_KEY"

Downloads the issued eVisa for one of your applications. Use the same reference or applicationId as /visa-status, and call it once /visa-status returns evisaAvailable: true. By default the file (PDF) is returned; add format=json to get it base64-encoded. Sandbox keys receive a sample TEST eVisa for TEST- references.

curl -o evisa.pdf "https://uta.online/api/public/visa-download-evisa?reference=VSA-100001" \
  -H "x-api-key: YOUR_KEY"

Returns your partner account's applications, newest first. Only applications created with your API key are visible.

curl "https://uta.online/api/public/visa-applications?page=1&pageSize=20" \
  -H "x-api-key: YOUR_KEY"

Published fee catalogue for every active visa service: base government fee, UTA service charge, VAT and the refundable security deposit per applicant.

curl "https://uta.online/api/public/visa/pricing" -H "x-api-key: YOUR_KEY"

curl -X POST "https://uta.online/api/public/visa/quote" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "serviceSlug": "uae-tourist-visa",
    "applicants": [{ "personType": "adult" }, { "personType": "child" }],
    "selectedOptions": { "duration": 30, "entry": "single" }
  }'

Helper endpoints that make the application form easier to build. They return the standard envelope { success, data, errors, meta } and need the visa service.

Lists the documents UTA requires for one nationality (passport copy, photo, etc.). country is accepted as an alias for nationality. meta.count is the number of documents.

Returns the values read from the passport (names, passport number, dates, nationality) so you can pre-fill the applicant.

curl "https://uta.online/api/public/visa/documents?nationality=IN" \
  -H "x-api-key: YOUR_KEY"

Returns live priced offers. One-way, return and multi-city are all expressed through the `legs` array, so the payload shape never changes between trip types.

curl -X POST "https://uta.online/api/public/flights/search" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tripType": "round",
    "cabin": "economy",
    "legs": [
      { "from": "DXB", "to": "LHR", "date": "2026-09-01" },
      { "from": "LHR", "to": "DXB", "date": "2026-09-08" }
    ],
    "passengers": { "adults": 2, "children": 0, "infants": 0 }
  }'

Returns the full fare breakdown, baggage rules and any purchasable bundles for one offer. Pass `searchResponseId` from the search response so the offer can be resolved.

curl "https://uta.online/api/public/flights/ofr_01H...?searchResponseId=srch_01H..." \
  -H "x-api-key: YOUR_KEY"

Always reprice immediately before booking. The response tells you whether the fare is still valid and whether the price moved since search.

curl -X POST "https://uta.online/api/public/flights/reprice" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "offerId": "ofr_01H...", "searchResponseId": "srch_01H..." }'

Creates the booking. Send `hold: true` to place the fare on hold instead of issuing — the booking then returns with status `on_hold` and must be confirmed before the deadline.

curl -X POST "https://uta.online/api/public/flights/book" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "offerId": "ofr_01H...",
    "searchResponseId": "srch_01H...",
    "selectedBundles": [{ "journeyKey": "J1", "bundleCode": "FLEX" }],
    "hold": false,
    "passengers": [
      {
        "type": "adult",
        "title": "MR",
        "firstName": "JOHN",
        "lastName": "SMITH",
        "dateOfBirth": "1990-04-11",
        "gender": "male",
        "nationality": "GB",
        "passportNumber": "P1234567",
        "passportExpiry": "2031-06-30"
      }
    ],
    "contact": { "email": "john@example.com", "phone": "+971500000000" },
    "partnerReference": "AGENCY-8891"
  }'

Retrieve returns the current status, tickets and price. Cancel voids or refunds the booking according to the fare rules; a held booking is simply released.

curl "https://uta.online/api/public/flights/bookings/ORD-889201" -H "x-api-key: YOUR_KEY"

Fare-confirms an offer returned by /flights/search and returns the money breakdown only. priceChanged: true means the supplier repriced the offer.

curl -X POST "https://uta.online/api/public/flights/pricing" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "offerId": "OFR-88213", "searchResponseId": "SRCH-1029" }'

Returns available properties with a lead nightly price. Results are paginated; stays are capped at 30 nights and check-out must be after check-in.

curl -X POST "https://uta.online/api/public/hotels/search" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "destinationId": "DXB",
    "checkIn": "2026-09-10",
    "checkOut": "2026-09-13",
    "rooms": 1,
    "adults": 2,
    "children": 1,
    "childAges": [7],
    "nationality": "AE",
    "page": 1,
    "perPage": 25
  }'

Static content for one property: description, address, facilities and gallery. Only fields the supplier actually provides are returned — missing values come back as `null`.

curl "https://uta.online/api/public/hotels/htl_10293" -H "x-api-key: YOUR_KEY"

Returns bookable room rates for one property and stay. Each rate carries a `rateKey` — the only value accepted by the booking endpoint. Rate keys are short-lived, so book promptly.

curl -X POST "https://uta.online/api/public/hotels/availability" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "hotelId": "htl_10293",
    "destinationId": "DXB",
    "checkIn": "2026-09-10",
    "checkOut": "2026-09-13",
    "rooms": 1,
    "adults": 2
  }'

Confirms the reservation against the selected `rateKey`.

curl -X POST "https://uta.online/api/public/hotels/book" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "rateKey": "rk_9f2c...",
    "holder": { "firstName": "JOHN", "lastName": "SMITH" },
    "guests": [
      { "roomNumber": 1, "type": "adult", "firstName": "JOHN", "lastName": "SMITH" },
      { "roomNumber": 1, "type": "child", "firstName": "EMMA", "lastName": "SMITH", "age": 7 }
    ],
    "partnerReference": "AGENCY-4410",
    "remarks": "High floor if possible"
  }'

Cancellation follows the rate's policy — a rate past its `cancellationDeadline` may incur a charge, which is reflected in the returned price.

curl "https://uta.online/api/public/hotels/bookings/HTL-77120" -H "x-api-key: YOUR_KEY"

Returns every bookable rate for one property with the per-night price, the number of nights, and the full-stay total for the requested room count. Same body as/hotels/availability.

curl -X POST "https://uta.online/api/public/hotels/pricing" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "hotelId": "htl_10293",
    "destinationId": "DXB",
    "checkIn": "2026-09-10",
    "checkOut": "2026-09-13",
    "rooms": 1,
    "adults": 2
  }'

Returns bookable activities and tickets for a city. Keep the `countryId` and `cityId` from the response — the detail endpoint needs both.

curl -X POST "https://uta.online/api/public/attractions/search" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "countryId": 1, "cityId": 2, "query": "burj", "page": 1, "perPage": 25 }'

Full activity content plus its ticket options. `countryId` and `cityId` are required query parameters because activity ids are scoped to a destination.

curl "https://uta.online/api/public/attractions/4021?countryId=1&cityId=2&travelDate=2026-09-10" \
  -H "x-api-key: YOUR_KEY"

Confirms live pricing and remaining capacity for a travel date. For slot-based activities the response returns the `timeSlotId` values accepted at booking.

curl -X POST "https://uta.online/api/public/attractions/availability" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "activityId": 4021, "travelDate": "2026-09-10", "adults": 2, "children": 1 }'

Confirms the booking and returns the supplier reference. Slot-based activities require `timeSlotId`; transfer-inclusive options require `transferId` and a `pickupLocation`.

curl -X POST "https://uta.online/api/public/attractions/book" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "activityId": 4021,
    "optionId": 8801,
    "travelDate": "2026-09-10",
    "adults": 2,
    "children": 1,
    "timeSlotId": 1,
    "leadGuest": {
      "firstName": "JOHN",
      "lastName": "SMITH",
      "email": "john@example.com",
      "phone": "+971500000000",
      "nationality": "GB"
    },
    "partnerReference": "AGENCY-2210"
  }'

Retrieve returns the ticket, validity and download URL once issued. Cancellation is only possible while the activity's cancellation policy still allows it.

curl "https://uta.online/api/public/attractions/bookings/RY-100482?supplierBookingId=B-1932" \
  -H "x-api-key: YOUR_KEY"

Returns adult / child / infant unit prices for every option (and transfer variant) of an activity, together with the computed totals for the requested pax mix.

curl -X POST "https://uta.online/api/public/attractions/pricing" \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "activityId": 33,
    "contractId": 300,
    "travelDate": "2026-09-12",
    "adults": 2,
    "children": 1
  }'

Errors always return success: false. Core Visa endpoints return a human-readable error message with optional details; all other endpoints return an errors[] array of { code, message, field }.

{
  "success": false,
  "error": "Invalid JSON body."
}

• Do not send unnecessary repeated requests; batch work where you can.
• Cache responses on your side — poll `/visa-status` on a sensible interval (for example every 15–30 minutes) rather than continuously.
• Apply exponential backoff when you receive `429`, `500` or `502–504` responses.
• Contact UTA before launching high-volume or bulk integrations.

• Never expose API keys publicly — no frontend code, no public repositories.
• Use backend-to-backend communication for every UTA API call.
• Rotate your key immediately if you suspect it was compromised.
• Do not store passport documents outside approved storage — upload them to UTA and keep only the returned `storagePath`.
• Do not log sensitive customer information, API keys or document contents.

All endpoints follow one predictable envelope.

• ☐Receive your sandbox key (uta_test_) and store it in your secret manager
• ☐Test authentication against the sandbox base URL with a simple GET
• ☐Visa: upload documents, submit an application, poll GET /visa-status
• ☐Flights: search, reprice the chosen offer, then book or hold
• ☐Hotels: search, check room availability, then book with a fresh rateKey
• ☐Attractions: search, check availability for the travel date, then book
• ☐Quote customers with the /pricing endpoints and re-price before payment
• ☐Store every returned reference / bookingId against your own order
• ☐Handle 400 / 401 / 403 / 404 / 409 / 422 / 429 / 5xx responses gracefully
• ☐Swap to the production base URL and your uta_live_ key to go live

End-to-end visa flow: upload a document, submit the application, then poll for status. Flights, Hotels and Attractions use the same headers, envelope and error handling — only the paths and bodies differ (see each service section above).

# 1. Upload the passport copy
curl -X POST https://uta.online/api/public/visa-upload \
  -H "x-api-key: $UTA_API_KEY" \
  -F "file=@passport.jpg" \
  -F "document_type=passport-copy"

# 2. Submit the application (use storagePath from step 1)
curl -X POST https://uta.online/api/public/visa-apply \
  -H "x-api-key: $UTA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "service_slug": "uae-tourist-visa-30-days",
    "selected_options": { "processing": "standard" },
    "applicants": [
      { "first_name": "John", "last_name": "Smith", "passport_number": "P123456" }
    ],
    "documents": [ { "storage_path": "guests/path/passport.jpg" } ]
  }'

# 3. Poll the status
curl "https://uta.online/api/public/visa-status?reference=VSA-100001" \
  -H "x-api-key: $UTA_API_KEY"