API Licence Agreement (UAE)

An API Licence Agreement in the United Arab Emirates is a commercial contract under which the owner of an Application Programming Interface grants a licensee the right to access and use the API — typically via authenticated API calls over the internet — within defined parameters including a permitted use case, a call volume limit, a fee structure, and confidentiality obligations. APIs are the technical connective tissue of the digital economy, enabling software systems to exchange data and trigger actions programmatically. UAE API licence agreements are classified as intellectual property licence agreements under the UAE Civil Code (Federal Law No. 5 of 1985) and the Copyright Federal Decree-Law No. 38 of 2021, which protects the API's underlying software, documentation, and original interface design as copyright works owned by the API developer.

The UAE has a rapidly expanding API economy. The Central Bank of the UAE's Open Banking framework (in development under its Financial Infrastructure Transformation Programme) is expected to mandate APIs for licensed payment service providers, enabling licensed third-party fintech companies to access customer account data with consent — on the model of the EU's PSD2. UAE government open data APIs from the Dubai Statistics Centre, the Dubai Land Department (DLD), the Dubai Roads and Transport Authority (RTA), and federal ministries enable licensed data resellers and analytics companies to build value-added services on top of public datasets. Payment gateway APIs from UAE banks and licensed payment service providers such as Network International, Checkout.com, PayTabs, and Telr are the backbone of UAE e-commerce, requiring formal API licence or service agreements before integration. UAE logistics companies including Aramex and the Emirates Post Group provide carrier tracking and shipment management APIs to e-commerce platforms under formal licence agreements.

The Copyright Federal Decree-Law No. 38 of 2021 is the foundational IP statute for API licences. Copyright in the API's source code vests in the developer by default; accessing the API beyond the scope of a valid licence constitutes copyright infringement. The UAE Cybercrime Law (Federal Decree-Law No. 34 of 2021) complements copyright protection by prohibiting unauthorised computer access — obtaining API credentials without a valid licence agreement may constitute a criminal offence under Articles 2 and 3 of the Cybercrime Law.

The Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), administered by the UAE Data Office, applies to API licences that involve the processing of personal data. Where the API owner processes the licensee's customers' personal data, a written data processing agreement or clause is mandatory under the PDPL.

Value Added Tax at 5% under Federal Decree-Law No. 8 of 2017, administered by the Federal Tax Authority (FTA), applies to API licence fees. Both the licensor and the licensee have VAT compliance obligations that should be reflected in the invoicing provisions of the licence agreement.

A UAE API Licence Agreement is required whenever an API owner grants a third party the right to access its API for commercial or operational purposes under the Copyright Federal Decree-Law No. 38 of 2021 and the UAE Civil Code (Federal Law No. 5 of 1985).

Payment API integration. UAE fintech companies and e-commerce platforms integrating UAE bank payment APIs or licensed payment gateway APIs (Network International, Checkout.com, PayTabs, Telr) require a formal API licence or service agreement covering permitted use, transaction volumes, data protection under the PDPL, and Central Bank of the UAE payment services compliance.

Government open data API access. Developers and data companies accessing government open data APIs from the Dubai Land Department (DLD), the Dubai Statistics Centre, or federal ministry portals require formal API access agreements, typically available through the relevant authority's developer portal.

SaaS platform API developer programmes. UAE SaaS companies that open their APIs to third-party developers — allowing integrations, plugins, and connected applications built on their platform — require standardised API licence terms to govern developer obligations, API call limits, IP ownership, and data handling.

B2B data API licensing. UAE companies with proprietary data assets (market data, property prices, logistics tracking data, weather data) who license access to that data via APIs to enterprise customers require formal licence agreements specifying permitted use, call limits, data resale restrictions, and pricing.

Open banking and financial data APIs. UAE financial institutions and fintech companies participating in the Central Bank's Open Banking framework will require formal API licence agreements with licensed third-party providers (TPPs) governed by the UAE Payment Services and Stored Value Facilities framework.

Cross-border API licensing. UAE companies licensing APIs to international customers, or international API providers licensing to UAE enterprise customers, require UAE-compliant agreements addressing PDPL cross-border data transfer requirements and UAE VAT obligations.

A UAE API Licence Agreement compliant with the Copyright Federal Decree-Law No. 38 of 2021 and the UAE Civil Code (Federal Law No. 5 of 1985) must contain the following elements. The forms-legal.com UAE API Licence Agreement template addresses each component in a commercially standard format recognised by the DIFC Courts, the Dubai Courts, and the ADGM Courts.

Party identification must record the full legal name, UAE trade licence number, and registered address of the licensor (API owner) and the licensee.

API description must identify the API by name, version, and functional description. Reference to API documentation attached as Schedule 1 is preferable to trying to describe the API's capabilities in the agreement body.

Licence scope must specify: the licence type (non-exclusive or exclusive within a defined sector/territory); the permitted use case (the specific application or service the licensee may build using the API); sub-licensing restrictions (typically prohibited without express permission); and restrictions on competitive use.

API call limits and overage must state the monthly or daily call limit, the overage charge per additional call, and the licensor's right to throttle or suspend access for limit violations.

Intellectual property must confirm the licensor's ownership of copyright in the API under the Copyright Federal Decree-Law No. 38 of 2021, restrictions on reverse engineering, and the licensee's ownership of its own application built using the API.

Data protection must address PDPL obligations where the API processes personal data: controller/processor identification, data processing restrictions, security measures, breach notification timelines, and cross-border transfer limitations.

Availability and SLA must set the uptime commitment and the remedies (service credits) for availability failures.

Fees and VAT must state the annual licence fee in AED and confirm VAT at 5% under Federal Decree-Law No. 8 of 2017.

Termination provisions must address access revocation, data deletion, and notice periods for deprecation of API endpoints.

Governing law and forum must identify UAE law and the competent court — DIFC Courts, ADGM Courts, Dubai Courts, or Abu Dhabi Judicial Department.

Completing a UAE API Licence Agreement requires the licensor and licensee to agree technical and commercial terms before populating the template. Proceed as follows.

Begin with the parties. Enter the licensor's full legal name from its UAE trade licence or free-zone registration. Enter the licensee's full legal name and UAE trade licence number.

Enter the agreement date in DD/MM/YYYY format.

In the API details section, enter the API name and version. API versioning is important — specifying 'v3.0' ensures the licence covers the current version and addresses how version upgrades are handled. Attach the API documentation as Schedule 1.

Select the licence type. Non-exclusive licences are standard — they allow the licensor to provide the same API to multiple licensees. Exclusive licences within a defined sector are commercially valuable and typically command a premium fee.

Describe the permitted use precisely. Identify the specific application the licensee is building, the user base, and any restrictions. For example: 'Integration into the Licensee's consumer payment application for UAE-resident end-users only; resale or sub-licensing prohibited.'

Enter the API call limits. Be specific about the measurement period (monthly, daily) and the overage charge per additional call. Include a provision allowing the licensee to request temporary limit increases for defined events.

Enter the annual licence fee in AED. Note that VAT at 5% under Federal Decree-Law No. 8 of 2017 applies in addition. Annual billing is common for API licences; monthly billing is also used for usage-based pricing models.

Select the governing forum. DIFC Courts or ADGM Courts are popular choices for API licence agreements involving international licensors and UAE enterprise licensees, due to their English-language proceedings and commercial law expertise.

Both parties sign through authorised representatives. Electronic signatures are valid under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021).

A UAE API Licence Agreement must comply with the following legal requirements.

Copyright protection under the Copyright Federal Decree-Law No. 38 of 2021 protects the API software, specification, and documentation. Copyright vests in the licensor by default. A valid written licence is required for the licensee to access and use the API lawfully. Unlicensed access may constitute copyright infringement and, where credentials are obtained without authorisation, a criminal offence under Articles 2 and 3 of the UAE Cybercrime Law (Federal Decree-Law No. 34 of 2021).

Licence formality under the Copyright Federal Decree-Law No. 38 of 2021 requires IP licences to be documented in writing. Click-wrap API terms published on a developer portal constitute valid written licences under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021), provided the licensee had reasonable opportunity to review them before accepting.

Data protection under the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) requires a written data processing agreement or clause where the API involves processing personal data. The UAE Data Office may investigate and penalise non-compliant API data processing arrangements.

Payment API compliance: API licences for UAE payment APIs must comply with the Central Bank of the UAE's payment services licensing requirements. Third-party access to payment infrastructure requires the licensee to hold or rely on an appropriate CBUAE payment services licence.

VAT obligations under Federal Decree-Law No. 8 of 2017 require VAT-registered licensors to charge VAT at 5% on API licence fees and issue FTA-compliant tax invoices.

Corporate authority under the Commercial Companies Law (Federal Decree-Law No. 32 of 2021) requires corporate signatories to hold board authorisation or a valid power of attorney.

Electronic execution is valid under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021).

UAE API Licence Agreements regularly lead to disputes and IP exposure because of the following recurring errors.

1. No written licence. Accessing an API under informal arrangements ('the API owner said it was OK by email') without a signed written licence agreement exposes the licensee to copyright infringement claims under the Copyright Federal Decree-Law No. 38 of 2021 and potentially criminal liability under the Cybercrime Law. Always execute a written licence agreement before integrating an API.

2. Vague permitted use. An agreement that licences use of 'the API for the licensee's business' without specifying the exact application and user base fails to prevent the licensee from sub-licensing to third parties or using the API for unintended purposes. Define permitted use precisely.

3. No call limit and overage provisions. Accepting an API licence without addressing call limits and overage charges creates cost uncertainty. Licences with uncapped usage and per-call overage charges can generate unexpectedly large invoices after a traffic spike.

4. Missing sub-licensing prohibition. An agreement that does not expressly prohibit sub-licensing leaves the licensor unable to prevent the licensee from reselling API access. Include an explicit prohibition.

5. No PDPL data processing clause. Where the API processes personal data, omitting a data processing clause violates the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Include a data processing schedule.

6. Insufficient API deprecation notice. Accepting an agreement where the licensor can deprecate API endpoints or change the API without advance notice can disable the licensee's product. Require minimum 60 to 90 days deprecation notice.

7. Ignoring VAT. Agreeing an annual licence fee without addressing VAT at 5% under Federal Decree-Law No. 8 of 2017 creates invoice disputes. State the VAT position clearly.

8. No API versioning and deprecation policy. An agreement that allows the licensor to change or deprecate the API at will without advance notice can disable the licensee's product overnight. Require a minimum 90-day deprecation notice for any breaking change or endpoint removal, and a defined versioning policy that maintains backward compatibility for a reasonable period.

9. Accepting click-wrap terms without legal review. Many UAE API providers present standard developer terms that are heavily tilted in their favour — broad IP licences over data processed through the API, unilateral right to change call limits, and uncapped liability for the licensee. Enterprise UAE customers should negotiate key terms covering data ownership, sub-processing restrictions, availability SLAs, and exit data portability before accepting any API licence, regardless of whether the provider's default is click-wrap acceptance under the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021).