Spring naar de inhoud

General API Terms and Conditions

In order to use the Schiphol API platform and the APIs offered on the platform, you must accept the following general API terms and conditions.

A. Definitions

In these General API Terms and Conditions, the following terms have the meanings set out below:

  1. Account Plan: the usage rights, restrictions, rate limits and other conditions applicable to a specific API or API User, as specified on the API Platform.
  2. API: an application programming interface made available by Schiphol through the API Platform.
  3. API Data: any data, information or other content made available through an API.
  4. API Platform: the Schiphol API platform through which Schiphol provides access to APIs.
  5. API User: the natural person or legal entity that registers for or obtains access to the API Platform or an API.
  6. Client ID & Client Secret: 2 unique identifiers, issued by Schiphol together, to an API User, used for generating a JSON Web Token.
  7. Documentation: the technical, functional, and other documentation relating to an API, as made available on the API Platform.
  8. General API Terms and Conditions: these General API Terms and Conditions.
  9. Intended Use: the permitted use of a specific API and the API Data, as described in the Documentation, the relevant Account Plan or the Specific API Terms and Conditions.
  10. JSON Web Token: a time-restricted token, which can only be generated with a valid Client ID and Client Secret, to access one or more APIs.
  11. Specific API Terms and Conditions: any additional or deviating terms and conditions applicable to a specific API.
  12. Schiphol: Schiphol Nederland B.V., a private company with limited liability, with its corporate seat in Haarlemmermeer and its offices at Evert van de Beekstraat 202, 1118 CP Schiphol, the Netherlands, registered with the Dutch Chamber of Commerce under number 34166584.

B. Registration and use of Client ID & Client Secret

  • The API User must provide its correct personal name and, where applicable, its correct company name when registering for the API Platform.
  • Where a person registers on behalf of a company or other legal entity, that person represents that they are authorised to act on behalf of and legally bind to that entity.
  • The API User must ensure that its registration information remains accurate, complete, and up to date.
  • Subject to compliance with these General API Terms and Conditions, Schiphol grants the API User a limited, non-exclusive, non-transferable and revocable right to access and use the API Platform and the applicable APIs for the Intended Use.
  • Schiphol allows the API User to generate a JSON Web Token using the obtained Client ID & Client Secret. The Client ID & Client Secret are issued to the relevant API User and may not be transferred or made available to another party, except as expressly permitted under these General API Terms and Conditions.
  • The API User remains responsible for all access to and use of the APIs through its account and Client ID & Client Secret, including use by its employees, contractors and other authorised persons.
  • The API User may distribute API Data to another party only where such distribution:
    • is necessary for and consistent with the Intended Use
    • is not prohibited by the Documentation, the Account Plan or the Specific API Terms and Conditions; and
    • complies with applicable law and these General API Terms and Conditions.
  • The API User must immediately notify Schiphol if it knows or reasonably suspects that an Client ID & Client Secret or account has been lost, compromised, disclosed without authorisation or otherwise misused.
  • Schiphol may revoke or replace an Client ID & Client Secret if Schiphol considers this reasonably necessary for security, technical, operational, or compliance purposes.

C. Intellectual property rights

  • All intellectual property rights in and relating to the API Platform, the APIs, the Documentation and the API Data are and remain vested in Schiphol or its licensors. No intellectual property rights are transferred to the API User.
  • Subject to these General API Terms and Conditions, the relevant Account Plan and any Specific API Terms and Conditions, Schiphol grants the API User a limited, non-exclusive, non-transferable, non-sublicensable and revocable license to:
    • access and use the relevant API;
    • use the API Data; and
    • incorporate API Data into the API User’s application, solely for the Intended Use.
  • The API User retains all intellectual property rights in its own applications, software, analyses and derivative works, excluding:
    • the API Platform, APIs and Documentation;
    • the API Platform, APIs and Documentation;
    • Schiphol’s intellectual property; and
    • the intellectual property of Schiphol’s licensors or partners.
  • The creation of an application, analysis or derivative work does not grant the API User any ownership right in the underlying API Data.
  • The names, logos, trademarks and other brand elements of Schiphol and Schiphol’s partners, including airlines, may not be used without the prior written consent of the relevant rights holder.
  • The API User may not state or suggest that it or its products or services are approved, certified, endorsed, selected or operated by, affiliated with, or acting on behalf of Schiphol, unless Schiphol has expressly agreed to this in writing.
  • The API User may not remove, obscure or alter any copyright notice, trademark, source attribution or other proprietary notice included in the API Platform, Documentation or API Data.

D. Use of the APIs

  • The API User may use the API Platform, APIs and API Data only:
    • for the Intended Use;
    • in accordance with the applicable Account Plan, Documentation and Specific API Terms and Conditions;
    • in compliance with applicable laws and regulations; and
    • in a manner that does not adversely affect the availability, integrity, security or operation of the API Platform, an API or a third-party system.
  • The API User is responsible for its own systems, applications, services, and use of API Data.
  • The API User must verify the accuracy, completeness, relevance and suitability of API Data before relying on it or providing it to another party.
  • The API Platform and APIs are made available for an indefinite period. Schiphol reserves the right to modify, suspend or discontinue the API Platform or an API at any time without prior notice.
  • The API User may not rely on the continued availability, format, content or performance of the API Platform, an API or API Data.
  • Upon discontinuation or termination of access to an API, the API User must immediately:
    • stop accessing and using the API;
    • stop obtaining new API Data through that API; and
    • delete all cached or stored API Data obtained through that API.
  • Paragraph 6(c) does not apply where and for as long as retention is required under applicable law. Any retained API Data must be isolated from further operational use, appropriately protected and deleted when the applicable statutory retention obligation ends.

E. Data protection

  • If the API User processes personal data obtained through or in connection with an API, the API User must ensure that such processing complies with all applicable data protection and privacy laws.
  • The API User is solely responsible for ensuring that its processing of personal data is lawful, fair, and transparent.
  • To the extent that the API User determines the purposes and means of processing personal data obtained through or in connection with an API, the API User acts as an independent controller of such personal data.
  • The API User is independently responsible for compliance with all obligations applicable to it in its capacity as controller, including obligations relating to transparency, data-subject rights, security, retention and accountability.
  • Nothing in these General API Terms and Conditions creates a joint-controller or processor relationship between Schiphol and the API User. If the processing in connection with a specific API requires Schiphol and the API User to enter an additional data-processing or joint-controller arrangement, that arrangement must be agreed separately in writing.
  • The API User may not:
    • attempt to identify or re-identify a natural person from anonymous, aggregated, statistical, pseudonymised or otherwise protected API Data;
    • combine API Data with other data for the purpose of identifying a natural person, unless such identification is necessary for the Intended Use and permitted under applicable law;
    • process special categories of personal data or personal data relating to criminal convictions and offences through or in connection with the APIs, unless permitted by applicable law and expressly permitted by Schiphol; or
    • use personal data obtained through an API for direct marketing, behavioral advertising or individual profiling unless this is expressly permitted under the Intended Use and under applicable law.

F. Security

  • The API User must implement and maintain appropriate technical and organisational measures to protect:
    • its account and Client ID & Client Secret;
    • API Data;
    • the API User’s applications and systems; and
    • the API Platform and APIs against risks arising from the API User’s use.
  • The security measures must be appropriate having regard to:
    • the nature and sensitivity of the API Data;
    • the nature and scope of the API User’s use;
    • the reasonably foreseeable security risks;
    • the state of the art; and
    • the costs of implementation.
  • At a minimum, the API User must:
    • keep Client ID, Client Secret and other access credentials confidential and secure;
    • restrict access to authorised persons on a need-to-know and least-privilege basis;
    • use secure and supported software, systems and protocols;
    • apply relevant security updates and patches within an appropriate period;
    • protect API Data against unauthorised or unlawful access, disclosure, alteration, loss or destruction;
    • take appropriate measures to detect unauthorised or abnormal use;
    • prevent vulnerabilities in its applications or systems from affecting the API Platform or Schiphol; and
    • securely delete API Data when retention is no longer necessary or permitted.
  • The API User must notify Schiphol via api-support@schiphol.nl without undue delay after becoming aware of:
    • unauthorised access to or use of an API, Client ID, Client Secret or API Data;
    • loss, disclosure, corruption or compromise of API Data;
    • a vulnerability or security incident that affects or may reasonably affect the API Platform, an API or Schiphol; or
    • any other material security incident connected with the API User’s use of an API.
  • The notification must include the information reasonably available to the API User regarding the nature, scope, likely consequences, and mitigation of the security incident.
  • The API User must reasonably cooperate with Schiphol in investigating and mitigating the security incident.
  • The API User may not test, scan or probe the security or vulnerability of the API Platform or an API without Schiphol’s prior written consent, except where expressly permitted under a responsible-disclosure policy published by Schiphol.
  • The API User may not publicly disclose a suspected vulnerability before giving Schiphol a reasonable opportunity to investigate and address it.
  • Schiphol may immediately revoke or replace a Client ID & Client Secret or suspend access if Schiphol reasonably considers this necessary to address a security incident or risk.

G. Rate limits and technical restrictions

  • Schiphol may apply and modify rate limits, usage quotas, storage limits, concurrency limits and other technical restrictions to an API or Account Plan.
  • The applicable limits may be specified in the Account Plan, Documentation, Specific API Terms and Conditions or through the API Platform.
  • The API User may not circumvent or attempt to circumvent an applicable limit, including by:
    • creating or using multiple accounts or Client ID & Client Secrets;
    • distributing requests across multiple systems or identities; or
    • using another technical measure intended to avoid the limit.
  • If the API User exceeds or attempts to circumvent an applicable limit, Schiphol may throttle or reject requests, restrict functionality, revoke an Client ID & Client Secret or suspend access without prior notice.
  • Schiphol is not obliged to process requests that exceed an applicable technical limit.

H. Prohibited use

Unless expressly permitted in writing by Schiphol, the API User may not:

  • use the API Platform, APIs or API Data for any unlawful or fraudulent purpose;
  • use the APIs or API Data for any purpose other than the Intended Use;
  • circumvent or attempt to circumvent authentication, authorisation, security, rate-limiting or access-control mechanisms;
  • access or attempt to access an API, API Data, account, system or functionality for which the API User has not been authorised;
  • introduce or transmit malware, viruses, ransomware, malicious code or other harmful components;
  • carry out or facilitate a denial-of-service attack or any activity that imposes an excessive or disproportionate load on the API Platform;
  • scrape, harvest, systematically download or otherwise collect API Data in bulk outside normal and permitted API use;
  • reverse engineer, decompile or disassemble the API Platform or an API, except to the extent that such restriction is prohibited by mandatory law;
  • sell, license, sublicense or commercially redistribute API Data in its original or substantially equivalent form;
  • use the APIs or API Data to create a competing source of raw Schiphol data;
  • use the APIs or API Data to train, fine-tune, validate or otherwise develop an artificial-intelligence or machine-learning model;
  • use the APIs or API Data to generate, display or distribute unlawful, inaccurate, deceptive, misleading, defamatory, discriminatory, harmful or offensive content;
  • use the APIs or API Data for unlawful surveillance, unlawful profiling or unlawful automated decision-making;
  • infringe the intellectual property rights, privacy rights or other rights of Schiphol or a third party;
  • falsely attribute information, applications, services or communications to Schiphol;
  • use the APIs or API Data for unsolicited commercial communications, spam or other unwanted mass communications; or
  • assist or enable another party to perform an activity prohibited under these General API Terms and Conditions.

I. Changes and version management

  • Schiphol may modify the API Platform, an API, API Data, the Documentation, an Account Plan, or any functionality.
  • Schiphol may introduce new API versions and may designate an existing API version as deprecated or no longer supported.
  • Were reasonably practicable, Schiphol will publish information about material technical changes, deprecation or discontinuation through the API Platform or Documentation.
  • Schiphol is not obliged to:
    • maintain backwards compatibility;
    • continue supporting a previous API version;
    • maintain a particular data format or structure; or
    • continue making particular API Data or functionality available.
  • The API User is responsible for:
    • monitoring the API Platform and Documentation for changes;
    • testing the continued operation of its applications;
    • implementing any changes required to maintain compatibility; and
    • ensuring that its continued use remains consistent with the Intended Use and these General API Terms and Conditions.
  • Schiphol will not be liable for changes that the API User must make to its application, systems, operations or services because of a modification, new version, deprecation or discontinuation.

J. Monitoring and compliance

  • Schiphol may monitor use of the APIs offered through the API Platform and may use the resulting information for:
    • operating, securing and improving the API Platform;
    • checking compliance with these General API Terms and Conditions and any Specific API Terms and Conditions;
    • preventing and investigating misuse, fraud and security incidents; and
    • providing usage insights to relevant API stakeholders.
  • Schiphol may immediately suspend an API User if Schiphol believes that the API User does not comply with these General API Terms and Conditions or any Specific API Terms and Conditions, or in the event of technical or security issues.
  • Schiphol reserves the right to audit the source code of applications and IT systems to verify that use complies with these General API Terms and Conditions and any Specific API Terms and Conditions.
  • Schiphol reserves the right to suspend API use immediately if such use conflicts with the commercial interests of Schiphol.
  • Monitoring, suspension or an audit by Schiphol does not relieve the API User of its responsibilities and does not constitute approval of the API User’s application, service or use of API Data.

K. Export controls and sanctions

  • The API User must comply with all applicable trade, export-control and sanctions laws and regulations, including applicable restrictive measures adopted by the European Union, the United Nations and the Netherlands.
  • The API User represents and warrants that neither it nor any person acting on its behalf in relation to use of the APIs:
    • is subject to applicable asset-freezing measures or other sanctions that prohibit or restrict access to the API Platform;
    • is owned or controlled by a sanctioned person or entity in circumstances where the applicable sanctions extend to such ownership or control; or
    • will use, export, re-export, transfer or otherwise make the API Platform, APIs or API Data available in breach of applicable sanctions or export-control laws.
  • The API User may not use or make available the API Platform, APIs or API Data:
    • in or for the benefit of a country, territory, person or entity where this is prohibited by applicable sanctions;
    • for a prohibited military, weapons-related, nuclear or other restricted end use; or
    • in any manner that would cause Schiphol to breach applicable sanctions or export-control requirements.
  • Schiphol may immediately suspend or terminate access if it reasonably suspects that continued access or use may breach applicable sanctions or export-control requirements.
  • The API User must promptly provide information reasonably requested by Schiphol to verify compliance with this section.

L. Availability and disclaimer of warranties

  • The API Platform, APIs, Documentation and API Data are provided on an “as is” and “as available” basis.
  • To the extent permitted by law, Schiphol excludes all express and implied warranties, representations and conditions, including warranties concerning:
    • availability, continuity or performance;
    • accuracy, completeness, timeliness or fitness for a particular purpose;
    • compatibility with the API User’s applications or systems;
    • freedom from errors, interruptions, vulnerabilities or harmful components; and
    • non-infringement of third-party rights.
  • The API User is responsible for:
    • determining whether an API and API Data are suitable for its intended application;
    • verifying API Data before relying on or distributing it;
    • implementing appropriate contingency and fallback measures; and
    • the design, operation, and results of its applications and services.

M. Limitation of liability

  • To the extent permitted by law, Schiphol will not be liable for loss or damage arising from or relating to:
    • use of or inability to use the API Platform or an API;
    • interruption, restriction, suspension, modification or discontinuation of the API Platform or an API;
    • inaccurate, incomplete, outdated, delayed or unavailable API Data;
    • loss, corruption or unauthorised disclosure of data;
    • revocation or replacement of a Client ID & Client Secret;
    • reliance on API Data; or
    • an act or omission of the API User or a third party.
  • To the extent permitted by law, Schiphol will not be liable for any indirect, consequential, incidental, special or punitive loss or damage, or for loss of profit, revenue, business, contracts, anticipated savings, goodwill or data.
  • Nothing in these General API Terms and Conditions excludes or limits liability to the extent that such liability cannot lawfully be excluded or limited.

N. Indemnification

  • The API User will indemnify and hold harmless Schiphol, its group companies, officers, employees and business partners against third-party claims, proceedings, damages, losses, fines, penalties and reasonable costs, including reasonable legal costs, arising from or relating to:
    • the API User’s use of the API Platform, APIs or API Data;
    • the API User’s application, product or service;
    • a breach of these General API Terms and Conditions, an Account Plan or Specific API Terms and Conditions;
    • infringement of intellectual property rights, privacy rights or other third-party rights by the API User;
    • the API User’s unlawful processing of personal data;
    • a security incident attributable to the API User’s failure to comply with its obligations; or
    • inaccurate, misleading, or unlawful information distributed by the API User using or based on API Data.
  • The indemnity applies only to the extent that the claim, loss or cost is attributable to an act or omission of the API User or a person for whom the API User is responsible.
  • Schiphol will notify the API User within a reasonable period after becoming aware of a third-party claim for which indemnification is sought.
  • A failure to notify the API User does not release the API User from its obligations, except to the extent that the delay materially prejudices the API User’s defense.
  • The API User may not settle a claim in a manner that admits liability by Schiphol, imposes an obligation on Schiphol or adversely affects Schiphol’s rights or reputation without Schiphol’s prior written consent.

O. Changes to the terms

  • Schiphol may amend these General API Terms and Conditions, an Account Plan or the Specific API Terms and Conditions.
  • Amended terms will be published on or made available through the API Platform and will specify the date from which they apply.
  • An amendment may take effect immediately where this is reasonably necessary:
    • to comply with applicable law or an instruction from a competent authority;
    • to address a security risk;
    • to prevent fraud or misuse;
    • to protect the API Platform or other API users; or
    • to correct an evident error.
  • In other cases, an amendment will take effect on the date specified by Schiphol.
  • The API User is responsible for regularly reviewing the applicable terms.
  • Continued access to or use of the API Platform or an API after the effective date of an amendment constitutes acceptance of the amended terms.
  • If the API User does not agree to an amendment, the API User must stop using the API and terminate its account before the amendment takes effect.
  • An amendment does not retroactively change rights or liabilities that arose before its effective date, unless required by law or expressly agreed in writing.

P. Termination

  • The API User may stop using an API and terminate its account at any time.
  • Schiphol may suspend, restrict or terminate an API User’s access, account or Client ID and Client Secrets immediately if:
    • the API User breaches these General API Terms and Conditions, an Account Plan or the Specific API Terms and Conditions;
    • Schiphol suspects unauthorised, unlawful, fraudulent, insecure or abusive use;
    • suspension or termination is necessary to protect Schiphol, another API user, a third party or the security or stability of the API Platform;
    • the API User fails to cooperate with a compliance or security investigation;
    • continued access may breach applicable law; or
    • Schiphol discontinues the relevant API or the API Platform.
  • Upon termination, the API User must comply with the obligations set out in sections D.6 and D.7.
  • Termination does not affect rights and obligations that arose before termination.
  • Provisions concerning intellectual property, data protection, security, deletion, liability, indemnification, applicable law and dispute resolution will continue to apply after termination to the extent required by their nature or purpose.

Q. Other provisions

  1. No waiver. A failure or delay by Schiphol in exercising a right does not constitute a waiver of that right.
  2. Severability. If a provision is found to be invalid or unenforceable, the remaining provisions will remain in effect. The invalid or unenforceable provision will be replaced by a valid provision that reflects its purpose as closely as legally possible.
  3. Assignment. The API User may not assign or transfer its account, Client ID & Client Secret, rights or obligations without Schiphol’s prior written consent.
  4. Schiphol may assign or transfer its rights and obligations to another company within Royal Schiphol Group or in connection with a restructuring, transfer of business or transfer of the API Platform.
  5. No partnership or agency. These General API Terms and Conditions do not create a partnership, joint venture, agency, employment or franchise relationship between Schiphol and the API User.
  6. Entire agreement. These General API Terms and Conditions, the applicable Account Plan, the Documentation and any Specific API Terms and Conditions constitute the agreement between Schiphol and the API User regarding use of the relevant APIs.
  7. Third party rights. Except where expressly stated otherwise, these General API Terms and Conditions do not create rights for third parties.
  8. Language. If these General API Terms and Conditions are translated, the English version will prevail in the event of inconsistencies, unless mandatory law provides otherwise.
  9. Applicable law. These General API Terms and Conditions and all contractual and non-contractual obligations arising from or relating to them are governed exclusively by Dutch law.
  10. Jurisdiction. Any dispute arising from or relating to the API Platform, an API, API Data or these General API Terms and Conditions will be submitted exclusively to the competent court of Amsterdam, the Netherlands, unless mandatory law provides otherwise.

Contact us for business or commercial questions

api-support@schiphol.nl