API Monetization in Dubai 2026: Stop Giving Your API Away

If your Dubai software already answers requests from another company’s system, you are running an API business and almost certainly giving it away. The UAE is the only market in the region where the price of an API call is set in law: the CBUAE’s AlTareq hub, operated by Nebras, charges between 2.5 and 12.5 fils per technically successful call, VAT included. That is AED 25,000 to AED 125,000 per million calls for data a bank already holds. Meanwhile the raw infrastructure cost of serving a million calls in the UAE is roughly AED 14. The gap between those two numbers is the whole opportunity, and most Dubai companies never price it.

The stakes: APIs became a revenue line while Dubai was still calling them integrations

Three numbers frame this. 65% of organisations now generate revenue directly from their APIs, and of those, 74% earn at least 10% of total company revenue from the API programme, with 25% earning more than half (Postman, State of the API). 82% of organisations describe themselves as API-first to some degree and 25% are fully API-first. And the UAE Digital Economy Strategy is targeting a jump in the digital economy’s share of GDP from 9.7% to 19.4%, taking the national digital economy from roughly USD 38 billion to over USD 140 billion by 2031.

The regulatory half matters more locally. The CBUAE Open Finance Regulation came into force on 10 July 2025 under Circular 3/2025, and Article 61 of Federal Decree-Law No. 6 of 2025 names Open Finance services a Licensed Financial Activity. Every bank and insurer in Phase 1 connects through one central hub, AlTareq, run by Nebras Open Finance. As of July 2026 only 5 of 15 publicly verifiable banks were live on it — Commercial Bank of Dubai, ADIB, FAB, Dubai Islamic Bank and Mashreq — with 16 September 2026 as the key transition deadline. Licensed third parties have started trading on top of it.

Read the hub’s published commercial model and you are reading a government-sanctioned API rate card. Service Initiation API calls are 2.5 fils each. A balance check or confirmation-of-payee call is 0.5 fils when paired with a payment inside two hours. Across all API types the band is 2.5 to 12.5 fils per call, charged only on technically successful calls, all fees inclusive of VAT. Payment-type fees sit alongside: 25 fils for a consumer or SME P2P transfer, 20 fils falling to 17 fils by Year 3 for me-to-me transfers, AED 4 for large-value, rent and invoice payments, and merchant collections at 38 basis points capped at AED 50 per transaction in Year 1, declining to 25bps by Year 5.

The UAE published a price per API call before most Dubai software companies published a price per API key. If a regulator can meter a call at 2.5 fils, so can you.

The mistake almost every Dubai software company makes

Here is the pattern we see in Business Bay and DIFC board rooms every month. A logistics platform, a clinic system, a property portal or an HR product gets asked by a large client for “an API”. Engineering builds endpoints, hands over a key in an email, and the commercial team books it as a free feature that helped close the deal. Two years later that API is carrying millions of calls a month for a dozen partners, is the hardest part of the system to change, has no quotas, no per-client metering and no contract — and generates AED 0.

The business that got the API, meanwhile, resells the capability. That is not a technology failure. It is a packaging failure, and the market has already moved: 85% of SaaS companies either use or are implementing usage-based pricing and 77% of enterprise software providers now incorporate consumption pricing (L.E.K.). In one annual survey of around 240 software and AI companies, hybrid pricing — a platform fee plus metered use — rose from 27% to 41% in a single year, while seat-based fell from 21% to 15% and flat fees from 29% to 22%. Hybrid pricing also posted the strongest retention, at a 105% median net revenue retention.

What a call actually costs you in the UAE

Price from margin, not from fear. Here are live UAE-region list prices pulled from the providers’ own pricing APIs on 23 October 2026, converted at the pegged AED 3.6725 to the dollar.

Gateway option	UAE region	Cost per 1M calls	Platform fee
AWS API Gateway — HTTP API	me-central-1 (UAE)	USD 1.22 / AED 4.48 (first 300M, then USD 1.10)	None
AWS API Gateway — REST API	me-central-1 (UAE)	USD 3.85 / AED 14.14 (then 3.51, 2.98, 1.89 at volume)	None
AWS managed developer portal	me-central-1 (UAE)	n/a	USD 137.50 / AED 505 per month, 10 products included
Azure API Management — Consumption	UAE North	USD 4.20 / AED 15.43	None
Azure APIM — Standard v2	UAE North	USD 2.50 / AED 9.18	USD 0.9589/hr, about AED 2,570 per month
Azure APIM — Basic v2	UAE North	USD 3.00 / AED 11.02	USD 0.20548/hr, about AED 551 per month
Google Apigee — pay-as-you-go	No UAE region	USD 20 / AED 73.45 standard proxy, USD 100 extensible	Environment from about USD 365 per month
Kong Konnect Plus	Self-hosted in UAE	USD 200 / AED 734 per extra million	About USD 105 per gateway service per month

Three things in that table are worth the read on their own. First, the UAE region carries a premium: AWS HTTP APIs cost 22% more in me-central-1 than the US list price of USD 1.00 per million, REST APIs 10% more, and Azure’s consumption tier is about 20% above its US reference. Budget it, do not be surprised by it.

Second, AWS quietly turned the developer portal into a product. The managed portal launched in November 2025 and in the UAE region bills at AED 505 per portal per month with ten portal products included and AED 50.50 per additional product — cheaper than two days of a developer’s time building a portal you then have to maintain.

Third, and this is the margin headline: at AED 14.14 per million REST calls, the regulated Open Finance floor price of 2.5 fils per call is roughly 1,770 times your infrastructure cost. Nobody is suggesting you charge a regulated rate. But if your current API price is zero, your pricing conversation is not about cents of compute. It is about the value of the data and the workflow behind the endpoint. See our Dubai data warehouse and analytics platform cost guide if the asset you want to sell access to is a dataset rather than a transaction.

Choosing a model: four that work here

Per-call (pure metered). Simplest to explain, matches the Open Finance precedent, and best when the call maps to a clear event — a credit check, a trade-licence lookup, a delivery booking. Needs a rating engine and tight idempotency rules so a retry is not billed twice.
Tiered quota. Bands of calls per month at a fixed AED price, with overage above. Easiest for UAE procurement to approve because it looks like a subscription on the purchase order.
Hybrid (platform fee plus metered). The 41%-and-rising majority model. An AED platform fee covers support, SLA and sandbox access; usage covers volume. Best retention of the four.
Revenue share or basis points. Right when your API moves money or closes a sale — the same logic as AlTareq’s 38bps merchant collection fee capped at AED 50. Harder to audit, much easier to sell to a partner with no budget line.

If you already bill recurring AED subscriptions, the metering layer is the only genuinely new engineering. Our UAE subscription billing and recurring payments guide covers the invoicing side; API monetisation bolts an event pipeline and rating engine onto it.

Six things you must ship before you can charge for a call

You cannot invoice what you cannot count, and you cannot defend what you cannot throttle. This is the minimum, and the security half is not optional: 87% of organisations were hit by an API-related security incident in 2025, average daily API attacks per organisation rose 113% year on year from 121 to 258, yet only 21% of organisations rate their ability to detect attacks at the API layer as high and just 13% can prevent more than half of them (Akamai, 2026 State of the Internet).

Per-client identity and keys. One key per client per environment, rotatable without a deployment, revocable in seconds. Shared keys make metering and incident response impossible.
Quotas and rate limits. A hard ceiling per plan and a burst limit per second. This is both your product tiering and your first line of defence against a partner’s runaway retry loop.
Metering you would show an auditor. Count only technically successful calls, as the UAE hub does, store raw events immutably, and reconcile the rating engine against them monthly. Disputed invoices kill API programmes faster than outages.
A developer portal with a sandbox. Self-serve docs, test keys and an OpenAPI spec. Partners that can integrate without a meeting integrate faster and churn less.
Versioning and a deprecation policy. Publish how long a version lives and how much notice a breaking change gets, in writing, before the first contract.
An SLA you can actually measure. Uptime, p95 latency and support response, instrumented and reported. If your API is in a client’s critical path, this is what the legal team will ask for.

Where the API exposes personal data, UAE Federal Decree-Law No. 45 of 2021 (PDPL) governs the transfer even though its Executive Regulations and fine schedule were still not issued as of October 2026. The exposure is commercial, not just regulatory: IBM put the average cost of a data breach in the Middle East at USD 8.0 million in 2026, the highest of any region studied. Our UAE PDPL compliance checklist covers the consent and transfer basics before you put customer records behind a paid endpoint.

What it costs to turn an existing API into a product in Dubai

Most Dubai companies at this stage already have working endpoints. What is missing is the commercial layer. Typical Aquarius engagement ranges, 2026:

Scope	What you get	AED	Timeline
API productization audit	Endpoint inventory, pricing model recommendation, quota design, margin model	12,000 – 25,000	1 – 2 weeks
Gateway, keys and quotas	Managed gateway in UAE region, per-client keys, rate limits, logging, alerting	35,000 – 75,000	3 – 5 weeks
Metering and billing	Event ingestion, rating engine, AED invoicing with 5% VAT, overage handling	60,000 – 160,000	6 – 12 weeks
Developer portal and sandbox	Docs, OpenAPI, self-serve signup, test keys, status page	30,000 – 70,000	3 – 6 weeks
Open Finance TPP build	AlTareq integration, FAPI-grade security profile, consent flows, licence support	180,000 – 450,000+	12 – 24 weeks

If you are heading for the regulated route, budget the licence too: the CBUAE charges TPPs AED 20,000 per year above 50,000 active connections and AED 100,000 per year above 100,000, calculated on an annual average. Our Open Finance and AlTareq integration guide goes deeper on that path.

VAT: who you charge 5% and who you do not

API revenue is a supply of services. Sell to a UAE customer and it carries the standard 5% VAT. Sell to a genuinely non-resident customer and Article 31(1)(a) of the VAT Executive Regulation can zero-rate it — but the recipient must have no relevant UAE presence and be outside the State when the service is performed, which the FTA tests as a UAE presence of under 30 days within a rolling 12 months and not effectively connected to the supply. The 15 November 2024 amendments narrowed this further. Note also that the AlTareq fees quoted above are stated VAT-inclusive, which is unusual and easy to mis-model. For the detail, read our guide to VAT on SaaS and digital products in the UAE, and for the multi-tenant plumbing underneath a paid API, our multi-tenant SaaS architecture guide.

How Aquarius runs this

We start with the audit, not the code, because the expensive mistake is metering the wrong event. In two weeks you get an endpoint inventory with call volumes, a recommended pricing model with the margin maths at your actual UAE region costs, and a quota design — a document your commercial team can price from and your engineers can build from. Then we ship the gateway, keys, metering and portal in phases, each one independently useful, so the programme earns before it is finished. Fixed scope and fixed price per phase, hosted in me-central-1 or UAE North when data residency matters, and you own every line of code and every credential. Our pricing page lists the engagement models.

The cost of waiting is specific. Every month your API runs unmetered, a partner is building a business on your data at your expense, and the switching cost you could have charged for is accruing to them. Start with the audit: book a 30-minute API monetization review and we will tell you what your current endpoints would be worth priced.

FAQ

How much should a Dubai company charge per API call?

Price from value, not compute. Infrastructure costs roughly AED 4.48 to AED 15.43 per million calls in UAE regions, while the regulated Open Finance band is 2.5 to 12.5 fils per call — around 1,770 times higher. Anchor on what the call saves or earns the client: a credit decision, a booking or a compliance check is worth fils, not fractions of one.

Do I need a CBUAE licence to sell access to my API?

Only if the API performs a Licensed Financial Activity. Open Finance data exchange and payment initiation require a CBUAE Open Finance licence under Article 61 of Federal Decree-Law No. 6 of 2025, with annual fees of AED 20,000 above 50,000 active connections and AED 100,000 above 100,000. A logistics, HR, retail or healthcare API carries no such requirement, though PDPL still applies to personal data.

Is API revenue subject to UAE VAT?

Yes at 5% for UAE customers. Supplies to genuinely non-resident recipients may be zero-rated under Article 31(1)(a) of the VAT Executive Regulation, subject to the under-30-days-in-12-months presence test and the November 2024 amendments. Keep evidence of the customer’s residence and place of consumption on file.

Which gateway should a Dubai business use?

If you are on AWS, API Gateway in me-central-1 at AED 4.48 per million HTTP calls plus the AED 505 per month managed portal is the shortest path. On Azure, UAE North Standard v2 at about AED 2,570 per month plus AED 9.18 per million suits steady enterprise volume. Apigee is capable but has no UAE region, so latency and data residency both suffer. Kong self-hosted in-region is the choice when you need full control of the data plane.

Can I monetise an API that already has free users?

Yes, and it is the common case. Meter silently for one to two billing cycles first so you know real usage, then grandfather existing partners into a free tier at or slightly above their current volume and price only the growth. Publishing quotas before prices makes the conversation about fair use rather than a new invoice.