Chapter 3 — Onboarding Process

This chapter describes the end-to-end process for a new company to become an authorized USS in the BR-UTM ecosystem, from account creation to operating in production.

3.1 Overview

The onboarding process has two phases:

1. Development Phase — Create an account, obtain a development API Key, and integrate your software against the Sandbox environment.
2. Production Phase — Submit your software for homologation (validation) by DECEA, receive a production API Key with U1 permission, create UTM Zones, and begin operating.

Create Account → Get Dev API Key → Sandbox Integration → Homologation → Production API Key → UTM Zone → Operate

3.2 Step 1 — Create an Account (Contas DECEA)

All access to DECEA digital services starts with a personal account on the Contas DECEA platform.

1. Navigate to the Portal UTM: http://portal.sandbox.brutm.dcta.mil.br/
2. Select the option to create a new account via Contas DECEA.
3. Complete the registration with your personal and professional information.

Note: A single individual user account can be associated with multiple company accounts. The account is linked to the person, not the company.

3.3 Step 2 — Register Your Company

After your personal account is created:

1. Log in to the Portal UTM.
2. Navigate to the company registration section.
3. Register your company with the relevant information (CNPJ, razão social, etc.).

Your company account will be the entity that owns API Keys, UTM Zones, and validated software versions.

3.4 Step 3 — Obtain a Development API Key

With a registered company account, you can request an API Key for the development (Sandbox) environment directly through the Portal UTM.

• Navigate to the developer section of the Portal UTM.
• Request a new API Key for your company.
• The API Key will be created and available immediately in the Portal.

During the transition period (while Portal UTM is not yet fully deployed in production): Contact DECEA through the official support channels — Mattermost or the Central de Ajuda — to request a development API Key manually.

This API Key is used in all subsequent requests to the Auth Server to obtain JWT tokens.

3.5 Step 4 — Download DECEA's Public Key

All JWT tokens issued by DECEA's Auth Server are signed with an RS256 private key. Your USS must validate incoming tokens (from other USSs and from the DSS) using DECEA's public key.

The public key is available through the Portal UTM developer section. It is a standard RSA public key in PEM format.

Important: Your USS must validate every incoming request's JWT against this public key. See Chapter 4 — Authentication for validation details.

3.6 Step 5 — Integrate Against the Sandbox

With your development API Key and DECEA's public key, you can begin implementing and testing your USS software against the Sandbox environment.

All Sandbox services are accessible under *.sandbox.brutm.dcta.mil.br:

Your integration must implement all mandatory USS-side endpoints. The Interface UTM (http://interface.sandbox.brutm.dcta.mil.br/) can be used as a visual debugging aid — it shows active OIRs, Constraints, ISAs, and telemetry in a 3D view of Brazilian airspace.

Refer to the following chapters for detailed technical integration guidance:

• Chapter 4 — Authentication
• Chapter 5 — The full flight lifecycle
• Chapter 6 — APIs your USS must implement

3.7 Step 6 — Request Homologation

Once your software is ready and has been validated internally against the Sandbox, you request a homologation process with DECEA.

Homologation is a manual validation process conducted by DECEA, potentially assisted by internal automated testing tools. During this process, DECEA will exercise your USS's APIs through a set of defined test scenarios (see Chapter 8 — Homologation).

To be eligible for homologation, your USS must:

• Implement all mandatory USS-side endpoints as defined in the OpenAPI specifications.
• Expose the automated testing interfaces (flights.yaml, injection.yaml, versioning.yaml) on your server so DECEA's testing framework can call them.
• Satisfy all non-functional requirements (see Chapter 7).
• Be deployed and accessible from the internet (your system must have a publicly accessible base URL).

Contact DECEA through the official channel (Mattermost or the Central de Ajuda) to initiate the homologation request.

3.8 Step 7 — Receive a Production API Key (U1 Permission)

Upon successful homologation, DECEA grants your software a production API Key with the U1 permission level.

• The production API Key is tied to the specific version of the software that was validated. If you release a new major version, a new homologation may be required.
• The U1 permission is the first operational authorization level for Phase 1 of BR-UTM.
• The production API Key can also be used to create sub-keys for third-party companies that wish to purchase and use your USS software. As the validated software owner, you create these sub-keys and distribute them to your clients.

3.9 Step 8 — Create UTM Zone(s)

With a production API Key, your company can create UTM Zones in the Portal UTM. A UTM Zone is the geographic, altitudinal, and temporal authorization for your company to operate.

To create a UTM Zone:

1. Log in to the Portal UTM with your production account.
2. Navigate to the Create UTM Zone section.
3. Provide your API Key — this confirms your software is validated and authorized.
4. Define the UTM Zone:
   • Geographic polygon (vertices in lat/lng)
   • Altitude range (floor and ceiling in meters WGS84)
   • Time validity (optional — can be indefinite/permanent)
5. Submit for creation.

A company can own multiple UTM Zones (e.g., one per city, or one per use case). There is currently no limit on the size of a UTM Zone — it can cover a neighborhood, a city, or an entire region.

Remember: All OIRs (Operational Intent References) your USS creates must be strictly contained within one of your UTM Zones. Operations outside your UTM Zone boundaries are not permitted.

3.10 Step 9 — Begin Operating

Once your UTM Zone is active and your production API Key is in use, your USS can begin accepting flight plans from operators and creating OIRs in the production DSS.

The complete technical flow for each individual flight is described in Chapter 5 — The Flight Lifecycle.

3.11 Onboarding Summary

┌─────────────────────────────────────────────────────┐
│                 ONBOARDING SEQUENCE                 │
├─────────────────────────────────────────────────────┤
│  1. Create personal account (Contas DECEA)          │
│  2. Register your company in Portal UTM             │
│  3. Request Development API Key (Portal UTM)        │
│  4. Download DECEA's public key (Portal UTM)        │
│  5. Implement & test against Sandbox environment    │
│  6. Request Homologation from DECEA                 │
│  7. Pass homologation → receive Production API Key  │
│     with U1 permission                              │
│  8. Create UTM Zone(s) in Portal UTM                │
│  9. Begin operating in production                   │
└─────────────────────────────────────────────────────┘

3.12 Support Channels