The airline was approved to fly the route four days a week but it did not include Sunday.
Indonesia's Ministry of Transport has announced a full investigation and suspended Indonesia AirAsia flights between the two cities. It will also check all other airlines operating in the country to make sure they were complying with license agreements.
Indonesia AirAsia CEO Sunu Widyatmoko was quoted on local television as saying the airline would cooperate fully with the investigation and would not be releasing any statement until the results were known. He has not returned calls from CNN.
AirAsia Indonesia is a subsidiary of the Malaysian-based AirAsia group. The parent company owns almost 49% of the Indonesian operation.
The investigation will focus on the operations of AirAsia Indonesia and state-owned airport operator Angkasa Pura 1, which manages Surabaya airport.
Transport Minister Ignatious Jonan described the airline's breach as a "serious violation."
"How could they fly? Who would they have to approach to be able to make that flight. It would have to be the airport management or lobby air traffic control."
He said the investigation is expected to take about a week.
"It's not complicated. There is a checklist of what should and should not have been done."
He said penalties ranged from AirAsia losing the right to fly the Surabaya-Singapore route through to grounding the entire operation, "depending on the evidence from the investigation."
Flight QZ8501 took off from Juanda International Airport in Surabaya a little after 5:30 a.m. last Sunday. Just after 6:12 a.m., one of the pilots radioed air traffic control requesting permission to climb from 32,000 to 38,000 feet and turn left to avoid bad weather. Permission was given to turn but not to increase altitude. That was the last communication with the plane. At 6:18 a.m. it disappeared from radar.
In an statement earlier, the transport ministry said the airline "has violated the agreement on route given."
"Indonesia AirAsia route Surabaya-Singapore was operated outside of the permitted license, namely among others on Sunday. And Indonesia AirAsia did not submit a request to alter operational day to the Directorate General of Air Transport. This is a violation against the agreement in the route provided," the statement said.
Aviation expert Geoff Thomas, an author on aviation issues and editor of airlineratings.com, which writes on airline safety worldwide, said it was "highly unusual" to fly without approval.
"If it was not authorized it could realize legal and insurance implications," he said. "In most jurisdictions, it is highly unusual. An airline will have to apply for a new flight."
Thomas added that in countries with an open-skies policy, airlines could add or subtract flights as they saw fit if there was the capacity at the airports, but Indonesia does not operate an open-skies policy.
AirAsia was founded by Tony Fernandes, currently the CEO, in 2001. It has had a spotless safety record until now.
Airline safety in Indonesia, one of Asia's fastest growing aviation markets, has improved in recent years. The last fatal accident involving a commercial jetliner was in 2007, according to the analysis group Flightglobal.
Jonan said he had been in touch with Fernandes via email and that the he had accepted the suspension of the airline.