Altinn

Resolve actor capacity for a person on behalf of an organisation

Given an 11-digit Norwegian fødselsnummer or D-nummer (fnr) and a 9-digit organisasjonsnummer (org_number), returns every Altinn role the actor currently holds for that organisation plus the derived action tokens those roles legally permit. The lookup hashes the raw fnr with HMAC-SHA-256(fnr, RECEIPT_HMAC_SECRET) at the boundary; the raw value NEVER lands in the response, the audit log, the cache row, or any persisted column — only the 64-hex fnr_hmac echoes back. Roles are normalised through (DAGL Daglig leder, LEDE Styreleder, MEDL Styremedlem, NESTL Nestleder, INNH Innehaver, REGN Regnskapsfører, REVI Revisor at v1 — every entry's role-code is verified against the Altinn role catalogue, and every per-action legal_reference carries a verified lovdata.no citation as of (2026-05-16) — DAGL/LEDE/MEDL/NESTL → aksjeloven, INNH → skatteforvaltningsloven, REGN → regnskapsførerloven, REVI → revisorloven; the derived_actions[*].verification_pending boolean stays on the contract for forward-compat with any future un-verified seed (post-2026-05-16 it is false for every production row)). The fail-closed behavior for unverified legal_reference placeholders IS wired (the resolver's failClosedOnUnverified branch) but currently unreachable: ALTINN_MODE=live throws Altinn live mode not yet wired so the live path never reaches the resolver at v1. When ships the live Altinn integration, the path activates: roles still appear in roles[] so the agent sees what Altinn reported, but no unverified derived_action propagates to live consumers. Results are cached in resolved_permissions with a hard 1-hour TTL ceiling enforced by a DB CHECK constraint; data.cached === true indicates a cache hit and the response was served without re-hitting Altinn. Required scope: read:altinn. The MCP tool list_acting_capacity proxies through this endpoint via the registry pattern — REST and MCP callers share one source of truth.

post/api/v1/altinn/list-acting-capacity

Request

  • Base URL: https://www.apier.no
  • URL: https://www.apier.no/api/v1/altinn/list-acting-capacity
  • Auth: HTTP bearer

Request body

fnrstring required

11-digit Norwegian fødselsnummer or D-nummer. HMAC-SHA-256 hashed at the boundary; never persisted in plaintext.

org_numberstring required

9-digit Norwegian organisasjonsnummer the actor wishes to represent.

Response

Actor capacity resolved. The response wraps the flat data shape under data (the standard /api/v1/* { success, data, _meta } shape; the MCP executor builds the agent envelope from this verbatim, so returning a pre-wrapped envelope here would double-wrap on the MCP path — see).

successtrue required

Example response

{
  "_meta": {
    "rulebook_version": "v1.0.0",
    "source": "apier.no",
    "data_source": "Brønnøysund Enhetsregisteret + Apier Universal Rulebook",
    "schema_version": "1.0.0",
    "legal_basis": "NLOD — public registry reuse",
    "response_timestamp": "2026-04-24T12:00:00.000Z",
    "response_hash": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "source_snapshot_id": "brreg-2026-04-24T02:00:00.000Z",
    "cost_nok": 0.5,
    "wallet_remaining_nok": 9.5,
    "spend_cap_remaining_nok": 12.5
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.