Auth Gateway

Mint a single-use approval token for a medium- or high-risk action

Call this endpoint AFTER a human operator in the consumer's UI explicitly confirms the action. The returned approval_token must be presented in the X-Approval-Token header on the subsequent write call and is immediately consumed there — tokens are single-use, bound to a specific (consumer, org_number, action_id) triple, and expire after 5 minutes (default). Low-risk read actions do NOT require an approval token; requesting one for a low-risk action returns 400 VALIDATION_FAILED so misconfigured clients find out immediately instead of silently accumulating unnecessary tokens. Plaintext token values are returned exactly once — the server stores only the SHA-256 hash. Downstream write endpoints that require approval return 403 with AUTH_APPROVAL_REQUIRED, AUTH_APPROVAL_INVALID, or AUTH_APPROVAL_MISMATCH (see the shared ApprovalForbidden response component). This operation is recorded in the append-only audit log (the plaintext token itself is NEVER written to audit — only the action_id and expires_at).

post/api/v1/auth/approval-token

Request

Base URL: https://www.apier.no
URL: https://www.apier.no/api/v1/auth/approval-token
Auth: HTTP bearer

Request body

org_numberstring required

Norwegian organisation number the action will be executed against. Exactly 9 digits.

Known action identifier. Only medium- and high-risk actions actually mint a token; low-risk values are accepted at the boundary so the server can return the explicit 'does not require an approval token' 400 explainer instead of a generic enum rejection — that path is documented below.

expires_in_secondsinteger

Override the 5-minute (300s) default token lifetime. Capped at 1 hour. Shorter windows are strongly preferred so a leaked token is only briefly useful.

Example request

{
  "org_number": "999999999",
  "action_id": "filing.submit",
  "expires_in_seconds": 300
}

Response

Token minted. The plaintext approval_token is returned exactly once — after this, only the SHA-256 hash exists server-side.

successtrue required

Example response

{
  "_meta": {
    "rulebook_version": "v1.0.0",
    "source": "apier.no",
    "data_source": "Brønnøysund Enhetsregisteret + Apier Universal Rulebook",
    "schema_version": "1.0.0",
    "legal_basis": "NLOD — public registry reuse",
    "response_timestamp": "2026-04-24T12:00:00.000Z",
    "response_hash": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "source_snapshot_id": "brreg-2026-04-24T02:00:00.000Z",
    "cost_nok": 0.5,
    "wallet_remaining_nok": 9.5,
    "spend_cap_remaining_nok": 12.5
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.