Check the delegation state for an organisation
Read-side of the Auth Gateway. Agents call this before attempting an action to discover whether the delegation required to act on behalf of a Norwegian organisation is in place. The response always uses HTTP 200 — the authorisation verdict lives in data.status (full/partial/none), and when the verdict is not full the response carries Compliance Explainer fix_steps (Norwegian text) guiding the consumer to completion. Only transport-level problems (bad org_number, missing API key, internal failure) produce non-200 responses. Organisations in the 999xxxxxx range are reserved for synthetic tests and always return a full mock state so sandbox clients can exercise success paths without a real delegation.
Request
- Base URL: https://www.apier.no
- URL: https://www.apier.no/api/v1/auth/permissions/{org}
- Auth: HTTP bearer
Path parameters
Norwegian organisation number. Exactly 9 digits, matching Brønnøysund Register Centre format. Any other shape returns 400 VALIDATION_FAILED before the delegation lookup runs.
Response
Permission state for the requested organisation. data.status carries the verdict; callers MUST branch on it rather than relying on HTTP status.
Example response
{
"data": {
"org_number": "999999999"
},
"_meta": {
"rulebook_version": "v1.0.0",
"source": "apier.no",
"data_source": "Brønnøysund Enhetsregisteret + Apier Universal Rulebook",
"schema_version": "1.0.0",
"legal_basis": "NLOD — public registry reuse",
"response_timestamp": "2026-04-24T12:00:00.000Z",
"response_hash": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"source_snapshot_id": "brreg-2026-04-24T02:00:00.000Z",
"cost_nok": 0.5,
"wallet_remaining_nok": 9.5,
"spend_cap_remaining_nok": 12.5
}
}Changes
No recorded changes to this operation across all 1 revision of this API.