Check which of your agent principals hold fullmakt for an organisation
Read-side of the Fullmakt Rails, and the natural follow-up to POST /v1/fullmakt/request. Answers, for one customer organisation: which of YOUR OWN agent principals currently hold delegated authority, which scopes are live, which are missing relative to your tier's baseline, and what to do about it. Each entry is the join of an agent principal to the delegation brokered for its write-once system_user_id binding, so an agent can decide whether it may act before attempting an action.
The response always uses HTTP 200 on the happy path — the verdict lives in data.overall_status (full/partial/none). none is a VALID state, not an error: a consumer with no agent principals, or none holding a live delegation for this organisation, receives a 200 with an empty data.principals and data.fix_steps pointing at POST /v1/fullmakt/request. This endpoint NEVER returns 404 for 'no fullmakt yet'. Only transport-level problems (malformed org_number, missing API key, insufficient scope, internal failure) produce non-200 responses.
Data source and its limits: the verdict is computed from the delegation state Apier RECORDED locally when it brokered the fullmakt, joined to your agent principals. It is NOT a live Altinn PDP (Policy Decision Point) decision — no such call exists at v1 — so the local record and Altinn's live decision can diverge if a delegation is revoked upstream without Apier observing it. Verified against Apier's own delegation records as of data.last_checked; no legal guarantee is asserted.
Expiry semantics match the enforcement path exactly: a delegation is live iff valid_until is null or strictly in the future, so a delegation POST /v1/actions/execute would refuse is never reported here as authority.
Request
- Base URL: https://www.apier.no
- URL: https://www.apier.no/api/v1/fullmakt/{org}
- Auth: HTTP bearer
Path parameters
Norwegian organisation number of the CUSTOMER the fullmakt applies to. Exactly 9 digits, matching Brønnøysund Register Centre format. Any other shape returns 400 VALIDATION_FAILED before the fullmakt-state lookup runs. Authentication and the scope check run FIRST, so an unauthenticated or under-scoped request carrying a malformed org_number returns 401/403 rather than 400.
Response
Fullmakt state for the requested organisation. data.overall_status carries the verdict; callers MUST branch on it rather than on the HTTP status, which is 200 for full, partial AND none alike.
Example response
{
"data": {
"org_number": "999999999",
"principals": [
{
"agent_principal_id": "11111111-1111-4111-8111-111111111111",
"display_name": "Innkjøpsagent",
"system_user_id": "mock_su_11111111-1111-1111-1111-111111111111",
"active_scopes": [
"skatteetaten:mva"
],
"missing_scopes": []
}
],
"fix_steps": [
"POST /api/v1/fullmakt/request med org_number 999999999, ønskede scopes og en av dine agent-principaler: 11111111-1111-4111-8111-111111111111",
"Be signaturrett hos organisasjonen godkjenne delegeringen via delegation_url fra svaret"
],
"last_checked": "2026-07-17T08:00:00.000Z"
},
"_meta": {
"rulebook_version": "v1.0.0",
"source": "apier.no",
"data_source": "Brønnøysund Enhetsregisteret + Apier Universal Rulebook",
"schema_version": "1.0.0",
"legal_basis": "NLOD — public registry reuse",
"response_timestamp": "2026-04-24T12:00:00.000Z",
"response_hash": "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"source_snapshot_id": "brreg-2026-04-24T02:00:00.000Z",
"cost_nok": 0.5,
"wallet_remaining_nok": 9.5,
"spend_cap_remaining_nok": 12.5
}
}Changes
No recorded changes to this operation across all 1 revision of this API.