Sandbox mirror of /api/v1/company/{org}/deadlines (API key or sandbox bearer)

Accepted for production-shape parity. Production also uses type: string at the wire layer (accepts bare YYYY-MM-DD or full ISO 8601 timestamp). Sandbox does NOT enforce the date-format constraint at runtime and returns the static fixture data regardless. Agents wanting calendar-logic verification must use the production endpoint with a test consumer.

Schema mirrors production exactly (integer 1-60). The schema is the contract clients honour at codegen time; URLSearchParams serialises the integer back to a string on the wire, which both sandbox and production accept. Sandbox runtime validates the range (an integer from 1 to 60; any other value returns 400 VALIDATION_FAILED) but returns the static fixture regardless of the value — agents wanting calendar-logic verification must use the production endpoint with a test consumer.

Force the sandbox to return a structured error response. tokens (Apier-edge failures) — missing_delegation → 403 AUTH_MISSING_DELEGATION; invalid_token → 401 AUTH_EXPIRED_TOKEN; validation_error → 400 VALIDATION_FAILED; scope_missing → 403 SCOPE_MISSING. upstream-failure tokens — altinn_timeout → 504 EXECUTION_DEADLINE_EXCEEDED (Altinn 3 instances endpoint timed out, response body carries the Altinn RFC 7807 envelope); invalid_certificate → 502 MASKINPORTEN_AUTH_FAILED (Maskinporten OAuth2 error_object — invalid_client); malformed_payload → 422 GOVERNMENT_VALIDATION_REJECTED (Skatteetaten validation errors with nested path[] arrays); upstream_5xx → 502 GOVERNMENT_UNAVAILABLE (generic government 5xx). The 500 INTERNAL_ERROR path is reserved for unexpected internal failures. Accepts BOTH lowercase public tokens (primary contract) AND uppercase internal explainer codes (back-compat). Wins precedence over reserved-org defaults.

Rulebook time travel. Re-derives each deadline / obligation's TEMPORAL status against this Europe/Oslo reference date — a deadline already past as_of reads overdue, one still ahead reads upcoming, a filed item stays filed; the deadline DATES never move (deterministic fixtures). Honored ONLY on the sandbox /deadlines and /obligations routes AND only with the synthetic apier_sandbox_test_<suffix> bearer — a real key with as_of present returns 403 SANDBOX_TEST_KEY_REQUIRED. Strict YYYY-MM-DD; bounds [2020-01-01, today + 2 years] (Europe/Oslo today); invalid calendar dates or out-of-bounds -> 400 VALIDATION_FAILED with the bound stated (the same status as an invalid mock_date). The exact input is echoed on _meta.as_of. Distinct from ?mock_date=, which pins the sandbox now() across the resolver-backed authenticated sandbox routes plus the execute write path (the zero-auth /v1/sandbox/public/* mirror does not parse it) and also re-derives these same reads (wider bounds 2000..2100, malformed returns 400, no test-bearer requirement); when both are present, as_of wins.

Pin the sandbox's now() to a specific Europe/Oslo wall-clock date. Format strictly YYYY-MM-DD (10 chars) — RFC 3339 with time, ISO with offset, locale forms all 400. The date interprets as midnight Europe/Oslo (CET / +01:00 winter, CEST / +02:00 summer — DST-aware via date-fns-tz fromZonedTime, never hardcoded offsets). Honored on the write path (POST /actions/execute computes filed_late against the pinned date) AND on the authenticated /v1/sandbox/company/{org}/deadlines and /obligations reads, where each item's upcoming/overdue temporal status re-derives against the pinned date — the deadline DATES themselves never move (deterministic fixtures). The zero-auth /v1/sandbox/public/* mirror does not parse this knob. When ?as_of= is also present on those reads, as_of wins. Year range 2000..2100; invalid calendar dates (Feb 30, Apr 31) rejected explicitly.

Infrastructure-failure injection. Honored ONLY on the authenticated sandbox company READ routes AND only with the synthetic apier_sandbox_test_<suffix> bearer — a real ("live") key with this header present returns 403 SANDBOX_TEST_KEY_REQUIRED (explicit, never silent: a live key must never receive simulated data). error_500 -> 500, timeout -> 504 after a fixed capped delay, rate_limit -> 429 + Retry-After: 30. Every simulated response carries _meta.simulated: true, burns no real rate-limit quota, and fires no Sentry alert. Case-sensitive; any other value -> 422 VALIDATION_FAILED. Distinct from ?simulate_error= (domain / upstream error SHAPES) — this simulates transport / infrastructure faults so an agent can rehearse its own retry / backoff / timeout handling.