Sandbox

Sandbox mirror of /api/v1/company/{org}/verify (API key or sandbox bearer)

Authenticated sandbox mirror of GET /api/v1/company/{org}/verify. Returns the same deterministic verification verdict (pass / fail / unknown; warn reserved) as the production endpoint, computed over in-code synthetic fixtures — same input yields the same response (excluding _meta.response_timestamp). Reserved test orgs, reserved error orgs, and ?simulate_error=<code> are documented on /api/v1/capabilities. CORS is open (Access-Control-Allow-Origin: *) so browser-based agents can fetch from any origin. Authentication accepts a real API key or a synthetic apier_sandbox_test_<suffix> bearer — no real Apier key is required to explore the sandbox. Synthetic data only. The ?certificate=true signed-certificate flag is production-only: this sandbox route declares no extra query keys, so certificate is rejected as an unknown query parameter (400 VALIDATION_FAILED) and no signature is ever issued over sandbox data.

get/api/v1/sandbox/company/{org}/verify

Request

  • Base URL: https://www.apier.no
  • URL: https://www.apier.no/api/v1/sandbox/company/{org}/verify
  • Auth: one of:
    • HTTP bearer
    • HTTP bearer

Query parameters

simulate_error'missing_delegation' | 'invalid_token' | 'validation_error' | 'scope_missing' | 'altinn_timeout' | 'invalid_certificate' | 'malformed_payload' | 'upstream_5xx' | 'AUTH_MISSING_DELEGATION' | 'AUTH_EXPIRED_TOKEN' | 'VALIDATION_FAILED' | 'SCOPE_MISSING'

Force the sandbox to return a structured error response. tokens (Apier-edge failures) — missing_delegation → 403 AUTH_MISSING_DELEGATION; invalid_token → 401 AUTH_EXPIRED_TOKEN; validation_error → 400 VALIDATION_FAILED; scope_missing → 403 SCOPE_MISSING. upstream-failure tokens — altinn_timeout → 504 EXECUTION_DEADLINE_EXCEEDED (Altinn 3 instances endpoint timed out, response body carries the Altinn RFC 7807 envelope); invalid_certificate → 502 MASKINPORTEN_AUTH_FAILED (Maskinporten OAuth2 error_object — invalid_client); malformed_payload → 422 GOVERNMENT_VALIDATION_REJECTED (Skatteetaten validation errors with nested path[] arrays); upstream_5xx → 502 GOVERNMENT_UNAVAILABLE (generic government 5xx). The 500 INTERNAL_ERROR path is reserved for unexpected internal failures. Accepts BOTH lowercase public tokens (primary contract) AND uppercase internal explainer codes (back-compat). Wins precedence over reserved-org defaults.

certificateboolean

When true, the sandbox returns the same result wrapped in a SANDBOX VerifyCertificate (is_sandbox: true), so an agent can rehearse offline JWS verification before it holds a real key; absent or false returns the bare result unchanged. The sandbox certificate has the production envelope but is signed with a dedicated Ed25519 sandbox key (JWS alg EdDSA, kid apier-sandbox-cert-1) whose public half is served at /.well-known/sandbox-jwks.json and named in jwks_uri. That key is public and untrusted by design: a sandbox certificate proves nothing about Apier, and the key is never in the production /.well-known/jwks.json, so a verifier that selects keys from the production set never accepts one. The certificate is issued at the fixed sandbox instant and is byte-identical across calls. Any value other than true/false, or a repeated flag, returns 400 VALIDATION_FAILED.

Headers

X-Apier-Simulate'error_500' | 'timeout' | 'rate_limit'

Infrastructure-failure injection. Honored ONLY on the authenticated sandbox company READ routes AND only with the synthetic apier_sandbox_test_<suffix> bearer — a real ("live") key with this header present returns 403 SANDBOX_TEST_KEY_REQUIRED (explicit, never silent: a live key must never receive simulated data). error_500 -> 500, timeout -> 504 after a fixed capped delay, rate_limit -> 429 + Retry-After: 30. Every simulated response carries _meta.simulated: true, burns no real rate-limit quota, and fires no Sentry alert. Case-sensitive; any other value -> 422 VALIDATION_FAILED. Distinct from ?simulate_error= (domain / upstream error SHAPES) — this simulates transport / infrastructure faults so an agent can rehearse its own retry / backoff / timeout handling.

Response

Sandbox 2xx success for GET /api/v1/sandbox/company/{org}/verify. Body shape is the typed SandboxVerifyEnvelope — { success: true, data: CompanyVerification, _meta: SandboxMeta }.

successtrue required

Example response

{
  "data": {
    "org_number": "999999999",
    "verification_status": "pass",
    "summary_en": "The company is actively registered in the Central Coordinating Register for Legal Entities (Enhetsregisteret) and has a registered signing authority (signaturrett), procuration (prokura) or owner (innehaver)."
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.