---
title: "Canonical sandbox test-data table (zero-auth)"
method: GET
path: "/api/v1/sandbox/fixtures"
tags: ["Sandbox"]
---

# Canonical sandbox test-data table (zero-auth)

`GET /api/v1/sandbox/fixtures`

## Request

- Base URL: `https://www.apier.no`
- URL: `https://www.apier.no/api/v1/sandbox/fixtures`
- Auth: none required

Machine-readable directory of every sandbox test fixture: the single source docs and agents link to instead of a hand-kept appendix. Enumerates the reserved write-side test orgs (999000001-005, the only orgs `/api/v1/sandbox/actions/execute` accepts as a successful filing), the Altinn acting-capacity scenario orgs, the MOD-11-valid realistic graph, the difficult-company personas (999770-series: realistic, internally-consistent companies for pre-production agent testing: bankruptcy in progress, voluntary liquidation, VAT deregistered, disputed signatur, degraded data, merger pair, NUF branch, dormant, and more, each with a `difficulty` descriptor and an `expected` verdict block), the single public-sandbox org, the four reserved error orgs (org → forced error code), all eight `?simulate_error=` tokens, the `?simulate_latency=` / `?mock_date=` query knobs, and the magic VAT values that force MVA-melding filing outcomes. The `execute` block also carries the write-loop contract agents otherwise discover by 400 round-trip: `execute.request_body` (the JSON field is `action`, not `action_type`; `approval_token` rides in the body), `execute.required_headers` (`Idempotency-Key` is mandatory; `Authorization` recommends the synthetic `apier_sandbox_test_<suffix>` bearer, noting that a real key also authenticates but is unnecessary because the sandbox never reaches a government upstream), and `execute.sandbox_clock` (`pinned_at`, `local_time`, `timezone: Europe/Oslo`, and a note, all derived from the single pinned sandbox instant that `?mock_date=` overrides on the write-side routes). Zero-auth (Category A discovery), per-IP rate-limited, deterministic except `_meta.response_timestamp`. Every value listed here reproduces its documented behaviour on the sandbox surface.

## Response `200`

The canonical sandbox fixtures table. `data` carries the directory; `_meta` is the standard sandbox metadata block (carries `is_sandbox: true` and `sandbox_notice`). Served `Cache-Control: no-store` like the whole sandbox surface: no ETag / `If-None-Match` → 304 / `max-age` cache tier here, because a conditional-GET 304 would replay a stale X-Correlation-ID + `_meta.response_timestamp` from a cached body and break the per-request trace contract — so 's ETag cache tier deliberately does not apply to the no-store sandbox surface. `Retry-After` is documented on the 429 below.

- object
  - `success` true, required
  - `data` object, required: Canonical fixtures directory. Top-level keys: `schema_version`, `description`, `base_url`, `reserved_test_orgs` (each org → entity_type / data_tier / obligation_ids), `acting_capacity_scenarios` (org → Altinn scenario, plus `endpoint_scope`: the only endpoints that resolve the org; every company read returns 404 for it), `realistic_orgs`, `magic_scenarios` (the 999660-series magic-state orgs — each org → name / state / label / description / entity_type / expected verdict block), `personas` (the 999770-series difficult-company personas — each org → name / entity_type / label / difficulty / description / expected verdict block), `public_sandbox_org`, `reserved_error_orgs` (org → forced error code), `simulate_error_tokens` (all 8), `query_knobs` (simulate_latency + mock_date), and `execute` (action_types, dry_run note, magic_vat_values).
  - `_meta` SandboxMeta, required: Sandbox `_meta` block. NOT a drop-in for production's `TrustMetadata`; clients must branch on `is_sandbox` before assuming any sandbox/production field equivalence. Differences from production: 1. `is_sandbox: true` — load-bearing detection signal; `body._meta.is_sandbox === true` is a single property assertion agents use to verify they're talking to the sandbox. Production omits this key entirely. 2. `rulebook_version` is the literal string `"sandbox"` — production carries the actual Rulebook version (e.g. `"v1.0.0"`). Sandbox responses are not Rulebook-evaluated. 3. `data_freshness` and `last_verified` are pinned constants (2026-01-01T00:00:00+01:00) — production reflects actual cache / fetch state. 4. `response_timestamp` is RFC 3339 with explicit Europe/Oslo offset (`+01:00` CET / `+02:00` CEST, DST-aware) — production's `response_timestamp` carries a UTC `Z` suffix. 5. `response_hash` and `source_snapshot_id` are OMITTED — sandbox writes ZERO provenance_log rows, so a hash without a matching forensic row would be misleading. Only `source` (`"apier.no"`) and `schema_version` semantics are shared with production.
    - `rulebook_version` 'sandbox', required: Always literal `sandbox` — sandbox responses are not Rulebook-evaluated.
    - `data_freshness` '2026-01-01T00:00:00+01:00', date-time, required: Pinned constant (2026-01-01T00:00:00+01:00) for determinism — same value on every call. Schema-locked via `enum` so spec-based drift checks catch any deviation.
    - `last_verified` '2026-01-01T00:00:00+01:00', date-time, required: Pinned constant — equal to data_freshness. Schema-locked via `enum` for the same drift-detection reason.
    - `source` 'apier.no', required: Response origin. Always `apier.no`. Preserves `_meta.source` parity with production `TrustMetadata.source` so clients can reuse `_meta` parsing across both surfaces. Provenance-specific fields (`response_hash`, `source_snapshot_id`) are omitted by design.
    - `schema_version` string, required: OpenAPI document version — mirrors the top-level `info.version` field. Distinct from `/api/v1/capabilities._meta.schema_version` and `/workflows.json.schema_version`, which version the capabilities-discovery and workflows-discovery surfaces respectively. Equality with `info.version` is enforced at CI time.
    - `is_sandbox` true, required: Load-bearing sandbox-detection signal. Always `true`.
    - `response_timestamp` string, date-time, required: RFC 3339 timestamp with explicit Europe/Oslo offset — runtime emits via `formatInTimeZone(now, 'Europe/Oslo', "yyyy-MM-dd'T'HH:mm:ssXXX")` so the offset is DST-aware (`+01:00` in CET / `+02:00` in CEST). The ONLY non-deterministic field permitted on sandbox responses (excluded from determinism comparisons).
    - `sandbox_notice` string, required: Human-readable mock-vs-government honesty signal (item 5). Constant prose: a passing sandbox run is an Apier internal mock (not Altinn TT02 / Skatteetaten test) and does not guarantee real government acceptance. `is_sandbox` is the machine-readable twin; this is the prose an agent or a human reading a logged response sees. Plain ASCII so it never trips the docs bokmål canary.
    - `cost_nok` 0: Always `0`. A sandbox call never debits anything — there is no ledger write and no government upstream. Same field name and rendering as production's `TrustMetadata.cost_nok`, so a client that reads the cost off `_meta` works unchanged against both surfaces. Emitted on every sandbox response. Declared optional in this schema only so the many older sandbox examples in this document stay valid; the runtime builder emits it on every response.
    - `wallet_remaining_nok` unknown
    - `as_of` string: Present ONLY when `?as_of=` Rulebook time travel is active on /deadlines or /obligations. Echoes the agent's exact YYYY-MM-DD input so a transcript is self-describing about which reference date the deadline / obligation statuses were derived against. Absent on every other sandbox response.
    - `simulated` true: Present + `true` ONLY on an `X-Apier-Simulate` injected failure response. The load-bearing signal that a 500 / 504 / 429 is a deliberately-simulated infrastructure failure, not a real one. Absent on every real sandbox response.
    - `session_merged` true: Present + `true` ONLY when this response merged per-suffix session state (mock filings recorded by a prior POST /api/v1/sandbox/actions/execute under the SAME sandbox-bearer suffix) over the static fixture, on the three opted-in reads (/audit, /obligations, /summary). The honesty marker distinguishing fixture state from session state. Absent on every fresh-suffix response, which stays byte-deterministic.
    - `session_merged_rows` integer: Count of response items the merged session state changed (obligation/deadline statuses overridden plus audit rows prepended). Present ONLY alongside `session_merged: true`, always >= 1.

## Other responses

- `429`: Sandbox 4xx / 5xx error. Body shape mirrors the production error envelope (`{ success: false, error_code, explanation, _meta }`); `explanation` is the Compliance Explainer's full Norwegian-bokmål `{ summary, why, fix_steps[], relevant_link, legal_basis, handover }`. The Cache-Control header is `no-store` so transient failures aren't pinned in the Edge cache.

---

[API](https://skmtc.dev/apier/apis/apier-no-api.md) · [All operations](https://skmtc.dev/apier/apis/apier-no-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apier/apis/apier-no-api/revisions/9ec19bc87311?raw)