Sandbox

Public sandbox execute (zero-auth, IP rate-limited, dry-run + live mock)

Unauthenticated. Per-IP rate limit 100 requests / hour. POST body capped at 32 KiB. Org 999999999 only. Two paths discriminated by ?dry_run=: dry-run returns a deterministic validation block that validates payload against the per-action schema and the sandbox magic values (an invalid payload answers 200 with validation.all_passed: false and data_format_valid failed); live runs the same approval-token gauntlet as the internal sandbox execute (presence → prefix → length → hex-only → re-derive → constant-time compare) and returns a deterministic receipt envelope. Idempotency-Key header is REQUIRED on every call (matches the internal /v1/sandbox/actions/execute + production write-side contract); a missing header returns 400 VALIDATION_FAILED with details.field='Idempotency-Key'. Sandbox is deterministic-by-construction so the key is validated for charset / length but NOT bound to a single-use cache. PROVENANCE EXEMPT. Unlike the internal sandbox execute, this surface does NOT emit the execution_guarantee + outcome reliability envelope at the top level — public sandbox is shape-discovery, not reliability drill. Unknown query parameters return 400 VALIDATION_FAILED (the only accepted keys are simulate_error and the parameters documented on this operation). A 200 carries X-RateLimit-Limit / -Remaining / -Reset for the per-IP clock-hour bucket; a 429 states the same 100-per-clock-hour limit, resetting at the top of the hour.

post/api/v1/sandbox/public/actions/execute

Request

  • Base URL: https://www.apier.no
  • URL: https://www.apier.no/api/v1/sandbox/public/actions/execute
  • Auth: none required

Query parameters

simulate_error'missing_delegation' | 'invalid_token' | 'validation_error' | 'scope_missing' | 'altinn_timeout' | 'invalid_certificate' | 'malformed_payload' | 'upstream_5xx' | 'AUTH_MISSING_DELEGATION' | 'AUTH_EXPIRED_TOKEN' | 'VALIDATION_FAILED' | 'SCOPE_MISSING'

Force the sandbox to return a structured error response. tokens (Apier-edge failures) — missing_delegation → 403 AUTH_MISSING_DELEGATION; invalid_token → 401 AUTH_EXPIRED_TOKEN; validation_error → 400 VALIDATION_FAILED; scope_missing → 403 SCOPE_MISSING. upstream-failure tokens — altinn_timeout → 504 EXECUTION_DEADLINE_EXCEEDED (Altinn 3 instances endpoint timed out, response body carries the Altinn RFC 7807 envelope); invalid_certificate → 502 MASKINPORTEN_AUTH_FAILED (Maskinporten OAuth2 error_object — invalid_client); malformed_payload → 422 GOVERNMENT_VALIDATION_REJECTED (Skatteetaten validation errors with nested path[] arrays); upstream_5xx → 502 GOVERNMENT_UNAVAILABLE (generic government 5xx). The 500 INTERNAL_ERROR path is reserved for unexpected internal failures. Accepts BOTH lowercase public tokens (primary contract) AND uppercase internal explainer codes (back-compat). Wins precedence over reserved-org defaults.

dry_run'true' | 'false'

Strict — empty / unknown values return 400.

Headers

Idempotency-Keystring required

REQUIRED on /api/v1/sandbox/public/actions/execute (matches the internal /v1/sandbox/actions/execute contract). Validated for charset (printable ASCII) + length (1-255) at the boundary — missing or malformed returns 400 VALIDATION_FAILED with details.field='Idempotency-Key'. Sandbox is deterministic-by-construction so the key is NOT bound against a single-use cache; SDK retry code paths that thread the key through both surfaces work identically.

X-Correlation-IDstring uuid

Optional request-scope UUID v4 that the client can set to thread its own trace across multiple requests. A valid UUID v4 is reused verbatim on the server; anything malformed or absent is replaced with a fresh crypto.randomUUID(). The canonical value is echoed back on the X-Correlation-ID response header AND persisted on every matching audit_log row — so a forensic query can reconstruct "every row from request X" without timestamp-based correlation. Accepted on every /api/v1/* operation via the proxy middleware; no per-operation opt-in required. The header is also emitted on every /api/v1/* response — see the X-Correlation-ID response-header component.

Request body

org_numberstring required
action'mva_melding' | 'a_melding' required
payloadobject required
approval_tokenstring

Boundary regex is permissive (1-255 printable ASCII); the live-mode gauntlet enforces the canonical sandbox-prefixed shape after.

Response

Success. Discriminated by data.dry_run boolean. Dry-run: { success: true, data: { dry_run: true, org_number, action, validation }, _meta }. Live: { success: true, data: { dry_run: false, receipt, _sandbox_marker }, _meta } — _sandbox_marker lives inside data (paired with the nested data.receipt.government_response_raw._sandbox_marker) so an agent serialising any subset of data still sees the marker. The internal /v1/sandbox/actions/execute route additionally exposes a top-level _sandbox_marker sibling; this public-sandbox variant intentionally narrows to the data-scoped marker since the response envelope is wrapper-stable across both branches.

OR

Changes

No recorded changes to this operation across all 1 revision of this API.