Sandbox

Public sandbox mirror of /api/v1/company/{org}/authority (zero-auth, IP rate-limited)

Unauthenticated. Per-IP rate limit 100 requests / hour on the dedicated 'public-sandbox' bucket. Org 999999999 only. Response shape is byte-equivalent to the internal /api/v1/sandbox/company/{org}/authority mirror (reuses the same SandboxAuthorityEnvelope schema). Two header differences from the internal surface: Access-Control-Allow-Methods: GET, POST, OPTIONS (unified across the public-sandbox routes); X-Robots-Tag: noindex and X-Apier-Sandbox: public are added so SDK clients can detect the surface without parsing the URL. PROVENANCE EXEMPT — no _meta.response_hash, no provenance_log row (sandbox carve-out). The ?certificate=true signed-certificate flag is production-only: the public mirror ignores it and returns the same deterministic body without a signature. Unknown query parameters return 400 VALIDATION_FAILED (the only accepted keys are simulate_error and the parameters documented on this operation). A 200 carries X-RateLimit-Limit / -Remaining / -Reset for the per-IP clock-hour bucket; a 429 states the same 100-per-clock-hour limit, resetting at the top of the hour.

get/api/v1/sandbox/public/company/{org}/authority

Request

Base URL: https://www.apier.no
URL: https://www.apier.no/api/v1/sandbox/public/company/{org}/authority
Auth: none required

Query parameters

Force the sandbox to return a structured error response. tokens (Apier-edge failures) — missing_delegation → 403 AUTH_MISSING_DELEGATION; invalid_token → 401 AUTH_EXPIRED_TOKEN; validation_error → 400 VALIDATION_FAILED; scope_missing → 403 SCOPE_MISSING. upstream-failure tokens — altinn_timeout → 504 EXECUTION_DEADLINE_EXCEEDED (Altinn 3 instances endpoint timed out, response body carries the Altinn RFC 7807 envelope); invalid_certificate → 502 MASKINPORTEN_AUTH_FAILED (Maskinporten OAuth2 error_object — invalid_client); malformed_payload → 422 GOVERNMENT_VALIDATION_REJECTED (Skatteetaten validation errors with nested path[] arrays); upstream_5xx → 502 GOVERNMENT_UNAVAILABLE (generic government 5xx). The 500 INTERNAL_ERROR path is reserved for unexpected internal failures. Accepts BOTH lowercase public tokens (primary contract) AND uppercase internal explainer codes (back-compat). Wins precedence over reserved-org defaults.

Response

Public-sandbox 2xx success for GET /api/v1/sandbox/public/company/{org}/authority. Same SandboxAuthorityEnvelope body schema as the internal SandboxAuthoritySuccess ({ success: true, data: CompanyAuthority, _meta: SandboxMeta }); the only contract difference is the public-surface header set. Two header differences from the internal mirror: Access-Control-Allow-Methods: GET, POST, OPTIONS (unified across the public-sandbox routes), and the added X-Robots-Tag: noindex + X-Apier-Sandbox: public detection markers. Access-Control-Allow-Credentials is INTENTIONALLY absent — the public sandbox is zero-auth.

successtrue required

Example response

{
  "data": {
    "org_number": "999999999",
    "classification": "sole",
    "coded_authority": {
      "signatur": {
        "state": "coded_verified",
        "record": {
          "clauses": [
            {
              "text": "Daglig leder alene",
              "codes": [
                "R0002"
              ],
              "mode": "sole"
            }
          ]
        },
        "verification": {
          "verified_at": "2026-09-20T10:00:00+00:00",
          "outcome": "covered"
        }
      },
      "prokura": {
        "state": "coded_verified",
        "record": {
          "clauses": [
            {
              "text": "Daglig leder alene",
              "codes": [
                "R0002"
              ],
              "mode": "sole"
            }
          ]
        },
        "verification": {
          "verified_at": "2026-09-20T10:00:00+00:00",
          "outcome": "covered"
        }
      }
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.