Public sandbox mirror of /api/v1/company/{org}/filing-history (zero-auth, IP rate-limited)
Unauthenticated. Per-IP rate limit 100 requests / hour. Org 999999999 only. Serves the same synthetic fixture source + pure pairing as the authenticated sandbox mirror; audit_pairing.status is always complete and pagination.has_more always false (deterministic-fixture stub). PROVENANCE EXEMPT. Unknown query parameters return 400 VALIDATION_FAILED (the only accepted keys are simulate_error and the parameters documented on this operation). A 200 carries X-RateLimit-Limit / -Remaining / -Reset for the per-IP clock-hour bucket; a 429 states the same 100-per-clock-hour limit, resetting at the top of the hour.
Request
- Base URL: https://www.apier.no
- URL: https://www.apier.no/api/v1/sandbox/public/company/{org}/filing-history
- Auth: none required
Query parameters
Force the sandbox to return a structured error response. tokens (Apier-edge failures) — missing_delegation → 403 AUTH_MISSING_DELEGATION; invalid_token → 401 AUTH_EXPIRED_TOKEN; validation_error → 400 VALIDATION_FAILED; scope_missing → 403 SCOPE_MISSING. upstream-failure tokens — altinn_timeout → 504 EXECUTION_DEADLINE_EXCEEDED (Altinn 3 instances endpoint timed out, response body carries the Altinn RFC 7807 envelope); invalid_certificate → 502 MASKINPORTEN_AUTH_FAILED (Maskinporten OAuth2 error_object — invalid_client); malformed_payload → 422 GOVERNMENT_VALIDATION_REJECTED (Skatteetaten validation errors with nested path[] arrays); upstream_5xx → 502 GOVERNMENT_UNAVAILABLE (generic government 5xx). The 500 INTERNAL_ERROR path is reserved for unexpected internal failures. Accepts BOTH lowercase public tokens (primary contract) AND uppercase internal explainer codes (back-compat). Wins precedence over reserved-org defaults.
Accepted for parity; sandbox does NOT enforce.
Opaque HMAC-signed continuation token - the CANONICAL pagination idiom. Pass the previous response's pagination.next_cursor back verbatim; a tampered or cross-endpoint cursor is rejected with 400 CURSOR_INVALID. Cannot be combined with the legacy offset parameter.
Accepted for parity. DEPRECATED: use the opaque cursor parameter instead; this parameter keeps working through the deprecation window (Sunset: 2027-01-31T00:00:00Z) and responses to requests using it carry Deprecation/Sunset/Link headers.
Response
Public-sandbox 2xx success for GET /api/v1/sandbox/public/company/{org}/filing-history. Same body schema as the internal SandboxFilingHistorySuccess ({ success: true, data: FilingHistory, _meta: SandboxMeta }, the double-wrapped nesting of production filing-history). The example body is the public fixture (org 999999999, Apier Public Sandbox AS) as the public mirror serves it; the internal component's example uses the 999000001-005 pool, which this surface rejects with 400 PUBLIC_SANDBOX_ORG_NOT_PERMITTED. Two header differences from the internal mirror: Access-Control-Allow-Methods: GET, POST, OPTIONS (unified across the public-sandbox routes), and the added X-Robots-Tag: noindex + X-Apier-Sandbox: public detection markers. Access-Control-Allow-Credentials is INTENTIONALLY absent — the public sandbox is zero-auth.
Changes
No recorded changes to this operation across all 1 revision of this API.