Skip to content
Apier

Foreign access

A foreign company can use Norwegian government APIs — how far depends on the order of operations.

Reading Norwegian registry data is open to anyone. Acting through Maskinporten and Altinn 3 requires a Norwegian organisation number, an enterprise certificate, and signed terms with Digdir — a sequence a non-Norwegian company can complete.

The 30-second answer: three tiers of access

  • Open data — no gate. Brønnøysund's Enhetsregisteret data is published under the NLOD open-data licence, keyless and free. A company in Berlin or Boston can verify a Norwegian counterparty today with a single HTTP request and no Norwegian presence of any kind.
  • Authenticated machine access — a Norwegian anchor in practice. Maskinporten, the machine-to-machine OAuth2 layer, binds its standard onboarding to an enterprise certificate that only a Norwegian-registered entity can obtain. A documented European eSeals route exists, but it is scope-gated and off by default — the Maskinporten page walks the distinction.
  • Delegated action — a Norwegian anchor plus your customer's consent. Filing or acting on behalf of a Norwegian company runs through Altinn 3's System User model: your organisation is registered as a system vendor, and each customer explicitly delegates rights to it. The Altinn page covers where a foreign entity stalls without the anchor.

The dependency chain, in order

Every step below depends on the one before it. This is the sequence to plan against — start the long-lead items first.

  1. Norwegian organisation number. The anchor everything else references. A foreign business gets one by registering a NUF with Brønnøysund — covered in the Altinn page's NUF section.
  2. Virksomhetssertifikat. The enterprise certificate from Buypass or Commfides, issued against that organisation number. Eligibility for foreign entities is its own page — it is the step most foreign teams underestimate.
  3. Samarbeidsportalen and bruksvilkår. Digdir's terms of use, signed on behalf of the registered organisation, unlock the self-service portal where Maskinporten clients live.
  4. Maskinporten client and scopes. The client is bound to your certificate; each API scope is a separate application to the API owner. Mechanics live in the Maskinporten Developer Guide.
  5. Altinn System Register entry. Your organisation registers as a system vendor so customers can delegate to it — the three-leg model in the Altinn System Users guide.
  6. Per-customer delegation. Each Norwegian customer adds your System User and grants it specific rights in Altinn. Until then, your authenticated client can log in but not act for them.

The timeline reality

Two lessons from walking this sequence ourselves in 2026, worth pricing into any plan. First, certificate issuance is a verification process measured in weeks, not an online checkout. Second, a scope grant can exist on paper before it works in practice: we have seen scopes formally granted by Digdir that did not appear in the client configuration picker until a servicedesk follow-up resolved the gap. Budget for at least one such round-trip per approval, and sequence your applications early rather than just-in-time.

The cluster: one page per gate

Connecting an EU application end to end

At summary level, an EU-based application reaches Norwegian government infrastructure in three moves: it reads open registry data immediately (no gate); it establishes a Norwegian organisation number and certificate to authenticate as itself; and it registers as an Altinn system vendor so Norwegian customers can delegate authority to it. The mechanical walkthrough of the middle move — keys, JWTs, token exchange — is the Maskinporten Developer Guide; the delegation model is the Altinn System Users guide; and the pre-launch gates are the going-live guide. An alternative to walking the sequence yourself is an infrastructure layer that has already walked it — that is the role Apier plays — but the sequence above is what exists either way.

FAQ

Can a foreign company read Norwegian company data without any registration?
Yes. Brønnøysund's Tier 1 open data (Enhetsregisteret) is published under the NLOD open-data licence with no authentication and no Norwegian presence required. Anyone, anywhere, can query it today — this is the one layer with no jurisdictional gate at all.
Does a foreign company need a Norwegian subsidiary to use Maskinporten and Altinn?
It needs a Norwegian organisation number, which is not the same thing. Brønnøysund's own guidance is that a foreign business needing a Norwegian organisation number registers a NUF (Norwegian-registered foreign business) — a registration of the existing foreign company, not a new company. Which structure fits your situation is a question for your own advisers, not this page.
How long does the full sequence take?
Budget weeks, not days. Certificate issuance alone often takes one to two weeks, and scope approvals are separate applications with their own review cycles — including the possibility that a granted scope needs a servicedesk round-trip before it is actually usable. The dependency chain on this page exists so you can start the long-lead steps first.
Where do the mechanical how-to steps live?
Not here. The Maskinporten Developer Guide walks the full OAuth2 setup with working code, and the docs guides cover Altinn 3 System Users and going live. This cluster owns the jurisdictional layer only: what a non-Norwegian company can access, and in which order the prerequisites fall.

Related reading