How do I integrate with Altinn 3?
By Antony Richard Grov, founder of Apier
Altinn 3 is a REST API, but you cannot call it with an API key alone. Every request needs a Maskinporten access token proving which organisation you are, and anything done on a customer's behalf additionally needs an Altinn System User delegation from that customer proving you are allowed to act for them. Apier brokers neither leg. What it offers sits beside that chain: who may sign for the company and what it must file by when, from Brønnøysund and the Rulebook, behind a single Authorization: Bearer header, with no Maskinporten token or delegation involved. The Altinn 3 call itself stays yours to build.
What is the easiest way to call Altinn 3 APIs?
Altinn 2 was decommissioned on 19 June 2026, so “Altinn 3” and “Altinn” now mean the same thing. There is no legacy route left to fall back to, and there is no shortcut around the authorisation model either: Altinn confirmed in May 2026 that serviceowner instance scopes are reserved for public agencies, so a commercial integrator works through the customer-delegated System User model or not at all.
That leaves one honest route into Altinn 3: build the credential chain yourself. A Maskinporten client, an enterprise certificate, signed terms of use, a System Register entry, and a delegation flow you walk every customer through. Apier does not shorten that chain. Since 2026-10-21 it brokers no Maskinporten token and no system user delegation, and the Altinn based endpoints it used to expose answer 410 CAPABILITY_WITHDRAWN.
What Apier does offer is the layer before and around the Altinn call: company context, obligations, deadlines and signing authority, from Brønnøysund and the Rulebook, with the source and date stated on every response. None of it needs Altinn access, which is why one Bearer key is enough. Filing validation and submission are not offered; the MVA line is parked until Digdir or Skatteetaten answer in writing whether a system vendor may offer it.
Do I still need Maskinporten and a virksomhetssertifikat?
It depends on who holds the credential, and the split is cleaner than it first looks. Maskinporten is Norway's machine-to-machine OAuth2 service: a client authenticates with a signed JWT assertion, and the key behind that assertion is anchored on an enterprise certificate (virksomhetssertifikat) issued to an entity registered in Brønnøysund. A direct integration means you obtain that certificate, upload the key, sign Digdir's terms of use, register your system in the Altinn System Register, and then rotate all of it on a schedule for as long as the integration lives.
For the Altinn 3 call, yes, all of it is yours: Apier does not hold a certificate or sign assertions on your behalf. For what Apier answers, none of it is needed, because Brønnøysund data is open and the Rulebook is Apier's own, so reading who may sign for a company takes one Bearer key and no Maskinporten client. The delegation stays what it always was: your customer granting your registered system the right to act for them is a decision only that customer can make, and no amount of infrastructure removes it. If you want the full mechanics of the OAuth2 exchange, the Maskinporten guide for developers covers the token flow and the pitfalls end to end.
How do I test an Altinn 3 integration without production access?
Use the zero-auth sandbox. Every company endpoint has a mirror under /api/v1/sandbox/public/ that answers the production response shape from synthetic Norwegian company fixtures, needs no API key, and is deterministic across calls — the same request returns the same body, so you can assert on it in a test suite. Failure paths are testable too: a ?simulate_error= parameter injects the missing-delegation, invalid-token, validation and missing-scope cases so your error handling is exercised before it meets a real one.
One property matters more than convenience here: the sandbox never calls a government system. A sandbox filing is a local state transition, not a submission held back — nothing reaches Altinn, Maskinporten or Skatteetaten from that surface. So the sandbox proves your client is correct and proves nothing about a real filing, which is exactly the guarantee that makes it safe to point an autonomous agent at. Start at the sandbox for a copy-paste request, or at the quickstart for the first-call walkthrough.
| Integration leg | Direct against Altinn 3 | What Apier answers instead |
|---|---|---|
| Authentication | Your own Maskinporten client, signed JWT assertions, and an enterprise certificate you obtain and renew. | Not needed. Apier reads open registers and its own Rulebook behind one Bearer key; no government token is held on your behalf. |
| Per-customer authority | A System Register entry plus a delegation from each customer, tracked and re-checked by you. | Not brokered. Apier answers who may sign for the company from Brønnøysund (signaturrett and prokura), so you know who can grant the delegation; the grant itself stays in Altinn. |
| Response shape | Each upstream register answers in its own schema; you normalise across Brønnøysund, Altinn and Skatteetaten. | One normalised schema across Brønnøysund and the Rulebook, with a _meta envelope carrying rule version and data freshness. |
| Failure handling | Upstream errors arrive in the upstream's own format; you map each one to something your caller can act on. | Structured error_code plus an explanation with fix steps, identical in shape across every endpoint. |
| Test environment | Access to test environments follows the same onboarding gates as production. | Zero-auth sandbox from the first minute, with deterministic fixtures and explicit failure injection. |
Make the first call
The sandbox request below needs nothing at all — no key, no certificate, no delegation. The TypeScript snippet is the production equivalent: same path shape, one header added.
# Zero-auth sandbox: no key, no certificate, no delegation needed.
curl -s https://www.apier.no/api/v1/sandbox/public/company/999999999/context// Production read. One header, no government token anywhere.
// Replace {org} with a real organisasjonsnummer; 999999999 exists only in the sandbox.
const res = await fetch(
"https://www.apier.no/api/v1/company/{org}/context",
{ headers: { Authorization: `Bearer ${process.env.APIER_API_KEY}` } },
);
if (!res.ok) {
const { error_code, explanation } = await res.json();
throw new Error(`${error_code}: ${explanation.summary}`);
}
const { data, _meta } = await res.json();
console.log(data.name, data.status, _meta.rulebook_version);Frequently asked questions
- Is Altinn 3 just a REST API I can call with an API key?
- No. Altinn 3 is a REST API, but it does not issue API keys. Each request carries a Maskinporten access token that identifies your organisation, and anything you do on a customer's behalf additionally requires that customer to have delegated access to your registered system. The HTTP call is the easy part; the credential chain behind it is the work.
- Do I need my own Maskinporten client to integrate with Altinn 3?
- Yes, if you call Altinn 3 at all. A direct integration means your own Maskinporten client, an enterprise certificate (virksomhetssertifikat) issued to a Brønnøysund-registered entity, signed Digdir terms of use, an Altinn System Register entry for your system, and a delegation from every customer. Apier brokers none of those: what it answers comes from open registers and its Rulebook, which need no Maskinporten token, so the chain only exists for the Altinn 3 call itself, which stays yours.
- Can I use Altinn's serviceowner APIs instead of System Users?
- No, and neither can any other private integrator. Altinn confirmed in May 2026 that serviceowner instance scopes are reserved for public agencies. Every commercial integration works through the customer-delegated System User model, where each customer explicitly grants rights to your registered system.
- Can I test an Altinn 3 integration before I have production access?
- Yes. Apier's public sandbox is zero-auth and answers the same response shapes as production from synthetic fixtures, so you can build and test the client before any certificate or delegation exists. The sandbox never calls a government system, which is also why a sandbox call proves your code path works and nothing about a real Altinn 3 call.
- Can Apier call Altinn 3 for me?
- No. Apier holds no system user for your customers, brokers no Maskinporten token and submits no filings; the Altinn based endpoints it used to expose were withdrawn on 2026-10-21 and answer 410 CAPABILITY_WITHDRAWN. What is live is the part that needs no Altinn access at all: company context, obligations, deadlines and signing authority from Brønnøysund and the Rulebook, behind one Bearer key, each answer with its source and date.