Hopp til innhold
Apier

Denne siden finnes foreløpig bare på engelsk. Innholdet nedenfor vises derfor på engelsk.

For AI-agent builders

Let your AI agents act for Norwegian companies

Data APIs tell agents about Norwegian companies. Apier lets agents act for them, with delegated authority, an audit trail, and Norwegian legal grounding. Ship the integration in days instead of months.

Try Agent SandboxRead the docs

Why agents stall at the Norwegian border

Reading public registry data is easy. Acting on it (filing, verifying authority, submitting to a government endpoint) is where an autonomous agent runs into infrastructure it was never built to own.

  • Your agent can't reach Altinn directly

    Altinn 3 is a machine-to-machine surface gated by Maskinporten. Before a single request authenticates, an agent needs a virksomhetssertifikat, an RSA keypair, a Maskinporten client and an Altinn System Register entry.

  • Delegation is harder than authentication

    Every company your agent acts for must grant a system-user delegation scoped to the right access packages. Those delegations expire, get revoked, and have to be re-granted on the organisation's side. Your agent has to track that state, not assume it.

  • Compliance is a moving target

    What a company must file, who may sign for it, and when it's due are defined by Norwegian law that changes. Hard-coding a deadline calendar or a signing-authority rule means shipping a bug the day the rule changes.

  • Binding actions need an audit trail

    An autonomous agent that submits a filing needs a defensible record of what it did, under whose authority, against which rule version. Without that forensic chain, no compliance officer will let it act unsupervised.

One execution layer your agent can call

Apier sits between your agent and Norwegian government systems (Altinn, Brønnøysund, Maskinporten) and owns the parts that make acting safe: authentication, delegation, deterministic compliance, and an immutable audit trail. Your agent sends one API key; the rest is resolved in the execution layer.

  • Authentication, handled

    Apier owns the Maskinporten token exchange and the System Register plumbing. Your agent sends one Bearer API key.

  • Delegation, resolved

    Acting capacity (signaturrett, prokura, system-user scopes) resolved into a clear yes/no answer before any binding action is attempted.

  • Compliance, deterministic

    Obligations and deadlines derived from a versioned Rulebook, computed in Oslo time. Same input + same rule version = same answer, every time.

  • Audit, built in

    Every response carries trust _meta and lands an immutable provenance record, so what your agent did is reconstructable from a single correlation id.

How the call flows

Four steps. Each one is a discrete API call the agent can reason about: no hidden state, no magic resolution.

  1. Step 01

    Agent asks: can I act?

    The agent sends a company org_number and intent to Apier. A single call returns the effective delegation scope plus every obligation that applies, with versioned legal citations the agent can surface to its caller.

  2. Step 02

    Apier composes the real request

    Given an authorized intent, Apier translates it into the concrete Altinn / Skatteetaten / Brønnøysund call and returns a dry-run receipt describing exactly what will happen: who, what, when, on whose authority. Delegation writes already accept an Idempotency-Key; other write endpoints inherit the same contract as the idempotency middleware lands across the surface.

  3. Step 03Handover

    Human-agent handover

    When the action crosses a threshold (signing, thresholds above NOK limits, missing delegations), Apier issues an Approval Token and a Norwegian-language explanation of what the human must do, where, and why. The agent stops here until the token is used.

  4. Step 04

    Apier validates, audits, replays

    On approval, Apier composes and validates the request, logs the full exchange to an append-only audit trail, and returns a receipt. Today that runs in sandbox and dry-run: it validates without submitting to a live government system; live binding submission is gated, pending Maskinporten production validation and Altinn scope approval, and runs the same audited path. On endpoints that carry an Idempotency-Key, the same key always returns the same receipt, never a duplicate submission.

Skip the boilerplate

Your agent calls one tool. We handle Maskinporten, Altinn, token refresh, scope resolution, and error mapping.

The Direct Way

Direct Maskinporten + Altinn integration

// Just to make ONE authenticated Norwegian gov API call:
// Maskinporten JWT, token exchange, Altinn fetch, error
// handling. Obligation logic needs several of these, plus
// your own rule engine to interpret the results.
import jwt from "jsonwebtoken";

// 1. Sign a client-assertion JWT (RS256) with your key.
const assertion = jwt.sign(claims, "<your-private-key>", {
  algorithm: "RS256",
});

// 2. Exchange it for a Maskinporten access token.
const tokenRes = await fetch(MASKINPORTEN_TOKEN_ENDPOINT, {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body: new URLSearchParams({
    grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
    assertion,
  }),
});
if (!tokenRes.ok) {
  // ...retry, token refresh, scope-mismatch mapping
}
const { access_token } = await tokenRes.json();

// 3. Call Altinn, then normalise the response yourself.
const altinnRes = await fetch(ALTINN_AUTHORIZATION_URL, {
  headers: { Authorization: "Bearer " + access_token },
});
// ...parse roles, map scopes, handle 401/403/429, refresh.

The Apier MCP Way

One tool call via @apier-no/mcp

// One tool call. Apier handles Maskinporten, Altinn,
// token refresh, scope resolution, and error mapping,
// then returns the structured obligation set.
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "get_company_obligations",
    "arguments": { "org_number": "999999999" }
  },
  "id": 1
}

Try it with your agent

The sandbox is keyless and returns production-shaped responses from synthetic data, with no signup, no government credentials and no binding writes. Wire an agent against it in minutes, then swap in a live key when you're ready.

Try Agent SandboxAltinn for AI agents

Related pages