Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Apier

REMOTE · WWW.APIER.NO · SCANNED SEP 20

Compliance infrastructure API connecting AI agents to Norwegian government systems (Altinn, BRREG).

Available components

remote · www.apier.no 95
0 this week 95 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security97
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
  • HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
  • The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
  • DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
  • The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
Schema Quality & AI Usability78
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 8372 tokens (~322/item across 26 items; 25 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Apier MCP server?

Apier is a hosted endpoint at https://www.apier.no/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · www.apier.no

# add to Claude Code
claude mcp add --transport http no-apier-mcp 'https://www.apier.no/api/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "no-apier-mcp": {
      "url": "https://www.apier.no/api/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "no-apier-mcp": {
      "type": "http",
      "url": "https://www.apier.no/api/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.no-apier-mcp]
url = "https://www.apier.no/api/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "no-apier-mcp": {
      "type": "remote",
      "url": "https://www.apier.no/api/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add no-apier-mcp --url 'https://www.apier.no/api/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  no-apier-mcp:
    url: "https://www.apier.no/api/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "no-apier-mcp": {
      "Transport": "http",
      "Url": "https://www.apier.no/api/mcp"
    }
  }
}
# add to Vellum
assistant mcp add no-apier-mcp -t streamable-http -u 'https://www.apier.no/api/mcp'
// mcp.json
{
  "mcpServers": {
    "no-apier-mcp": {
      "type": "http",
      "url": "https://www.apier.no/api/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 27 Aug 26 0
    • Tool “search_companies” rewrote its description, which is the text the model reads security
    • Tool “validate_action” rewrote its description, which is the text the model reads security
    • Tool “check_authorization” rewrote its description, which is the text the model reads security
    • Tool “check_fullmakt” rewrote its description, which is the text the model reads security
    • Tool “explain_compliance_error” rewrote its description, which is the text the model reads security
    • Tool “get_company_authority” rewrote its description, which is the text the model reads security
    • Tool “get_company_context” rewrote its description, which is the text the model reads security
    • Tool “get_company_deadlines” rewrote its description, which is the text the model reads security
    • Tool “get_company_filing_history” rewrote its description, which is the text the model reads security
    • Tool “get_company_obligations” rewrote its description, which is the text the model reads security
    • Tool “get_company_profile” rewrote its description, which is the text the model reads security
    • Tool “get_company_summary” rewrote its description, which is the text the model reads security
    • Tool “get_company_verification” rewrote its description, which is the text the model reads security
    • Tool “list_acting_capacity” rewrote its description, which is the text the model reads security
    • Tool “list_changes” rewrote its description, which is the text the model reads security
    • Tool “request_fullmakt” rewrote its description, which is the text the model reads security
    • Tool “revoke_fullmakt” rewrote its description, which is the text the model reads security
    • “explain_compliance_error” added an optional parameter “context_field” cosmetic
    • “explain_compliance_error” added an optional parameter “context_org_number” cosmetic
    • “explain_compliance_error” added an optional parameter “context_role” cosmetic
    • “explain_compliance_error” added an optional parameter “context_scope” cosmetic
    • “explain_compliance_error” added an optional parameter “context_upstream_system” cosmetic
    • “get_company_filing_history” added an optional parameter “cursor” cosmetic
    • “get_company_filing_history” reworded the description of “offset” cosmetic
    • “explain_compliance_error” dropped the optional parameter “context” cosmetic
  • 26 Aug 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 +2
    • Authorization: fail → pass ▲ security
    • First check of Authorization: partial security
    • Stability: 0.97 → pass security
  • 24 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Aug 26 0
    • Tool “explain_compliance_error” rewrote its description, which is the text the model reads security
    • “explain_compliance_error” reworded the description of “error_code” cosmetic
  • 13 Aug 26 0
    • Tool “check_authorization” rewrote its description, which is the text the model reads security
    • Tool “check_fullmakt” rewrote its description, which is the text the model reads security
    • Tool “explain_compliance_error” rewrote its description, which is the text the model reads security
    • Tool “get_altinn_migration_guidance” rewrote its description, which is the text the model reads security
    • Tool “get_company_accounts” rewrote its description, which is the text the model reads security
    • Tool “get_company_authority” rewrote its description, which is the text the model reads security
    • Tool “get_company_context” rewrote its description, which is the text the model reads security
    • Tool “get_company_deadlines” rewrote its description, which is the text the model reads security
    • Tool “get_company_filing_history” rewrote its description, which is the text the model reads security
    • Tool “get_company_obligations” rewrote its description, which is the text the model reads security
    • Tool “get_company_profile” rewrote its description, which is the text the model reads security
    • Tool “get_company_summary” rewrote its description, which is the text the model reads security
    • Tool “get_company_verification” rewrote its description, which is the text the model reads security
    • Tool “get_credit_balance” rewrote its description, which is the text the model reads security
    • Tool “get_exchange_rate” rewrote its description, which is the text the model reads security
    • Tool “get_pricing” rewrote its description, which is the text the model reads security
    • Tool “get_public_deadlines” rewrote its description, which is the text the model reads security
    • Tool “get_public_obligations” rewrote its description, which is the text the model reads security
    • Tool “list_acting_capacity” rewrote its description, which is the text the model reads security
    • Tool “list_changes” rewrote its description, which is the text the model reads security
    • Tool “redeem_issuance_token” rewrote its description, which is the text the model reads security
    • Tool “request_fullmakt” rewrote its description, which is the text the model reads security
    • Tool “revoke_fullmakt” rewrote its description, which is the text the model reads security
    • Tool “search_companies” rewrote its description, which is the text the model reads security
    • Tool “validate_action” rewrote its description, which is the text the model reads security
    • Schema quality: 627 → 328 ▲ functional
    • “explain_compliance_error” reworded the description of “context” cosmetic
    • “get_company_accounts” reworded the description of “org_number” cosmetic
    • “get_company_authority” reworded the description of “org_number” cosmetic
    • “get_company_context” reworded the description of “org_number” cosmetic
    • “get_company_deadlines” reworded the description of “org_number” cosmetic
    • “get_company_filing_history” reworded the description of “limit” cosmetic
    • “get_company_filing_history” reworded the description of “offset” cosmetic
    • “get_company_filing_history” reworded the description of “org_number” cosmetic
    • “get_company_obligations” reworded the description of “org_number” cosmetic
    • “get_company_summary” reworded the description of “org_number” cosmetic
    • “get_company_verification” reworded the description of “org_number” cosmetic
    • “get_exchange_rate” reworded the description of “date” cosmetic
    • “list_changes” reworded the description of “cursor” cosmetic
    • “list_changes” reworded the description of “from” cosmetic
    • “list_changes” reworded the description of “limit” cosmetic
    • “list_changes” reworded the description of “to” cosmetic
    • “request_fullmakt” reworded the description of “agent_principal_id” cosmetic
    • “request_fullmakt” reworded the description of “scopes” cosmetic
    • “revoke_fullmakt” reworded the description of “agent_principal_id” cosmetic
    • “revoke_fullmakt” reworded the description of “reason” cosmetic
  • 11 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 9 Aug 26 0
    • Server version: 2026.8.0 → 2026.8.1 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Probed https://www.apier.no/api/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=www.apier.no CN=YR1,O=Let's Encrypt,C=US 15 Aug 2026 13 Nov 2026 RSA 2048 SHA256-RSA 5fe54db905b3718606f7ae1a6bcbcb5ed74
SANs: www.apier.no
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC secure

Validation of www.apier.no. — Secure

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
no. present 38032 13 Verified
apier.no. present 63233, 63233 15, 15 Verified
www.apier.no. Verified address RRset verified with the apex keys
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer realm="apier-mcp", error="invalid_token", error_description="A valid Apier API key or an OAuth 2.1 access token for this resource is required", resource_metadata="https://www.apier.no/.well-known/oauth-protected-resource/api/mcp" 

Bearer realm="apier-mcp", error="invalid_token", error_description="A valid Apier API key or an OAuth 2.1 access token for this resource is required", resource_metadata="https://www.apier.no/.well-known/oauth-protected-resource/api/mcp"
Header Value
strict-transport-security max-age=63072000; includeSubDomains; preload
content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline' https://plausible.io https://js.stripe.com https://news.google.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https://plausible.io https://*.sentry.io https://*.ingest.sentry.io https://api.stripe.com https://*.supabase.co wss://*.supabase.co https://news.google.com; frame-src https://js.stripe.com https://news.google.com; frame-ancestors 'none'; worker-src 'self' blob:; manifest-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin
permissions-policy camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=(), bluetooth=(), serial=(), hid=(), midi=(), interest-cohort=(), browsing-topics=()

Protected resource metadata

Document https://www.apier.no/.well-known/oauth-protected-resource/api/mcp
Retrieved Yes
Resource https://www.apier.no/api/mcp
Authorisation server https://ietncbksyajattlahlzs.supabase.co/auth/v1

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://www.apier.no/api/mcp Verified 200
http (plaintext) http://www.apier.no/api/mcp HTTPS enforced 308 https://www.apier.no/api/mcp
MCP tools · 25 exposed · ~8,328 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
check_authorization ~274

Return the authorisation snapshot for the calling consumer's delegation on a Norwegian organisation: the `status` enum (`full` / `partial` / `none`), `missing_scopes` (empty on `full`), `granted_scopes`, and the `delegation_chain` breadcrumbs. To check whether a SPECIFIC action is permitted, compare `granted_scopes` to the scopes it requires. Always runs against the calling consumer — no per-action or per-actor input at v1. Always a 200: with no delegation the verdict is `status: "none"`, never a 404. Input: { org_number } (9 digits, MOD-11). Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. For a SPECIFIC person's actions, use list_acting_capacity instead. Before a live execute, use validate_action to preflight the same delegation rule at zero upstream cost. For the per-agent-principal breakdown, use check_fullmakt; for statutory signing authority, use get_company_authority. No sandbox mirror. Docs: https://www.apier.no/docs/fullmakt

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer (passing MOD-11) the calling consumer's delegation is checked against.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe authorisation snapshot for the calling consumer's delegation on the organisation: status enum, missing_scopes, granted_scopes, and the delegation_chain breadcrumbs.

No examples provided.

check_fullmakt ~286

Check your fullmakt state for a Norwegian company BEFORE acting on its behalf — the read leg of the Fullmakt Rails. Per agent principal of yours holding a live delegation there it returns: the bound system_user_id, whether the delegation is `active` or still `pending` signaturrett approval, the scopes carried, and the scopes still missing. `overall_status`: `full` (act now), `partial` (`fix_steps` names the blocker), or `none` — a VALID answer, not an error: 200 with empty `principals[]`, never a 404. Reports the delegation state Apier RECORDED, not a live Altinn PDP decision. Input: { org_number } (plain 9 digits). Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. To BROKER a fullmakt use request_fullmakt; to withdraw one use revoke_fullmakt; the CONSUMER-level snapshot is check_authorization. No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/fullmakt

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer of the customer company to check your fullmakt state for. Plain 9 digits (no MOD-11 check), matching the route contract.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe fullmakt state: `overall_status` (full/partial/none), `principals[]` (system_user_id, statuses, active/missing scopes, valid_until), Norwegian `fix_steps`, `last_checked`. LOCAL recorded state, n…

No examples provided.

explain_compliance_error ~378

Resolve a structured Apier compliance error code into a Norwegian-bokmål Explanation envelope: summary, bokmål why, ordered fix_steps, optional documentation link + legal_basis, and an optional handover block (who / where / what / why) for errors a human must resolve (e.g. AUTH_INSUFFICIENT_ROLE, AUTH_NO_DELEGATION, SCOPE_MISSING) — agent-resolvable errors ship `handover: null`. Accepts any code from the closed EXPLAINER_ERROR_CODES catalogue — pass whatever code an Apier endpoint returned in an error envelope. Optional flat context_org_number / context_scope / context_role / context_field / context_upstream_system strings carry placeholder values interpolated into the bokmål text; missing values fall back to 'ukjent <noun>'. Failure modes: VALIDATION_FAILED on an unknown code; SCOPE_INSUFFICIENT (needs read:rulebook). For a company's live obligations rather than an error explanation, use get_company_obligations instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Docs: https://www.apier.no/docs/guides/error-handling

NameTypeReqDescription
context_fieldstring–Field name interpolated into the explanation.
context_org_numberstring–Organisation the error relates to (9 digits).
context_rolestring–Role code interpolated into the explanation.
context_scopestring–Scope token interpolated into the bokmål explanation.
context_upstream_systemstring–Upstream system name interpolated into the explanation.
error_codestringyesAn Apier error code from an error envelope. Full list: apier://tools/explain_compliance_error/guide
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe Explainer envelope: summary, bokmål why, ordered fix_steps, optional documentation link + legal_basis, and an optional human handover block.

No examples provided.

get_altinn_migration_guidance ~306

Discover the Altinn 3 equivalent of an Altinn 2 service or role code. The 19 June 2026 Altinn 2 deprecation deadline has passed, so this serves remediation for any integration still on Altinn 2. Pass { altinn2_code } (alphanumeric, 1–10 chars, e.g. A0208) for a single mapping, or omit it for the entire migration map. Every response carries the deprecation status computed in Europe/Oslo (deprecation_deadline, days_remaining — floored at 0, deadline_passed — now true). Each entry ships a `verified` flag: gate any production migration action on `verified === true`; unverified entries are hints, not instructions. Deterministic static map (DigDir-sourced) — no government system is contacted at call time. Failure modes: NOT_FOUND when a supplied code is not in the map (omit it to list every entry), VALIDATION_FAILED (INVALID_CODE), SCOPE_INSUFFICIENT (needs read:digdir). No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/guides/altinn-system-users

NameTypeReqDescription
altinn2_codestring–An Altinn 2 service or role code to resolve (alphanumeric, 1–10 chars, e.g. A0208). Omit to get the entire migration map.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe migration lookup: `deprecation_deadline` (Oslo), `days_remaining`, `deadline_passed`, and either one `entry` or the full `mappings[]`. Gate production migration actions on `verified === true`.

No examples provided.

get_company_accounts ~345

Current-snapshot read of a Norwegian company's annual accounts (årsregnskap) from the OPEN Regnskapsregisteret tier: `has_filed_annual_accounts` (tri-state — null means unknown, never a fabricated false), `last_accounts_year`, and that year's minimal `key_figures` (currency, presentation basis, totals). `currency` is always surfaced so figures are never silently read as NOK. Current-snapshot only — no multi-year history. A well-formed but unknown org_number returns 200 with `null`, not a 404. Input: { org_number } (9 digits, MOD-11). Failure modes: SCOPE_INSUFFICIENT (needs read:brreg), VALIDATION_FAILED. For the filing status as one input to a go/no-go verdict, use get_company_verification; for the registry identity, use get_company_context. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norwegian-company-annual-accounts

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund ID); MOD-11-checked up-front — a failing value is rejected as VALIDATION_FAILED, so correct the number rather than retrying it.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe /accounts snapshot: `has_filed_annual_accounts` (tri-state), `last_accounts_year`, and that year's minimal `key_figures` (currency always surfaced, presentation basis, totals). Current-snapshot o…

No examples provided.

get_company_authority ~360

Answer "who can legally sign for this Norwegian company, and how?" before acting on its behalf. Given a 9-digit organisasjonsnummer it returns a deterministic signing-authority classification — `sole`, `joint`, `by_role`, `prokura_only`, `no_authority`, or `unknown` — from the open Fullmakttjenesten signing combinations plus the signaturrett / prokura role-holders. `kombinasjon_available: false` flags a degraded answer. No legal citation is asserted. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_UNAVAILABLE, VALIDATION_FAILED. For a fast go/no-go verdict, use get_company_verification instead. This answers STATUTORY authority — no actor input, no Altinn delegations. For a SPECIFIC person's actions, use list_acting_capacity; for the consumer's own delegation, use check_authorization. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/signature-rights-norwegian-company

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund ID); MOD-11-checked up-front — a failing value is rejected as VALIDATION_FAILED, so correct the number rather than retrying it.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe /authority answer: a deterministic `classification`, `combinations[]`, the `signaturrett_holders` / `prokura_holders` lists, and `kombinasjon_available`. No legal citation is asserted.

No examples provided.

get_company_context ~326

Retrieve the structured Brønnøysund identity slice for a Norwegian organisation by its 9-digit organisasjonsnummer: legal name, organisasjonsform (AS / ENK / NUF / ASA …), NACE codes, addresses, incorporation/dissolution dates, and the signaturrett / prokura role-code summary (never personal identifiers). Cache window 24 h. Choose this for the identity slice ONLY, without the compliance verdict; pair with get_company_obligations or get_company_deadlines for the regulatory layer. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_TIMEOUT, VALIDATION_FAILED. For a compliance verdict, use get_company_summary instead; for the plain registry profile with NACE descriptions, use get_company_profile instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/company-snapshot

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund ID); MOD-11-checked up-front — a failing value is rejected as VALIDATION_FAILED, so correct the number rather than retrying it.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe Brønnøysund identity slice: legal name, organisasjonsform, NACE codes, addresses, incorporation/dissolution dates, and signaturrett/prokura role codes (never personal identifiers).

No examples provided.

get_company_deadlines ~383

Compute the upcoming Norwegian regulatory filing calendar for a specific organisation, looking horizon_months ahead. One entry per (obligation, period) pair: a stable obligation_id matching get_company_obligations, the due_date as ISO 8601 in Europe/Oslo (DST-aware), the legal_reference, and recurrence/adjustment flags. Choose this for the calendar view — when does the next MVA / A-melding / Årsregnskap filing land? Inputs: { org_number (9 digits, MOD-11), horizon_months? (1–60) }. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), VALIDATION_FAILED. For the per-obligation compliance verdict, use get_company_obligations instead; for the entity-type-level calendar that needs no organisasjonsnummer (and no API key), use get_public_deadlines instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norway-corporate-tax-return-deadline

NameTypeReqDescription
horizon_monthsinteger–Look-ahead window in months (1–60). Omitted → the endpoint's default horizon (12).
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund ID); MOD-11-checked up-front — a failing value is rejected as VALIDATION_FAILED, so correct the number rather than retrying it.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe upcoming filing calendar: due_date (Europe/Oslo), legal_reference, recurring + business_day_adjusted per obligation×period.

No examples provided.

get_company_filing_history ~427

Reconcile a Norwegian company's Altinn 3 filing history against the filings YOUR consumer submitted through Apier. Given a 9-digit organisasjonsnummer it returns the org's Altinn filing instances (Mva-melding, A-melding, Skattemelding, …), each paired with its Apier audit record where one exists (`filed_via_apier` + `apier_record`). Cursor-paginated via { cursor } (pass back `pagination.next_cursor`) + { limit } (1–100, default 20); legacy { offset } still accepted (deprecated); no filings → 200 with an empty list, never a 404. MOCK-GATED until the `altinn:instances.read` Maskinporten scope is approved. Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), AUTH_NO_DELEGATION (live mode), VALIDATION_FAILED. For upcoming deadlines rather than past filings, use get_company_deadlines instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/audit-inspection

NameTypeReqDescription
cursorstring–Opaque continuation token from the previous page's `pagination.next_cursor` - the canonical way to page.
limitinteger–Page size 1–100 (route default 20).
offsetinteger–Zero-based offset (deprecated - use `cursor` instead).
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund ID); MOD-11-checked up-front — a failing value is rejected as VALIDATION_FAILED, so correct the number rather than retrying it.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe paired filing history: `data[]` Altinn instances (form code, title, agency, submitted_at, status, instance id) each with `filed_via_apier` + `apier_record` when Apier submitted it, plus a `pagina…

No examples provided.

get_company_obligations ~361

Evaluate the Apier Rulebook for a Norwegian organisation and return every applicable regulatory obligation with its current state and legal reference. One entry per obligation: a stable obligation_id (e.g. `MVA_FILING_BIMONTHLY`), the lovdata legal_reference, the state enum (`filed` / `pending` / `in_progress` / `failed` / `overdue` / `unknown`), the bokmål description inherited byte-for-byte from the Rulebook (never re-translate it), and the freshness window. Deterministic, always against the current instant (no as_of at v1). Choose this for the full obligation menu. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), VALIDATION_FAILED. For the calendar alone, use get_company_deadlines instead; for the entity-type-level set needing no organisasjonsnummer or key, use get_public_obligations instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norwegian-company-obligations

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund ID); MOD-11-checked up-front — a failing value is rejected as VALIDATION_FAILED, so correct the number rather than retrying it.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe full rule-engine evaluation: every applicable obligation with stable id, lovdata legal_reference, state enum, and bokmål description.

No examples provided.

get_company_profile ~361

Resolve a Norwegian organisasjonsnummer (9 digits) into a structured company profile from Brønnøysund Enhetsregisteret: display name, organisational form (AS / ENK / ASA …), NACE codes with descriptions, addresses, registration/dissolution dates, the `active` / `dissolved` status enum, the MVA-registered flag, and deduplicated person role CODES — never personal identifiers. Note the backing REST route is POST /api/v1/brreg/company-profile (org number in the JSON body), unlike the GET company siblings. For an evaluated compliance verdict, use get_company_summary instead; for the signaturrett/prokura role-code summary, the distress flags, or the annual-accounts filing status, use get_company_context instead. No sandbox mirror. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), VALIDATION_FAILED. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norwegian-company-register-search

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund Enhetsregisteret ID). Unlike the get_company_* tools, this input schema does NOT run the MOD-11 control-digit check — MOD-11 is enforced by the back…
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe Brønnøysund company profile: display name, organisasjonsform, NACE codes + descriptions, addresses, registration/dissolution dates, MVA flag, and person role codes (never personal identifiers).

No examples provided.

get_company_summary ~328

Retrieve a one-shot compliance summary for a Norwegian organisation by its 9-digit organisasjonsnummer. Your FIRST call when orienting against a company: one round-trip composes entity_type, nace_codes, mva_registered, data_tier, the full obligations[] catalogue, and the rolling deadlines[] calendar, all from one rule version. obligations[] is byte-identical to get_company_obligations; deadlines[] matches get_company_deadlines (tier_2 adds filing_status). Only { org_number } is exposed, so call get_company_deadlines to control horizon_months. For drill-down call get_company_obligations; for identity without a verdict, use get_company_context instead. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_TIMEOUT, VALIDATION_FAILED. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/company-snapshot

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund ID); MOD-11-checked up-front — a failing value is rejected as VALIDATION_FAILED, so correct the number rather than retrying it.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe /summary composition: entity_type, nace_codes, mva_registered, data_tier, obligations[], deadlines[] (tier_2 adds filing_status), and (tier_1 only) upgrade_path. NOT the registry identity; call g…

No examples provided.

get_company_verification ~353

Get the deterministic verification verdict for a Norwegian organisation by its 9-digit organisasjonsnummer — a fast go / no-go trust check before acting on a company's behalf. Keyed ONLY off entity activity plus visible signing authority (signaturrett, prokura, or an ENK innehaver). `verification_status`: `pass` (active AND visible signing authority), `fail` (not active — konkurs, under avvikling, or oppløst), `unknown` (indeterminate or none visible — never a claimed absence; `warn` reserved). Seven transparency signals never change the verdict. The breakdown is available from get_company_authority; call get_company_context for identity, get_company_summary for obligations-and-deadlines, or get_company_obligations for drill-down. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_UNAVAILABLE, VALIDATION_FAILED. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norwegian-company-register-search

NameTypeReqDescription
org_numberstringyes9-digit Norwegian organisasjonsnummer (Brønnøysund ID); MOD-11-checked up-front — a failing value is rejected as VALIDATION_FAILED, so correct the number rather than retrying it.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe verdict: `verification_status` (pass / fail / unknown; `warn` reserved), the seven signals, Norwegian `summary`, `signing_authority_summary`, `last_accounts_year`, and the registry identity echo.

No examples provided.

get_credit_balance ~250

Call this BEFORE a batch of metered calls to confirm the calling key's prepaid credit balance covers it, and AFTER a 402 INSUFFICIENT_CREDITS + human top-up to verify the funds landed. The balance is ALWAYS the authenticated key's own — no parameters, so reading another key's balance is structurally impossible. Returns api_key_id (non-secret UUID), balance_ore (whole øre, always an integer), currency (NOK), updated_at (null = never topped up = balance 0), and top_up_url (hand it to a human; agents cannot pay directly). For affordability, multiply cost_ore from get_pricing by the planned call count and compare against balance_ore. Free (unmetered), zero side effects. Failure modes: 401 without a key (NOT keyless — use get_pricing for keyless price discovery); SCOPE_INSUFFICIENT (needs read:credits or read:*); CREDIT_BALANCE_UNAVAILABLE (503, retryable — a money read is never fabricated). Under a sandbox bearer it returns SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/guides/agent-payments

Input schema present but exposes no named parameters.

NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe authenticated key's own prepaid balance: api_key_id, balance_ore, currency, updated_at, top_up_url.

No examples provided.

get_exchange_rate ~324

Fetch the most recent Norges Bank exchange-rate reference for a currency against NOK — the canonical conversion benchmark Norwegian tax + accounting authorities accept for obligations in foreign currency (Årsregnskap, cross-border MVA, dividend reporting). The currency-of-record lookup; takes no Norwegian-company input. Returns the rate, the date it is valid for (weekday rates only; weekends / holidays return the prior business day's rate), and source attribution. Input: { base, quote, date? } — ISO 4217 codes, NOK-ANCHORED: exactly one side MUST be 'NOK'. A pair without a NOK side is rejected client-side as UNSUPPORTED_CURRENCY_PAIR — fetch both NOK legs and derive the cross rate yourself. Failure modes: VALIDATION_FAILED, UNSUPPORTED_CURRENCY_PAIR, INVALID_DATE, UPSTREAM_TIMEOUT, NO_RATE_AVAILABLE, SCOPE_INSUFFICIENT (needs read:norgesbank). For compliance obligations or filing deadlines rather than a currency rate, use get_company_summary instead. Docs: https://www.apier.no/docs/mcp

NameTypeReqDescription
basestringyesBase currency — ISO 4217 three-letter code (case-insensitive). Exactly one of base/quote must be 'NOK'.
datestring–Optional ISO 8601 date (YYYY-MM-DD); omit for the latest published rate. Non-business days fall back to the prior business day.
quotestringyesQuote currency — ISO 4217 three-letter code (case-insensitive). Exactly one of base/quote must be 'NOK'.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe Norges Bank NOK reference rate, the date it is valid for, and the source attribution.

No examples provided.

get_pricing ~204

Call this BEFORE metered work to check per-call cost and whether billing enforcement is live. Keyless: executes WITHOUT an API key, so an agent can price a workflow before it holds any credential. Returns the machine-readable price list: every credit-metered REST endpoint with its MCP tool name and cost in whole øre (always an integer), the enforcement.live flag (while false nothing is debited and a 402 is impossible), the 402 INSUFFICIENT_CREDITS recovery-contract field list, the top-up bounds with top_up_url, and the how_to_pay_guide URL. Prices derive from the SAME configuration the 402 meter debits, so this surface cannot drift from enforcement. Input: none — call with {}. Failure modes: per-IP rate limiting and transient errors only. For the calling key's own balance, use get_credit_balance (Bearer key required) instead. Docs: https://www.apier.no/docs/guides/billing

Input schema present but exposes no named parameters.

NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe machine-readable price list: per-endpoint/tool costs in whole øre, enforcement.live, the 402 recovery-contract shape, top-up bounds, and the how_to_pay_guide URL.

No examples provided.

get_public_deadlines ~296

Compute the universal Norwegian regulatory filing calendar — the deadlines that apply to every Norwegian business of the covered categories (MVA, A-melding, Årsregnskap), independent of any specific organisation. One entry per (obligation, period) pair for a single Europe/Oslo calendar year: a stable obligation_id (e.g. `MVA_FILING_BIMONTHLY`), the due_date as ISO 8601 in Europe/Oslo (DST-aware), the lovdata legal_reference, a recurring flag, and a business_day_adjusted flag. Choose this tool for questions like 'when is the next MVA filing deadline' that don't depend on a specific org_number — it requires no organisasjonsnummer. Deterministic: same input + same rulebook_version → byte-identical calendar. Input: optional `year` (integer 2020–2100; defaults to the current Oslo year). Failure modes: SCOPE_INSUFFICIENT (needs read:rulebook), VALIDATION_FAILED on year shape. For a specific company's filing calendar rather than the universal one, use get_company_deadlines instead. Docs: https://www.apier.no/docs/guides/norway-corporate-tax-return-deadline

NameTypeReqDescription
yearinteger–Europe/Oslo calendar year the calendar should cover (2020–2100). Omitted → the current Oslo year at the endpoint.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe universal Norwegian filing calendar for one Europe/Oslo year, independent of any specific organisation.

No examples provided.

get_public_obligations ~251

Retrieve the universal obligation set for a Norwegian entity type — every regulatory obligation that applies by virtue of an entity BEING that organisational form, BEFORE per-company Tier-2 data is layered on. Use this to answer 'what does an AS owe?' or 'what are the baseline filings for an Enkeltpersonforetak?' without naming a specific company. Each obligation carries a tier_2_required boolean — true means the rule engine needs commercial data to know whether it applies to a SPECIFIC company, false means it applies unconditionally. Input: { entity_type } from the closed enum AS / ENK / ANS / DA / NUF (no 'OTHER' fallback). Failure modes: VALIDATION_FAILED, SCOPE_INSUFFICIENT (needs read:rulebook), UPSTREAM_TIMEOUT. For per-company evaluation that DOES layer on commercial data, call get_company_obligations; for a specific company's evaluated obligations, use get_company_obligations instead. Docs: https://www.apier.no/docs/guides/norwegian-company-obligations

NameTypeReqDescription
entity_typestringyesNorwegian organisational form (closed enum): AS / ENK / ANS / DA / NUF.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe universal obligation set for the entity type, before per-company Tier-2 data is layered on.

No examples provided.

list_acting_capacity ~314

Resolve every Norwegian regulatory action a person is currently authorised to perform on behalf of a specific organisation. Combines the actor's Altinn role assignments (DAGL, LEDE, MEDL, NESTL, INNH, REGN, REVI) with a conservative role-to-action map, returning the raw role list AND the derived action tokens an agent may pass to /v1/actions/execute (dry-run them first with the validate_action tool), each with a lovdata legal_reference. Inputs: an 11-digit fødselsnummer / D-nummer — HMAC-hashed; the raw value is never persisted, logged, or returned (only `actor.fnr_hmac` is echoed) — plus the 9-digit organisasjonsnummer. Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. For your own consumer's delegation snapshot, use check_authorization instead; for the company-level statutory signing authority with no actor input, use get_company_authority. No sandbox-bearer mirror (SANDBOX_TOOL_UNAVAILABLE). Docs: https://www.apier.no/docs/guides/altinn-system-users

NameTypeReqDescription
fnrstringyes11-digit Norwegian fødselsnummer / D-nummer of the actor. HMAC-SHA-256 hashed before any storage — the raw value is never persisted, logged, or returned.
org_numberstringyes9-digit Norwegian organisasjonsnummer of the represented entity.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe actor's raw Altinn role list plus the derived action tokens they may pass to /v1/actions/execute (dry-run first with the validate_action tool), each with a lovdata legal_reference.

No examples provided.

list_changes ~419

Read Apier's cross-source change archive — detected created / updated / deleted events across the upstreams Apier polls (Brønnøysund ingestion plus the Altinn-schema, DigDir-policy, and Norges Bank pollers) so agents drive incremental sync instead of re-fetching whole entities. `observation_kind` separates cache warm-up rows from genuine transitions. Filter by { source, entity_type, entity_id, change_type } and a { from }–{ to } detected_at range. Queries WITHOUT entity_id withhold personal-field rows by design (`personal_fields_withheld: true`); the org-scoped form returns everything. Keyset-paginated newest-first: pass { limit } (1–500, default 50) and carry `next_cursor` back verbatim — cursors are HMAC-signed; an edited one is rejected as CURSOR_INVALID - start over without a cursor. Failure modes: SCOPE_INSUFFICIENT (needs read:changes), VALIDATION_FAILED, CURSOR_INVALID. No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/guides/webhooks

NameTypeReqDescription
change_typestring–Filter to created / updated / deleted events.
cursorstring–Opaque signed cursor from a previous `next_cursor` — pass back verbatim.
entity_idstring–Filter to one entity's change stream (e.g. a 9-digit org number).
entity_typestring–Filter to one entity type (e.g. annual_accounts, company).
fromstring–Lower bound on detected_at (ISO 8601 with timezone offset).
limitinteger–Page size 1–500 (route default 50).
sourcestring–Filter to one upstream source (e.g. brreg / altinn / digdir / norges_bank). Omit for all sources.
tostring–Upper bound on detected_at; must be ≥ from.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe change page: `data[]` rows (source, entity_type, entity_id, change_type, detected_at, source_snapshot_id, observation_kind), a `pagination` block, and `personal_fields_withheld`. Ordered newest-f…

No examples provided.

redeem_issuance_token ~278

Convert an owner-issued key-issuance token into your own API key — the headless onboarding step for an agent that holds no credential yet. Keyless: the one-time token IS the credential. Minting and revocation are dashboard-only by design, so an agent can never self-issue authority. Redemption is strictly SINGLE-USE and atomic: on success (201) the token is consumed and the result carries {id, name, scopes, created_at, plaintext_key} — returned EXACTLY ONCE; store it immediately. Failure modes: an expired / used / revoked / unknown token yields ONE uniform ISSUANCE_TOKEN_INVALID failure (ask the owner for a fresh token, never retry); MAX_KEYS_REACHED (409) means 3 active keys — the token was NOT consumed, retry with the SAME token after the owner revokes a key. After onboarding, use get_pricing (keyless) to price metered work and get_credit_balance (with your new key) for the balance. Docs: https://www.apier.no/docs/authentication

NameTypeReqDescription
tokenstringyesThe one-time key-issuance token the account owner minted in the Apier dashboard (Agent issuance tokens) and handed to you out-of-band. Single-use: it is consumed atomically on success. Never logged b…
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe freshly issued API key: id, fixed name, read:* scopes, creation time, and the one-time plaintext_key.

No examples provided.

request_fullmakt ~444

Broker a fullmakt — a legally-grounded, scoped, revocable company→agent authority delegated through an Altinn systembruker. The tool brokers the delegation, persists it, and binds the returned system_user_id write-once onto the principal (`pending` → `active`). The company's signing authority must approve the returned `delegation_url` before the delegation is usable. Non-empty `warnings[]` on a 201 means the delegation exists upstream but a local follow-up degraded - reconcile, never blind-retry. Identical retries are dedup-safe (deterministic Idempotency-Key). Inputs: { agent_principal_id (uuid, YOUR OWN), org_number (9 digits), scopes (non-empty string[]), validity_days?, label? }. Failure modes: FULLMAKT_PRINCIPAL_NOT_FOUND, FULLMAKT_PRINCIPAL_NOT_ELIGIBLE, FULLMAKT_UPSTREAM_FAILED, SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. To inspect the recorded state per principal, use check_fullmakt instead; to withdraw the delegation and retire the principal, use revoke_fullmakt instead. No sandbox mirror. Docs: https://www.apier.no/docs/fullmakt

NameTypeReqDescription
agent_principal_idstringyesThe agent principal (UUID) to bind this delegation to — one of YOUR OWN; an unknown or foreign id returns FULLMAKT_PRINCIPAL_NOT_FOUND.
labelstring–Optional consumer-supplied label for the delegation (dashboard display only; echoed back on the response).
org_numberstringyes9-digit Norwegian organisasjonsnummer of the customer company granting the delegation. Plain 9 digits (no MOD-11 check), matching the route contract.
scopesarrayyesThe Altinn scopes the delegation should carry (e.g. `altinn:accessmanagement/authorizedparties.read`); at least one, each non-whitespace.
validity_daysinteger–Optional delegation validity window in days (1–3650; the 10-year cap matches Altinn's longest supported term). Omit to use the adapter default.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe brokered delegation: `system_user_id`, `status`, `scopes`, `valid_until`, `delegation_url` (the approval link), the echoed `label`, the `agent_principal` snapshot, and `warnings[]` (empty on the…

No examples provided.

revoke_fullmakt ~317

Revoke a fullmakt — withdraw an agent's delegated authority for a Norwegian company and retire the agent principal (broker with request_fullmakt, inspect with check_fullmakt). Given ONLY the agent_principal_id (system_user_id and org_number resolve server-side from the write-once binding, so a client cannot redirect the revoke), Apier revokes the bound delegation and flips the principal to terminal `revoked` — never resurrected; create a new principal to act again. LOCAL revocation is authoritative and immediate. Idempotent: an already-revoked principal/delegation is a 200 no-op. `warnings[]` carries NAMED outcome tokens (principal_revoke_failed, delegation_not_found, upstream_revoke_unconfirmed) - read the specific token, not just array emptiness. Input: { agent_principal_id (uuid), reason? (audit-only) }. Failure modes: FULLMAKT_PRINCIPAL_NOT_FOUND, SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/fullmakt

NameTypeReqDescription
agent_principal_idstringyesThe agent principal (UUID) whose delegation to revoke — one of YOUR OWN; an unknown or foreign id returns FULLMAKT_PRINCIPAL_NOT_FOUND.
reasonstring–Optional operator-facing reason, recorded on the audit row only. Send content or omit — an empty string is rejected.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe revocation outcome: `revoked: true`, the `agent_principal` snapshot, and `warnings[]` (empty on the clean path; NAMED tokens otherwise).

No examples provided.

search_companies ~329

Resolve a Norwegian company NAME to its 9-digit organisasjonsnummer. Use this as your FIRST call whenever you have a company's name but NOT its org_number — every other company tool requires the 9-digit number, and guessing a MOD-11-valid number risks hitting the wrong company. Searches Brønnøysund's public Enhetsregisteret and returns a token-efficient candidate list: up to ten matches, five fields each (name, org_number, org_form, municipality, registry status). Then call get_company_summary or get_company_context with the chosen org_number (skip a deleted or bankrupt match unless you meant it). Input: { name } (2–100 chars, æ/ø/å supported). On NOT_FOUND, broaden the name and drop the legal form — never loop on the same name. Failure modes: VALIDATION_FAILED, NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_TIMEOUT / UPSTREAM_UNAVAILABLE. No sandbox mirror — the sandbox fixtures catalog already lists every synthetic org. Docs: https://www.apier.no/docs/guides/norwegian-company-register-search

NameTypeReqDescription
namestringyesCompany name to search for (2–100 characters, trimmed). Free-text; matched against Brønnøysund's registered `navn` field. Omit the legal form for a broader match (search `Nordic Widgets`, not `Nordic…
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe /company/search projection: { query, count, candidates } — five fields per candidate (name, org_number, org_form, municipality, status). Pick an org_number, then call get_company_summary / get_co…

No examples provided.

validate_action ~414

Run the Apier dry-run validator against a proposed regulatory action without producing ANY upstream side effect — no Maskinporten call, no Altinn / Skatteetaten / NAV submission. Use this BEFORE the live execute path to catch missing delegations and payload-shape errors at zero upstream cost. The verdict carries five prerequisite check slots (each pass / fail / skipped), the overall `valid` boolean, the DRY_RUN_DISCLAIMER (a pass is NOT a guarantee of upstream success), and the preview echo `would_be_payload` + `preview_notice`. Inputs match the /v1/actions/execute body: { org_number (9 digits, MOD-11), action_type (`mva_melding` | `a_melding`), period, payload }. The nested `payload` object is intentional - it mirrors the upstream government payload schema for the action, so it is not flattened. Failure modes: SCOPE_INSUFFICIENT (needs read:actions), VALIDATION_FAILED; the validator never throws. To actually file a (sandbox) VAT return, use submit_vat_return instead. No sandbox mirror — under a sandbox bearer call submit_vat_return instead. Docs: https://www.apier.no/docs/guides/mva-filing

NameTypeReqDescription
action_typestringyesThe regulatory action to dry-run — `mva_melding` (VAT return) or `a_melding` (employer report).
org_numberstringyes9-digit Norwegian organisasjonsnummer (passing MOD-11) the proposed action targets.
payloadobjectyesThe upstream-shaped JSON payload for the action; the route's per-action discriminated Zod owns shape validation. Capped at 64 KiB UTF-8 here.
periodstringyesReporting period. mva_melding: `YYYY-T1..T6` (bimonthly), `YYYY-A` (annual), or `YYYY-MM` (monthly). a_melding: `YYYY-MM`.
NameTypeReqDescription
_meta–––
justification–yes–
metadata–yes–
resultobjectyesThe structured dry-run verdict: the overall `valid` boolean, the five check slots (each pass/fail/skipped with a reason), the DRY_RUN_DISCLAIMER, and the preview echo `would_be_payload` + `preview_no…

No examples provided.

Common questions

What is the Apier MCP server?

Apier is an MCP server listed in the public MCP registry as no.apier/mcp. Compliance infrastructure API connecting AI agents to Norwegian government systems (Altinn, BRREG). This page covers its hosted endpoint (https://www.apier.no/api/mcp).

Is the Apier MCP server safe to use?

Apier scores 95 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Apier MCP server expose?

Apier exposes 25 tools: get_company_summary, get_public_obligations, get_exchange_rate, list_acting_capacity, get_company_profile, and 20 more. Their descriptions and schemas cost roughly 8,328 tokens of context every time the server is loaded.

Does the Apier MCP server require authentication?

Yes. Apier asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the Apier MCP server still maintained?

Apier is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.