mcp server

Apier

Compliance API bridging AI agents to Norwegian government systems (Altinn, Maskinporten, BRREG)

Description as published by the maintainer. Source

• version 2026.8.0
• active
• security

active — Registry entry last updated 2026-08-04. Dashed tags are derived by ZBS Index from the published description, not stated by the maintainer.

What this server can do

25 functions, named and described by the server itself. Parameter names are shown because they say more about what a function does than its name usually does.

check_authorization(org_number)

Return the authorisation snapshot for the calling consumer's delegation on a Norwegian organisation: the `status` enum (`full` / `partial` / `none`), `missing_scopes` (empty on `full`), `granted_scopes`, and the `delegation_chain` breadcrumbs. To check whether a SPECIFIC action is permitted, compare `granted_scopes` to the scopes it requires. Always runs against the calling consumer — no per-action or per-actor input at v1. Always a 200: with no delegation the verdict is `status: "none"`, never a 404. Input: { org_number } (9 digits, MOD-11). Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. For a SPECIFIC person's actions, use list_acting_capacity instead. This is the CONSUMER-level snapshot — the execute preflight (dry-run it via the validate_action tool) enforces the same rule. For the per-agent-principal breakdown, use check_fullmakt; for statutory signing authority, use get_company_authority. No sandbox mirror. Docs: https://www.apier.no/docs/fullmakt Required: org_number.

check_fullmakt(org_number)

Check your fullmakt state for a Norwegian company BEFORE acting on its behalf — the read leg of the Fullmakt Rails. Per agent principal of yours holding a live delegation there it returns: the bound system_user_id, whether the delegation is `active` or still `pending` signaturrett approval, the scopes carried, and the scopes still missing. `overall_status`: `full` (act now), `partial` (`fix_steps` names the blocker), or `none` — a VALID answer, not an error: 200 with empty `principals[]`, never a 404. Reports the delegation state Apier RECORDED, not a live Altinn PDP decision. Input: { org_number } (plain 9 digits). Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. To BROKER a fullmakt use request_fullmakt; to withdraw one use revoke_fullmakt. This breaks the state down PER AGENT PRINCIPAL; the CONSUMER-level snapshot is reported by check_authorization. No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/fullmakt Required: org_number.

explain_compliance_error(context, error_code)

Resolve a structured Apier compliance error code into a Norwegian-bokmål Explanation envelope: a one-line summary, a 1–3 sentence why, ordered fix_steps, an optional documentation link, an optional Lovdata-style legal_basis, and an optional handover block (who / where / what / why) for errors a human must resolve (e.g. AUTH_INSUFFICIENT_ROLE, AUTH_NO_DELEGATION, SCOPE_MISSING) — agent-resolvable errors ship `handover: null`. Accepts any code from the closed EXPLAINER_ERROR_CODES catalogue (40 codes) — pass whatever code an Apier endpoint returned in an error envelope. The optional `context` object carries placeholder values (org_number, role, scope, field, upstream_system) interpolated into the bokmål text; missing values fall back to 'ukjent <noun>'. Failure modes: VALIDATION_FAILED on an unknown code; SCOPE_INSUFFICIENT (needs read:rulebook). For a company's live obligations rather than an error explanation, use get_company_obligations instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Docs: https://www.apier.no/docs/guides/error-handling Required: error_code.

get_altinn_migration_guidance(altinn2_code)

Discover the Altinn 3 equivalent of an Altinn 2 service or role code. The 19 June 2026 Altinn 2 deprecation deadline has passed, so this serves remediation for any integration still on Altinn 2. Pass { altinn2_code } (alphanumeric, 1–10 chars, e.g. A0208) for a single mapping, or omit it for the entire migration map. Every response carries the deprecation status computed in Europe/Oslo (deprecation_deadline, days_remaining — floored at 0, deadline_passed — now true). Each entry ships a `verified` flag: gate any production migration action on `verified === true`; unverified entries are hints, not instructions. Deterministic static map (DigDir-sourced) — no government system is contacted at call time. Failure modes: NOT_FOUND when a supplied code is not in the map (omit it to list every entry), VALIDATION_FAILED (INVALID_CODE), SCOPE_INSUFFICIENT (needs read:digdir). No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/guides/altinn-system-users

get_company_accounts(org_number)

Current-snapshot read of a Norwegian company's annual accounts (årsregnskap) from the OPEN Regnskapsregisteret tier: `has_filed_annual_accounts` (tri-state — null means unknown, never a fabricated false), `last_accounts_year`, and that year's minimal `key_figures` (currency, presentation basis, totals). `currency` is always surfaced so figures are never silently read as NOK. Current-snapshot only — no multi-year history. A well-formed but unknown org_number returns 200 with `null`, not a 404. Input: { org_number } (9 digits, MOD-11). Failure modes: SCOPE_INSUFFICIENT (needs read:brreg), VALIDATION_FAILED. For the filing status as one input to a go/no-go verdict, use get_company_verification; for the registry identity, use get_company_context. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norwegian-company-annual-accounts Required: org_number.

get_company_authority(org_number)

Answer "who can legally sign for this Norwegian company, and how?" before acting on its behalf. Given a 9-digit organisasjonsnummer it returns a deterministic signing-authority classification — `sole`, `joint`, `by_role`, `prokura_only`, `no_authority`, or `unknown` — normalised from the open Brønnøysund Fullmakttjenesten signing combinations plus the signaturrett / prokura role-holders. `combinations[]` carries `kombinasjons_id`, description, and role codes; `kombinasjon_available: false` flags a degraded answer. No legal citation is asserted. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_UNAVAILABLE, VALIDATION_FAILED. For a fast go/no-go verdict, use get_company_verification instead. This answers STATUTORY authority — no actor input, no Altinn delegations. For a SPECIFIC person's actions, use list_acting_capacity; for the consumer's own delegation, use check_authorization. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/signature-rights-norwegian-company Required: org_number.

get_company_context(org_number)

Retrieve the structured Brønnøysund identity slice for a Norwegian organisation by its 9-digit organisasjonsnummer: legal name, organisasjonsform (AS / ENK / NUF / ASA …), NACE codes, addresses, incorporation/dissolution dates, and the signaturrett / prokura role-code summary (never personal identifiers). Cache window 24 h. Choose this for the identity slice ONLY, without the compliance verdict; pair with get_company_obligations or get_company_deadlines for the regulatory layer. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_TIMEOUT, VALIDATION_FAILED. For a compliance verdict, use get_company_summary instead. Distinguishers: the role-code summary, the open distress flags, and the annual-accounts filing status; for the plain registry profile with NACE descriptions, use get_company_profile instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/company-snapshot Required: org_number.

get_company_deadlines(org_number, horizon_months)

Compute the upcoming Norwegian regulatory filing calendar for a specific organisation, looking horizon_months ahead. One entry per (obligation, period) pair: a stable obligation_id matching get_company_obligations, the due_date as ISO 8601 in Europe/Oslo (DST-aware), the legal_reference, a recurring flag, and a business_day_adjusted flag. Choose this for the calendar view — when does the next MVA / A-melding / Årsregnskap filing land? Deterministic: byte-identical per rulebook version. Inputs: { org_number (9 digits, MOD-11), horizon_months? (1–60) }. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), VALIDATION_FAILED. For the per-obligation compliance verdict, use get_company_obligations instead; for the entity-type-level calendar that needs no organisasjonsnummer (and no API key), use get_public_deadlines instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norway-corporate-tax-return-deadline Required: org_number.

get_company_filing_history(limit, offset, org_number)

Reconcile a Norwegian company's Altinn 3 filing history against the filings YOUR consumer submitted through Apier. Given a 9-digit organisasjonsnummer it returns the org's Altinn filing instances (Mva-melding, A-melding, Skattemelding, …) — form code, title, agency, submitted_at (Europe/Oslo), status, instance id — each paired with its Apier audit record where one exists (`filed_via_apier` + `apier_record`). Offset-paginated via { limit } (1–100, default 20) and { offset }; no filings → 200 with an empty list, never a 404. MOCK-GATED until the `altinn:instances.read` Maskinporten scope is approved. Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), AUTH_NO_DELEGATION (live mode), VALIDATION_FAILED. For upcoming deadlines rather than past filings, use get_company_deadlines instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/audit-inspection Required: org_number.

get_company_obligations(org_number)

Evaluate the Apier Rulebook for a Norwegian organisation and return every applicable regulatory obligation with its current state and legal reference. One entry per obligation: a stable obligation_id (e.g. `MVA_FILING_BIMONTHLY`), the lovdata legal_reference, the state enum (`filed` / `pending` / `in_progress` / `failed` / `overdue` / `unknown`), the bokmål description inherited byte-for-byte from the Rulebook (never re-translate it), and the freshness window. Deterministic, always against the current instant (no as_of at v1). Choose this for the full obligation menu; use get_company_deadlines for the calendar view. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), VALIDATION_FAILED. For the calendar alone, use get_company_deadlines instead; for the entity-type-level set needing no organisasjonsnummer or key, use get_public_obligations instead. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norwegian-company-obligations Required: org_number.

get_company_profile(org_number)

Resolve a Norwegian organisasjonsnummer (9 digits) into a structured company profile from Brønnøysund Enhetsregisteret: display name, organisational form (AS / ENK / ASA …), NACE codes with descriptions, addresses, registration/dissolution dates, the `active` / `dissolved` status enum, the MVA-registered flag, and deduplicated person role CODES — never personal identifiers. Tier 1 public NLOD data; cache TTL 24 h. Note the backing REST route is POST /api/v1/brreg/company-profile (org number in the JSON body), unlike the GET company siblings. For an evaluated compliance verdict, use get_company_summary instead. Distinguishers: full address detail and NACE descriptions; for the signaturrett/prokura role-code summary, the distress flags, or the annual-accounts filing status, use get_company_context instead. No sandbox mirror. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), VALIDATION_FAILED. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norwegian-company-register-search Required: org_number.

get_company_summary(org_number)

Retrieve a one-shot compliance summary for a Norwegian organisation by its 9-digit organisasjonsnummer. Your FIRST call when orienting against a company: one round-trip composes entity_type, nace_codes, mva_registered, data_tier, the full obligations[] catalogue, and the rolling deadlines[] calendar, all from one rule version. obligations[] is byte-identical to get_company_obligations; deadlines[] matches get_company_deadlines (tier_2 adds filing_status). Only { org_number } is exposed, so call get_company_deadlines to control horizon_months. It does NOT return the registry identity; call get_company_context for those fields. For drill-down call get_company_obligations; for filing dates call get_company_deadlines; for identity without a verdict, use get_company_context instead. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_TIMEOUT, VALIDATION_FAILED. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/company-snapshot Required: org_number.

get_company_verification(org_number)

Get the deterministic verification verdict for a Norwegian organisation by its 9-digit organisasjonsnummer — a fast go / no-go trust check before acting on a company's behalf. Reduced from the same Tier 1 data as get_company_context, keyed ONLY off two facts: is the entity active, and is signing authority (signaturrett, prokura, or an ENK innehaver) visible in the open role data. `verification_status`: `pass` (active AND visible signing authority), `fail` (not active — konkurs, under avvikling, or oppløst), `unknown` (indeterminate or none visible — never a claimed absence; `warn` reserved). Seven transparency signals never change the verdict. The breakdown is available from get_company_authority; call get_company_context for identity, get_company_summary for obligations-and-deadlines, or get_company_obligations for drill-down. Failure modes: NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_UNAVAILABLE, VALIDATION_FAILED. No API key? Bearer apier_sandbox_test_<suffix> (fresh suffix) serves synthetic fixtures; org numbers: GET /api/v1/sandbox/fixtures. Cost: 50 øre (NOK 0.50) per call, prepaid (prices: the get_pricing tool or GET /api/v1/pricing; a shortfall returns INSUFFICIENT_CREDITS with top_up_url). Docs: https://www.apier.no/docs/guides/norwegian-company-register-search Required: org_number.

get_credit_balance

Call this BEFORE a batch of metered calls to confirm the calling key's prepaid credit balance covers it, and AFTER a 402 INSUFFICIENT_CREDITS + human top-up to verify the funds landed. The balance is ALWAYS the authenticated key's own — no parameters, so reading another key's balance is structurally impossible. Returns api_key_id (non-secret UUID), balance_ore (whole øre, always an integer), currency (NOK), updated_at (null = never topped up = balance 0), and top_up_url (hand it to a human; agents cannot pay directly). For affordability, multiply cost_ore from get_pricing by the planned call count and compare against balance_ore. Free (unmetered), zero side effects. Failure modes: 401 without a key (NOT keyless — use get_pricing for keyless price discovery); SCOPE_INSUFFICIENT (needs read:credits or read:*); CREDIT_BALANCE_UNAVAILABLE (503, retryable — a money read is never fabricated). Under a sandbox bearer it returns SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/guides/agent-payments

get_exchange_rate(base, date, quote)

Fetch the most recent Norges Bank exchange-rate reference for a currency against NOK — the canonical conversion benchmark Norwegian tax + accounting authorities accept for obligations in foreign currency (Årsregnskap, cross-border MVA, dividend reporting). The currency-of-record lookup; takes no Norwegian-company input. Returns the rate, the date it is valid for (weekday rates only; weekends / holidays return the prior business day's rate), and source attribution. Input: { base, quote, date? } — ISO 4217 codes, NOK-ANCHORED: exactly one side MUST be 'NOK'. A pair without a NOK side is rejected client-side as UNSUPPORTED_CURRENCY_PAIR — fetch both NOK legs and derive the cross rate yourself. Failure modes: VALIDATION_FAILED, UNSUPPORTED_CURRENCY_PAIR, INVALID_DATE, UPSTREAM_TIMEOUT, NO_RATE_AVAILABLE, SCOPE_INSUFFICIENT (needs read:norgesbank). For compliance obligations or filing deadlines rather than a currency rate, use get_company_summary instead. Docs: https://www.apier.no/docs/mcp Required: base, quote.

get_pricing

Call this BEFORE metered work to check per-call cost and whether billing enforcement is live. Keyless: executes WITHOUT an API key, so an agent can price a workflow before it holds any credential. Returns the machine-readable price list: every credit-metered REST endpoint with its MCP tool name and cost in whole øre (always an integer), the enforcement.live flag (while false nothing is debited and a 402 is impossible), the 402 INSUFFICIENT_CREDITS recovery-contract field list, the top-up bounds with top_up_url, and the how_to_pay_guide URL. Prices derive from the SAME configuration the 402 meter debits, so this surface cannot drift from enforcement. Input: none — call with {}. Failure modes: per-IP rate limiting and transient errors only. For the calling key's own balance, use get_credit_balance (Bearer key required) instead. Docs: https://www.apier.no/docs/guides/billing

get_public_deadlines(year)

Compute the universal Norwegian regulatory filing calendar — the deadlines that apply to every Norwegian business of the covered categories (MVA, A-melding, Årsregnskap), independent of any specific organisation. One entry per (obligation, period) pair for a single Europe/Oslo calendar year: a stable obligation_id (e.g. `MVA_FILING_BIMONTHLY`), the due_date as ISO 8601 in Europe/Oslo (DST-aware), the lovdata legal_reference, a recurring flag, and a business_day_adjusted flag. Choose this tool for questions like 'when is the next MVA filing deadline' that don't depend on a specific org_number — it requires no organisasjonsnummer. Deterministic: same input + same rulebook_version → byte-identical calendar. Input: optional `year` (integer 2020–2100; defaults to the current Oslo year). Failure modes: SCOPE_INSUFFICIENT (needs read:rulebook), VALIDATION_FAILED on year shape. For a specific company's filing calendar rather than the universal one, use get_company_deadlines instead. Docs: https://www.apier.no/docs/guides/norway-corporate-tax-return-deadline

get_public_obligations(entity_type)

Retrieve the universal obligation set for a Norwegian entity type — every regulatory obligation that applies by virtue of an entity BEING that organisational form, BEFORE per-company Tier-2 data is layered on. Use this to answer 'what does an AS owe?' or 'what are the baseline filings for an Enkeltpersonforetak?' without naming a specific company. Each obligation carries a tier_2_required boolean — true means the rule engine needs commercial data to know whether it applies to a SPECIFIC company, false means it applies unconditionally. Input: { entity_type } from the closed enum AS / ENK / ANS / DA / NUF (no 'OTHER' fallback). Failure modes: VALIDATION_FAILED, SCOPE_INSUFFICIENT (needs read:rulebook), UPSTREAM_TIMEOUT. For per-company evaluation that DOES layer on commercial data, call get_company_obligations; for a specific company's evaluated obligations, use get_company_obligations instead. Docs: https://www.apier.no/docs/guides/norwegian-company-obligations Required: entity_type.

list_acting_capacity(fnr, org_number)

Resolve every Norwegian regulatory action a person is currently authorised to perform on behalf of a specific organisation. Combines the actor's Altinn role assignments (DAGL, LEDE, MEDL, NESTL, INNH, REGN, REVI) with a conservative role-to-action map, returning the raw role list AND the derived action tokens an agent may pass to /v1/actions/execute (dry-run them first with the validate_action tool), each with a lovdata legal_reference. Inputs: an 11-digit fødselsnummer / D-nummer — HMAC-hashed; the raw value is never persisted, logged, or returned (only `actor.fnr_hmac` is echoed) — plus the 9-digit organisasjonsnummer. Cached up to 1 hour (`metadata.cached: true`). Failure modes: SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. For your own consumer's delegation snapshot, use check_authorization instead; for the company-level statutory signing authority with no actor input, use get_company_authority. No sandbox-bearer mirror (SANDBOX_TOOL_UNAVAILABLE). Docs: https://www.apier.no/docs/guides/altinn-system-users Required: fnr, org_number.

list_changes(to, from, limit, cursor, source, entity_id, change_type, entity_type)

Read Apier's cross-source change archive — detected created / updated / deleted events across the upstreams Apier polls (Brønnøysund ingestion plus the Altinn-schema, DigDir-policy, and Norges Bank pollers). It answers "what changed, where, and when?" so an agent drives an incremental sync instead of re-fetching whole entities. `observation_kind` distinguishes first_observation (cache warming up) from value_change (a genuine transition). Filter by { source, entity_type, entity_id, change_type } and a { from }–{ to } detected_at range. Queries WITHOUT entity_id withhold personal-field rows by design (`personal_fields_withheld: true`); the org-scoped form returns everything. Keyset-paginated newest-first: pass { limit } (1–500, default 50) and carry `next_cursor` back verbatim — cursors are HMAC-signed, an edited one is rejected as CURSOR_INVALID (start over without a cursor). Failure modes: SCOPE_INSUFFICIENT (needs read:changes), VALIDATION_FAILED, CURSOR_INVALID. No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/guides/webhooks

redeem_issuance_token(token)

Convert an owner-issued key-issuance token into your own API key — the headless onboarding step for an agent that holds no credential yet. Keyless: the one-time token IS the credential. Minting and revocation are dashboard-only by design, so an agent can never self-issue authority. Redemption is strictly SINGLE-USE and atomic: on success (201) the token is consumed and the result carries {id, name, scopes, created_at, plaintext_key} — returned EXACTLY ONCE; store it immediately. Failure modes: an expired / used / revoked / unknown token yields ONE uniform ISSUANCE_TOKEN_INVALID failure (ask the owner for a fresh token, never retry); MAX_KEYS_REACHED (409) means 3 active keys — the token was NOT consumed, retry with the SAME token after the owner revokes a key. After onboarding, use get_pricing (keyless) to price metered work and get_credit_balance (with your new key) for the balance. Docs: https://www.apier.no/docs/authentication Required: token.

request_fullmakt(label, scopes, org_number, validity_days, agent_principal_id)

Broker a fullmakt — a legally-grounded, scoped, revocable company→agent authority delegated through an Altinn systembruker. Turns an agent principal (an identity) into an ACTOR for a specific Norwegian company: the tool brokers the delegation, persists it, and binds the returned system_user_id write-once onto the principal (`pending` → `active`). The company's signing authority must approve the returned `delegation_url` before the delegation is usable. `warnings[]` is ALWAYS present; non-empty on a 201 means the delegation EXISTS upstream but a local follow-up degraded — reconcile, never blind-retry. Identical retries are dedup-safe (deterministic Idempotency-Key). Inputs: { agent_principal_id (uuid, YOUR OWN), org_number (9 digits), scopes (non-empty string[]), validity_days?, label? }. Failure modes: FULLMAKT_PRINCIPAL_NOT_FOUND, FULLMAKT_PRINCIPAL_NOT_ELIGIBLE, FULLMAKT_UPSTREAM_FAILED (never blind-retry the ack-unconfirmed variant), SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. The read-side twin is check_fullmakt; the revocation leg is revoke_fullmakt. No sandbox mirror. Docs: https://www.apier.no/docs/fullmakt Required: agent_principal_id, org_number, scopes.

revoke_fullmakt(reason, agent_principal_id)

Revoke a fullmakt — withdraw an agent's delegated authority for a Norwegian company and retire the agent principal (broker with request_fullmakt, inspect with check_fullmakt). Given ONLY the agent_principal_id (system_user_id and org_number are read server-side from the write-once binding, so a client cannot redirect the revoke), Apier revokes the bound delegation and flips the principal to terminal `revoked` — never resurrected; create a new principal to act again. LOCAL revocation is authoritative and immediate. Idempotent: an already-revoked principal/delegation is a 200 no-op. `warnings[]` carries NAMED outcome tokens (principal_revoke_failed, delegation_not_found, upstream_revoke_unconfirmed) — read the specific token rather than treating any non-empty array as a local failure. Input: { agent_principal_id (uuid), reason? (audit-only) }. Failure modes: FULLMAKT_PRINCIPAL_NOT_FOUND, SCOPE_INSUFFICIENT (needs read:altinn), VALIDATION_FAILED. No sandbox mirror — a sandbox bearer gets SANDBOX_TOOL_UNAVAILABLE. Docs: https://www.apier.no/docs/fullmakt Required: agent_principal_id.

search_companies(name)

Resolve a Norwegian company NAME to its 9-digit organisasjonsnummer. Use this as your FIRST call whenever you have a company's name but NOT its org_number — every other company tool requires the 9-digit number, and guessing a MOD-11-valid number risks hitting the wrong company. Searches Brønnøysund's public Enhetsregisteret and returns a token-efficient candidate list: up to ten matches, five fields each (name, org_number, org_form, municipality, registry status). Follow-up: pick the right candidate's org_number (skip a deleted or bankrupt match unless you meant it), then call get_company_summary or get_company_context with it. Input: { name } (2–100 chars, æ/ø/å supported). On NOT_FOUND, broaden the name and drop the legal form — never loop on the same name. Failure modes: VALIDATION_FAILED, NOT_FOUND, SCOPE_INSUFFICIENT (needs read:brreg), UPSTREAM_TIMEOUT / UPSTREAM_UNAVAILABLE. No sandbox mirror — the sandbox fixtures catalog already lists every synthetic org. Docs: https://www.apier.no/docs/guides/norwegian-company-register-search Required: name.

validate_action(period, payload, org_number, action_type)

Run the Apier dry-run validator against a proposed regulatory action without producing ANY upstream side effect — no Maskinporten call, no Altinn / Skatteetaten / NAV submission. Use this BEFORE the live execute path to catch missing delegations, expired scopes, deadline misses, and payload-shape errors at zero upstream cost. The verdict carries five check slots (company_exists, system_user_authorised, scopes_delegated, deadline_in_future, data_format_valid — each pass / fail / skipped), the overall `valid` boolean, the DRY_RUN_DISCLAIMER (a pass is NOT a guarantee of upstream success), and the preview echo `would_be_payload` + `preview_notice`. Inputs match the /v1/actions/execute body: { org_number (9 digits, MOD-11), action_type (`mva_melding` | `a_melding`), period, payload }. Failure modes: SCOPE_INSUFFICIENT (needs read:actions), VALIDATION_FAILED; the validator never throws. To actually file a (sandbox) VAT return, use submit_vat_return instead. No sandbox mirror — under a sandbox bearer call submit_vat_return instead. Docs: https://www.apier.no/docs/guides/mva-filing Required: org_number, action_type, period, payload.

Last successful function declaration observed on 2026-08-13. Source: https://www.apier.no/api/mcp. We list what the server declared; we do not call any of these functions.

Endpoint status observed on 2026-08-13. Source: https://www.apier.no/api/mcp.

Signals

These are separate measurements of different things. They are deliberately not combined into one score, because a popularity number that mixes website traffic with saves and stars cannot be checked or acted on.

Where to get it

• Repository — https://github.com/PowerLaunch/apier-mcp
• Website — https://www.apier.no/docs
• Remote endpoint (streamable-http) — https://www.apier.no/api/mcp