Norwegian company intelligence, without the manual work

1. Step 01

   Agent asks: can I act?

   The agent sends a company org_number and intent to Apier. A single call returns the effective delegation scope plus every obligation that applies — with versioned legal citations the agent can surface to its caller.

2. Step 02

   Apier composes the real request

   Given an authorized intent, Apier translates it into the concrete Altinn / Skatteetaten / Brønnøysund call and returns a dry-run receipt describing exactly what will happen — who, what, when, on whose authority. Delegation writes already accept an Idempotency-Key; other write endpoints inherit the same contract as the idempotency middleware lands across the surface.

3. Step 03Handover

   Human-agent handover

   When the action crosses a threshold (signing, thresholds above NOK limits, missing delegations), Apier issues an Approval Token and a Norwegian-language explanation of what the human must do, where, and why. The agent stops here until the token is used.

4. Step 04

   Apier validates, audits, replays

   On approval, Apier composes and validates the request, logs the full exchange to an append-only audit trail, and returns a receipt. Today that runs in sandbox and dry-run — it validates without submitting to a live government system; live binding submission is gated, pending Maskinporten production validation and Altinn scope approval, and runs the same audited path. On endpoints that carry an Idempotency-Key, the same key always returns the same receipt — never a duplicate submission.

DeterminismSame input, same Rulebook version, same output.

The same request produces the same cross-agency plan every time. No hidden model in the path deciding what to do — the sequence is derived from rules you can read.

IdempotencyAn Idempotency-Key makes a delegation write safe to retry.

Send the same request twice with the same idempotency key and the second call returns the first result instead of acting again, so a retry after a timeout can't write twice.

Dry-runSee the exact call before it happens.

Preview the exact government requests a call would make, and what they'd return, without submitting anything — so you can test an agent's behaviour before it touches a live registry.

Audit trailAppend-only, consumer-scoped, immutable.

Every action writes an append-only record: who acted, in what capacity, what was sent, and what came back. The log can be added to, never edited or deleted.

Approval TokenA human gate for every threshold action.

Actions that need a human in the loop can be gated behind a single-use approval token, so an agent prepares a filing and a person authorises it before anything is sent.

ResilienceTimeouts, bounded retries, and rate limits contain failure.

Calls run behind timeouts and bounded retries, and an agent that misbehaves can be rate-limited before it burns through a customer's tokens — so one bad client doesn't degrade the rest.

Built for accountability, not just access.

When an AI agent acts on your behalf inside a government system, the question from finance and compliance is the hard one: how do you prove what it did? Apier was built so that question has a clean answer. Every call an agent makes through the platform is recorded the moment it happens — not reconstructed afterwards from scattered logs, but written as it runs. Each record captures the request that went out, the agency it reached, and the response that came back, tied to the identity and the delegated capacity the agent was acting under. The point isn't to collect data for its own sake. It's that when someone asks who filed this, under whose authority, and on what date, the platform can show them, line by line, instead of asking you to take it on trust. That record exists from the first call — which matters, because a history of who did what can't be backfilled credibly once it's the thing you need.

That record is tamper-evident by design. The audit log is append-only: entries can be added but never quietly edited or deleted, enforced at the database level rather than left to application code that could be bypassed. Alongside each action, Apier keeps the inputs the decision was based on — the company's state and the rules in force at that moment — so a filing can be explained in the terms that applied when it was made, not the terms that happen to apply today. When a live, gated submission returns a receipt or confirmation from a government system, that raw response is stored too. For a compliance officer, that's the difference between a system that says it did the right thing and one that can hand you the evidence — the snapshot, the rule version, and the agency's own acknowledgement — when an auditor or a client asks.

Accountability also means an agent can't quietly do damage. Before anything is submitted, a call can be run as a dry-run that shows exactly what it would send. Actions that warrant a human decision can be held behind an approval step, so automation prepares the work and a named person releases it. And because requests are idempotency-protected, a retry after a network hiccup returns the original result rather than filing a second time — the kind of silent duplicate that's painful to unwind. None of this slows your team down day to day; it's the quiet machinery that lets you hand work to an agent and still answer for every action it takes, months later, in front of whoever is asking.

Sovereign friction is real and Norway should win from it.

Altinn, Brønnøysund, and Skatteetaten are world-class public infrastructure. But AI agents can't reason about Norwegian delegation rules, compliance deadlines, or entity obligations — because nobody has translated them into a machine-readable layer. That's the gap Apier.no fills. Apier.no translates Norwegian regulatory reality into structured API responses any agent can act on.

• EU data residency

  Database: Stockholm, live. Compute: Vercel EU edge today; full-EU backend before real company data flows.

• Open audit trail

  Every Rulebook evaluation and every write action is recorded in an append-only audit log, scoped to the consumer that made the call. The schema is public; operators can introspect what they're signing up for before they sign.

• Versioned Rulebook

  Every rule is stored as data, not code, and ships with a `_meta.rulebook_version`. A rule change is a DB operation, not a release — and a lovdata.no-source-change alert loop watches for the upstream regulatory drift that would invalidate it.