Skip to content

Getting started

Base endpoint

Authentication

Request API Key here or by phone +4570131410.
Once you've received an API Key, authentication will happen by header verification.

The API key must have an API user configured on the company in the admin panel (company edit). That user must have the company as their primary company. If no API user is set, or the user is invalid, the API returns 403 Forbidden.

All HTTP requests require the following headers to be set.

Headers

X-Api-Key: YOUR-API-KEY X-Api-Company: COMPANY-NUMBER (optional)

Acting as another company

You may optionally send X-Api-Company with a company number (kundenummer / NAV customer number) to execute the API call in the context of that company instead of the company that owns the API key.

  • Use the customer number as shown in the admin panel, including leading zeros (for example 02101). Do not send the internal company ID.
  • The API key must have been granted access to the requested company by an administrator (via company edit in the admin panel).
  • The company that owns the API key is always allowed implicitly — you do not need to configure access to itself.
  • When this header is sent, the request is logged for audit purposes.
  • If the API key is not allowed to act as the requested company, the API returns 403 Forbidden.
  • If the requested company does not exist or the header value is invalid, the API returns 400 Bad Request.

Multi-company GET without X-Api-Company

When X-Api-Company is omitted, the API returns merged data for all companies the API key may act as.

To scope a request to a single company, send X-Api-Company with the desired company number.

Car brands and models

When requesting a price (POST order/price) or creating an order (POST order), you must use exact brand and model names from the GET cars endpoint.

  • Call GET /cars first to retrieve the list of supported brands and their models.
  • Use a brand name as the car field and a model name as the model field in your request body.
  • Brand and model matching is case-insensitive, but spelling must match exactly — free-text values are rejected or may fail price calculation.

Cars response structure

{
    "data": {
        "Audi": ["A3", "A4", "Q5"],
        "BMW": ["320", "520", "X5"]
    }
}

Usage in order/price and order/create

{
    "car": {
        "car": "Audi",
        "model": "A4"
    }
}

If you submit an unknown brand or model when creating an order, the API returns 422 Unprocessable Entity with an error pointing you to GET /cars. For price requests, an invalid combination may result in a failed price calculation because no price category can be found for the given brand and model.

See also: Get cars

Response handling

The server expects you to send valid JSON throughout your bodies and will fail if not properly configured.

Response variations

If your request for any reason cannot be processed a matching HTTP Status Code greater than 400 will always be returned. Inspect the response payload for further information.

{
    "errors": Array|Object
}

Should your request successfully execute a proper status code will be returned.
200 if your request was succesful fetching the resource.
201 if your POST request was successfully executed and stored.

{
    "data": Array|Object
}

Parameter association

  • GET requests can't contain a body. The parameters should only be provided through the query.
  • POST requests must contain a body with the expected values associated.

Throttling

A maximum of 500 request pr minute is allowed.
Should you exceed this rate limit a 429 will be thrown.