Altinn — the government services and reporting platform

Altinn is the Norwegian government's digital gateway. For newcomers: picture a tax portal extended to ALL of government — a single site where a company files its VAT, its SAF-T, its annual accounts and hundreds of other forms. Launched in 2003, Altinn is the official channel for reporting obligations; for experts, it is also an API-first platform that ERPs connect to directly.

History — from 2003 to Altinn 3

Altinn was born in 2003 out of a drive to pool company filings across Skatteetaten, Brønnøysundregistrene and the statistics office (SSB). Rather than each agency building its own portal, Norway created a shared gateway. Altinn 2 (2010) industrialised the scaling; Altinn 3 (from 2018-2020) turned it into a cloud, API-first platform where business services are reusable "apps".

text altinn-timeline.txt

2003       | Altinn launched — a shared digital gateway for company
           | filings (VAT, taxes, statistics). Co-driven by Skatteetaten,
           | Brønnøysundregistrene, SSB.
           |
2010       | Altinn 2 — technical overhaul, higher load capacity,
           | stronger authentication services.
           |
2014       | ID-porten becomes the state's common authentication base
           | (BankID, Buypass, Commfides).
           |
2018-2020  | Migration to Altinn 3 — cloud platform, API-first, reusable
           | components (Altinn Apps, Altinn Authorization).
           |
2022       | The code-based MVA-melding (SAF-T VAT codes) is filed via
           | Altinn / API.
           |
2024-2026  | Altinn 3 generalised. VAT reporting, SAF-T, annual accounts
           | and hundreds of business services run through the platform.

Governance — Digdir + agencies

Altinn is run by Digdir (Digitaliseringsdirektoratet — Agency for Digitalisation), which provides the platform and the common building blocks (ID-porten, Maskinporten, Altinn Authorization). The "service owner" agencies (Skatteetaten for VAT and SAF-T, Brønnøysundregistrene for annual accounts, SSB for statistics) publish their forms and APIs on the platform.

Architecture — ID-porten, forms, API

Altinn 3 is built around three blocks:

ID-porten / Maskinporten — authentication: ID-porten for users (BankID), Maskinporten for machine-to-machine access (OAuth2 bound to the org.nr).
Altinn Apps — each reporting service is an application (form + validation + workflow) deployed by the owning agency.
Altinn Authorization — role management: who may sign or file on behalf of which company (org.nr).

text altinn-api.txt

# Altinn — filing an MVA-melding via API (conceptual sketch)

POST https://platform.altinn.no/storage/api/v1/instances
Authorization: Bearer <ID-porten / Maskinporten token>
Content-Type: application/json

{
  "appId": "skd/mva-melding",
  "instanceOwner": { "organisationNumber": "991825827" },
  "dataValues": {
    "periode": "2026-03",
    "kildesystem": "ERP-X 4.2"
  }
}

# Machine-to-machine authentication: Maskinporten issues an
# OAuth2 token bound to the organisasjonsnummer + service scope.

Altinn vs Nordic gateways

Country	Gateway	Auth	Model
Norway	Altinn	ID-porten / Maskinporten	Shared API-first platform
Sweden	Bolagsverket + Skatteverket	BankID	Per-agency portals
Denmark	Virk.dk / NemHandel	MitID	Shared portal
Finland	OmaVero / Suomi.fi	Suomi.fi-tunnistus	Shared portal
Estonia	X-Road / eMTA	ID-kaart	Decentralised bus

Adoption — de facto single gateway

Near-universal. The vast majority of Norwegian companies interact with the state through Altinn.
ERP integration. Accounting software files directly via API (Maskinporten), with no manual entry.
Multi-agency. VAT, SAF-T, annual accounts, a-melding (payroll): a single entry point for dozens of obligations.
Representation roles. An accounting firm can file on behalf of its clients thanks to Altinn Authorization.

Common pitfalls

Confusing Altinn and PEPPOL. Altinn = filings to the state; PEPPOL/EHF = invoices. Two distinct channels.
Forgetting Altinn Authorization roles. Without delegation, an ERP or firm cannot file on behalf of the company.
Wrong Maskinporten scope. Each service requires a precise OAuth2 scope; a token too broad or too narrow is rejected.
Testing in production. Altinn provides a test environment (TT02) — using it avoids polluting real data.
Assuming "Altinn = Difi". Governance moved to Digdir; historical docs under Difi may be stale.

Foundations

Standards

Flagship messages

Tools