# Capability matrix This matrix is the source-of-truth overview of the SDK's public service namespaces. Method signatures and return types are exported from the package root and documented by TypeDoc. Access labels mean: - **Anonymous:** no credential or caller identity is required. - **Identification required:** a meaningful application identity is required, but no secret is used. - **Free registration required:** the named method requires a self-service provider credential. - **Third-party anonymous:** no identity is required, but the endpoint is independently operated and is not an official government data source. The opt-in live suite uses low-volume representative contract probes across the source adapters and composed profiles, including one-item, one-page probes for every public iterator. It does not exercise every method, parameter combination or upstream response variant. HydAPI probes also require a separately supplied free key. The suite is scheduled weekly for authorized repository maintainers — see [Testing](testing.md). | Source | Namespace | Public methods | Access type | Required configuration | Licence or terms | Runtime validation | Live-probe status | Known limitations | | ---------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------- | | Brønnøysundregistrene | `companies` | `get`, `search`, `searchAll`, `getSubEntity` | Anonymous | None | NLOD 2.0; attribution required | HAL/JSON is Zod-validated before normalization | Representative probes pass | Search is limited to 100 entities per SDK page; `searchAll` remains caller-bounded. | | Statistics Norway / SSB | `statistics` | `getTableMetadata`, `query`, `queryRaw` | Anonymous | None | CC BY 4.0; credit SSB | Metadata and JSON-stat2 are Zod-validated and parsed into typed tables | Representative probes pass | Provider limit is 800,000 cells and 30 queries per 60 seconds per IP. | | Folkehelseinstituttet / FHI | `health` | `getSources`, `getTables`, `getTableMetadata`, `getTableDimensions`, `query`, `queryRaw` | Anonymous | None | Open API; per-bank terms; credit FHI and the publishing register | JSON and JSON-stat2 are Zod-validated; suppression flags are preserved with their legend | Representative probes pass | Suppressed cells return `flag` with `value: null` and must stay suppressed downstream. | | Kartverket | `addresses` | `search` | Anonymous | None | Dataset-specific Geonorge terms | Address responses are Zod-validated before normalization | Representative probes pass | County filtering is local after at most one provider page. | | Kartverket | `places` | `search`, `nearby` | Anonymous | None | Dataset-specific Geonorge terms | Place-name responses and coordinates are Zod-validated | Representative probes pass | Nearby radius is capped at 5,000 metres. | | Entur | `transport` | `autocomplete`, `departures`, `journeys` | Identification required | `applicationName`, sent as `ET-Client-Name` | NLOD; credit Entur and relevant transport authorities | Geocoder and GraphQL responses are Zod-validated; GraphQL errors are surfaced | Representative probes pass | Result sizes are bounded and provider GraphQL cost controls still apply. | | MET Norway | `weather` | `forecast`, `current` | Identification required | `applicationName` and `contactEmail` in the User-Agent | NLOD 2.0 and CC BY 4.0 unless product terms differ | Locationforecast GeoJSON and timeseries are Zod-validated | Representative probes pass | Locationforecast is an automated forecast with no SLA. | | Cross-provider composition | `profiles` | `company`, `address` | Anonymous; richer with identification | None; `applicationName`/`contactEmail` add weather and roads | Inherits the terms of every underlying provider | Components retain source/status; hazards use structured administrative matches | Representative probes pass | Warning matches are not an all-clear; optional provider failures degrade to `provider-error` components. | | Data.norge | `catalog` | `search`, `searchAll`, `getDataset`, `getDataService`, `getPublisher` | Anonymous | None | Resource-specific rights and licences | Search/resource JSON is Zod-validated; publisher RDF/Turtle is validated and parsed | Representative probes pass | The search API is documented as internal; multi-type paging has a 100-position window. | | Norges Bank | `currency` | `getExchangeRate`, `getExchangeRates`, `getPolicyRate`, `getNowa` | Anonymous | None | Norges Bank reuse terms; source attribution required | Text responses and parsed CSV rows are strictly validated | Representative probes pass | Unbounded latest cross-rates inspect only each series' 10 newest observations. | | Stortinget | `parliament` | `getRepresentatives`, `getRepresentative`, `getParties`, `searchCases`, `searchCasesAll`, `getCase`, `getVotes`, `getQuestions`, `getMeetings` | Anonymous | None | NLOD; credit Stortinget and avoid misleading presentation | Allowlisted Zod schemas validate JSON and strip unsupported person fields | Representative probes pass | Case filtering and pagination occur locally after one full session export. | | Statens vegvesen / NVDB | `roads` | `getRoadObjectTypes`, `getRoadObjectType`, `searchRoadObjects`, `searchRoadObjectsAll`, `getRoadObject`, `getRoadNetwork`, `getRoadNetworkAll` | Identification required | `applicationName`, sent as `X-Client` | NLOD; credit Statens vegvesen | JSON is Zod-validated; dynamic values remain `unknown`; sensitive metadata is filtered | Representative probes pass | Opaque continuation markers and dynamic values remain provider-defined. | | NVE | `energy` | `getReservoirStatistics`, `getHydropowerPlants`, `getWindPowerPlants`, `getPowerPlants` | Anonymous | None | NLOD; credit NVE | Reservoir and plant JSON is Zod-validated with numeric and date constraints | Representative probes pass | Endpoints expose the latest reservoir week and currently operational plants, not full history. | | Hva koster strømmen? (third-party) | `electricity` | `getPrices`, `getCurrentPrice` | Third-party anonymous | None | No standard licence; cite provider; ENTSO-E/Norges Bank lineage | Zod plus ordered 23/24/25-hour Oslo-day validation; negative prices accepted | Representative probes pass | Derived NOK values can differ from official NOK market publications; prices exclude fees/taxes. | | NVE / Varsom / HydAPI | `hazards` | `getFloodWarnings`, `getAvalancheWarnings`, `getLandslideWarnings`, `getHydrologyStations`, `getHydrologyObservations` | Warnings are anonymous; HydAPI requires free registration | `credentials.nve.apiKey` for stations and observations | NLOD; credit NVE and use service-specific Varsom attribution | Structured warning areas and hydrology responses are validated | Warning probes pass; HydAPI needs a key | HydAPI enforces response-size and per-key throttling limits. | > **Address-profile safety boundary:** `profiles.address().data.hazards` contains only exact > structured matches (code first, normalized name second). Municipality data is authoritative when > present; county matching is reserved for warnings with no municipality list. Forecast regions are > not matched automatically. No match must ever be treated as an all-clear. Query the complete > official Varsom/NVE services directly and follow their current guidance for any safety decision. Hva koster strømmen? is an independent third-party endpoint, not a government or official data provider. Its API page says it obtains electricity prices from ENTSO-E in EUR and converts them to NOK with the latest Norges Bank exchange rate; it also warns that its NOK values can differ from official NOK prices shown by Nord Pool. The SDK's MIT licence applies only to its source code. Returned data keeps the provider's licence, terms and attribution requirements. Protected endpoints, personal data, write operations and delegated authentication are unsupported. See [Provider terms, attribution and limits](../PROVIDERS.md) for the authoritative provider notes.