Developers

For integrators building on top of Novantra: ingesting governance records into a warehouse, pushing findings from scanners, wiring submission events into a regulator portal, or building a custom dashboard against Novantra data.

If you’re starting from zero, Getting Started walks you from “I have a workspace” to “I made my first call” in about thirty minutes.

Where the API lives

The public API is at /api/v1/.... It is curated, versioned, and scope-token authenticated. It is not a re-export of Novantra’s internal application routes; those are unstable and not for external use.

See REST API for the section index, or jump straight to:

• v1 conventions for the shape every endpoint follows.
• Authentication for service accounts and OAuth.
• Versioning for the deprecation contract.
• Errors for the error envelope and idempotency keys.
• Rate limits and Pagination.
• Webhooks for outbound notifications instead of polling.
• Governance reference for the per-module endpoint reference.

What v1 covers today

Reads across the v1-scope foundation modules: Frameworks, Controls, Risks, Evidence, Assessments, Findings, Exceptions, Monitoring, Indicators, Submissions, Assets, Party Engagements, Change Management, Vulnerability Management.

Targeted writes where an external system is the natural source: creating Findings from scanners, creating Evidence claims with attachments, posting Submission package events.

Webhooks for important state transitions on Findings, Evidence claims, Submission packages, and Assessments.

Administrative operations

Organization administration, member and role management, license operations, billing, key management, and backup and restore are performed in the Novantra application UI.

Integrating at scale

Integrators authenticate with the client-credentials flow (see Authentication) and page through large result sets using standard Pagination. For high-volume warehouse ingest patterns, work with your account team to design the right integration path.