Governance reference
This section is the per-resource v1 endpoint reference. Each page below documents the endpoints, scopes, request and response shapes, and a real-case integration example for one resource.
Before drilling into a specific resource, make sure you’ve read:
- v1 conventions for the shared request and response patterns.
- Authentication for service accounts and scopes.
- Errors for the error envelope and idempotency.
What’s in v1
v1 is read-heavy. The API supports these integration patterns:
- Pull governance data into a warehouse or BI tool.
- Push findings into Novantra from external scanners.
- Push evidence into Novantra from external systems (backup logs, configuration snapshots, SBOM exports).
- Record submission package status callbacks from regulator portals.
- Import customer-managed source updates from official-site monitors, legal feeds, or internal source repositories.
| Resource | Read | Write |
|---|---|---|
| Frameworks | yes | read-only |
| Controls | yes | read-only |
| Risks | yes | read-only |
| Evidence | yes | create claim with attachments |
| Assessments | yes | read-only |
| Findings | yes | create, update status |
| Sources | via import callbacks | import source version |
| Exceptions | yes | read-only |
| Monitoring | runs and result items | read-only |
| Indicators | yes | read-only |
| Submissions | yes | record package events |
| Assets | yes | read-only |
| Party Engagements | yes | read-only |
| Change Management | yes | read-only |
| Vulnerability Management | yes | read-only |
The governance modules and their workflows are documented in the governance user guides. If your integration needs programmatic access to a resource not listed above, raise it with your account team.
Scopes summary
Read scopes use the pattern <resource-module>:read. Write scopes use <resource-module>:write. The full catalogue lives on the Authentication page.
The least-privileged token an integration can hold is one with exactly the scopes it uses. A read-only warehouse loader needs governance.controls:read governance.risks:read (and similar) and nothing else.
Webhook coverage
Resources with corresponding webhook events:
- Findings (
finding.created,finding.updated,finding.closed) - Evidence claims (
evidence.claim.created,.approved,.rejected) - Submissions (
submission.package.status_changed,submission.package.event_recorded) - Assessments (
assessment.completed)
See Webhooks for the full event catalogue, payload shape, signature verification, and delivery semantics.