Sources

The Sources endpoint lets an external integration submit a new governed source version into the workspace. Use it when your organization monitors official sites, legal feeds, regulator portals, or internal source repositories outside Novantra and wants Novantra to record the source truth with an auditable import receipt.

The endpoint imports a governed source version and records its truth with an auditable receipt. Applicability review, obligation mapping, control creation, evidence requirements, and posture updates are governed workspace workflows where your team reviews scope, rights, classification, and applicability.

For shared conventions (auth, errors, idempotency, ID format, and mutation reasons), read v1 conventions first.

Scope required

Endpoint	Scope
Create source import	`governance.sources:write`

Endpoint

Import a source version


POST /api/v1/governance/sources/imports
Authorization: Bearer <access-token>
Content-Type: application/json
Idempotency-Key: official-feed-2026-06-05-circular-42


{
  "externalCorrelationId": "official-feed-2026-06-05-circular-42",
  "importSource": {
    "system": "official-feed-monitor",
    "retrievedAt": "2026-06-05T08:15:00.000Z"
  },
  "authority": {
    "authorityKey": "example-authority",
    "authorityName": "Example Authority",
    "authorityKind": "regulator",
    "trustLabel": "customer_managed_source"
  },
  "source": {
    "sourceKey": "example-authority-circular-42",
    "sourceKind": "circular",
    "title": "Circular 42: Updated reporting expectation",
    "description": "Summary prepared by the customer-owned integration.",
    "rightsPolicy": {
      "canStoreReference": true
    },
    "classification": {
      "label": "public"
    }
  },
  "version": {
    "versionKey": "2026-06-05",
    "versionLabel": "Published 2026-06-05",
    "sourceUrl": "https://example.gov/circulars/42",
    "effectiveAt": "2026-07-01T00:00:00.000Z",
    "sourceHash": {
      "algorithm": "sha256",
      "value": "f3b1..."
    },
    "status": "accepted"
  },
  "reasonForChange": "Imported from the approved official-feed monitor after a detected regulatory source update."
}

Response: the accepted import batch, receipt, source authority, source item, and source version identifiers.

Use a stable Idempotency-Key and externalCorrelationId for every source import. Retries with the same key return the original receipt instead of creating duplicate source records.

Field notes

`authority`

The issuing or owning authority for the source. The authority can be a regulator, standards body, customer-owned internal policy body, or another tenant-defined issuer. Novantra does not hardcode a regulator or framework vocabulary.

`source`

The source item being tracked, such as a circular, law, standard, guideline, customer policy, or internal source. sourceKind is tenant-defined text so your organization can choose the categories it actually uses.

`version`

The specific version or publication instance. Include dates and a sourceHash when your integration can calculate one. Include sourceUrl only when the URL is safe for your users to open and does not require secret-bearing query strings.

`rightsPolicy` and `classification`

Use these snapshots to describe whether the source can be referenced, stored, indexed, or redistributed according to your organization’s policy. Keep these fields concise; do not send secrets, credentials, or raw protected document content.

What the import does

The import records source truth and creates an auditable receipt for the submitted version. From there, deciding applicability, creating obligations and controls, defining evidence requirements, setting framework posture, and indexing source text for AI assistance are explicit governed workflows in Novantra, so your team reviews scope, rights, classification, and applicability before any downstream changes.

Real-case integration: monitoring official circulars

A healthcare organization runs a small customer-owned monitor for official circular pages in its jurisdiction. When the monitor detects a new circular, it submits the source metadata to Novantra:

The monitor calculates a stable external correlation ID from the issuer, circular reference, and publication date.
It records the authority and source item using tenant-owned keys.
It submits the source URL, effective date, and hash through POST /api/v1/governance/sources/imports.
Novantra returns an import receipt.
The compliance team reviews the imported source inside the workspace and decides whether it affects obligations, controls, evidence, posture, or work assignments.

This keeps official-source monitoring automated while preserving human governance for applicability and compliance impact.

Governance reference - all v1 governance endpoints.
v1 conventions - request, response, and idempotency rules.
Authentication - service accounts and scopes.
Governed sources user guide - using source records in the workspace.