Setup

Provision a GovBridge endpoint for a public-sector organisation, store the backend credentials and connect the bridge in SovrGPT.

Setup happens in two steps: a platform admin provisions the endpoint, then the bridge token that is shown once is stored in the public-sector organisation.

Prerequisites

The organisation has the entitlement public-sector connectors (unlocked by a platform admin). Without the entitlement, the org is marked in the form as "⚠ without public-sector entitlement".
GOVBRIDGE_ENCRYPTION_KEY (32-byte base64) is set on the server — otherwise provisioning is disabled.
Depending on the protocol, a reachable backend with a service account (basic or OAuth2 client credentials):
- CMIS: a CMIS 1.1 browser-binding endpoint of the DMS.
- FIT-Connect: a Submission API v2 instance (FITKO) with the destinations you want to submit to.

Step 1 — provision the endpoint

Under Sidebar → Platform admin → GovBridge (/admin/govbridge), fill in the form "Provision new endpoint":

Field	Meaning
Organisation	The target org the endpoint belongs to.
Protocol	`CMIS (DMS/case file)` or `FIT-Connect (delivery)`.
Backend base URL	For CMIS the browser-binding endpoint of the DMS (service document); for FIT-Connect the Submission API v2 instance.
Write access	Enables the write tools (`allow_writes`). Default: off.
Auth mode	`OAuth2 client credentials` (default) or `Basic`.

Depending on the auth mode, additionally:

Basic: username + password of the DMS service account.
OAuth2 client credentials: token URL (https), client ID, client secret and optionally a scope (e.g. cmis.read cmis.write).

On submit, the platform automatically generates an opaque slug and a bridge token, encrypts the backend credentials (AES-256-GCM) and creates the endpoint row.

Step 2 — secure the bridge token

Immediately after creation, the bridge token is shown once ("New GovBridge token – visible only now"). Copy this value straight away:

Only its SHA-256 hash is stored — the plaintext cannot be retrieved afterwards.
If it is lost, the endpoint has to be re-provisioned (or a new token generated).

Step 3 — connect it in SovrGPT

The endpoint is reachable through the two factors:

URL: https://govbridge.sovrgpt.com/<slug>/<protocol> (e.g. …/abcd1234/cmis).
Header: Authorization: Bearer <bridge-token>.

In the public-sector org, this MCP endpoint is added like any other MCP server (see Connecting your own systems and MCP server). The tools matching the protocol then appear in the composer:

CMIS → cmis_*: search case files, read metadata and content and — when write access is enabled — file and move documents.
FIT-Connect → fit_*: check destinations and — when write access is enabled and after confirmation — submit applications.

Testing the endpoint

A quick MCP initialize handshake confirms reachability and the token:

curl -s https://govbridge.sovrgpt.com/<slug>/<protocol> \
  -H "Authorization: Bearer <bridge-token>" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18"}}'

<protocol> is the provisioned protocol (cmis or fit-connect) and must match exactly. Expect a JSON-RPC response containing serverInfo.name ("GovBridge CMIS" or "GovBridge FIT-Connect"). A 401 means the slug or the token does not match (which factor it was is deliberately not revealed).

Administration & revocation

The admin dashboard lists all endpoints (without secrets) — including slug, protocol, token prefix, auth mode, write flag and status. An endpoint can be deactivated or revoked; revoked rows are no longer resolved by the bridge. Every action is recorded in the audit log.