Setting up GovBridge
Set up GovBridge: create an endpoint for the authority, store the credentials for the DMS or FIT-Connect and connect the adapter in SovrGPT.
Three steps: a platform admin creates the endpoint, the bridge token shown once is saved, and the authority's organisation connects it in the Marketplace.
Prerequisites
- The organisation has the entitlement "Behörden-Konnektoren" (public-sector connectors); otherwise the form shows "⚠ ohne Behörden-Entitlement".
GOVBRIDGE_ENCRYPTION_KEY(32 bytes, base64) is set on the server.- A reachable backend with a service account (OAuth2 client credentials or basic): for CMIS a CMIS 1.1 browser-binding endpoint of the DMS, for FIT-Connect a Submission API v2 instance (FITKO) with the destinations you want to submit to.
Step 1: provision the endpoint
Under Platform admin → GovBridge (/admin/govbridge), fill in the form
"Neuen Endpoint provisionieren". The admin area is in German; labels are shown as they
appear:
| Field | Meaning |
|---|---|
| Organisation | The organisation the endpoint belongs to. |
| Protokoll | CMIS (DMS/Akte) or FIT-Connect (OZG). |
| Anzeigename | Optional display name. |
| Backend-Basis-URL | CMIS: browser-binding endpoint of the DMS (service document). FIT-Connect: the Submission API v2 instance. https only. |
| Backend-Authentifizierung | OAuth2 (Client Credentials) (default) or HTTP Basic (Legacy). |
| Schreib-Tools erlauben | Enables the write tools (allow_writes). Off by default. |
Add the service account's username and password for basic, or the token URL
(https), client ID, client secret and an optional scope (e.g. cmis.read cmis.write)
for OAuth2.
The platform then generates an opaque slug and a bridge token and stores the credentials encrypted (AES-256-GCM).
Step 2: save the bridge token
The token appears exactly once ("Neuer GovBridge-Token – nur jetzt sichtbar.", visible only now). Copy it right away: only its SHA-256 hash is stored.
Step 3: connect it in SovrGPT
In the authority's organisation, open Marketplace and connect the template
VIS / DMS-Akte (CMIS-Adapter) or FIT-Connect (OZG-Antragszustellung). Enter
https://govbridge.sovrgpt.com/<slug>/<protocol> as the URL (e.g. …/abcd1234/cmis)
and the bridge token as the token. SovrGPT stores it encrypted and sends it as
Authorization: Bearer <bridge-token>.
Use the template rather than "Eigenen MCP-Server hinzufügen" (add a custom MCP server):
only the templates ask for approval in the chat before write actions (confirm_writes),
before each action individually, with the details shown, valid for one hour
(Approvals in the chat). The protocol's tools are then available in the composer.
Testing the endpoint
An MCP initialize handshake checks reachability and the token:
curl -s https://govbridge.sovrgpt.com/<slug>/<protocol> \
-H "Authorization: Bearer <bridge-token>" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18"}}'The response contains serverInfo.name ("GovBridge CMIS" or "GovBridge FIT-Connect").
A 401 means the slug, the token or <protocol> does not match.
Administration & revocation
/admin/govbridge lists all endpoints without secrets: organisation, protocol, URL with
slug, token prefix, write access and status. A platform admin can revoke an endpoint
there at any time; the adapter no longer resolves revoked or deactivated endpoints. If a
token is lost or a leak is suspected, revoke the endpoint and create a new one (new slug,
new token). Creating and revoking are recorded in the audit log.