Skip to main content
POST

Authorizations

​
Authorization
string
header
required

Source-bound WorkOS API key or configured machine OIDC token. OIDC webhook management requires karsa:webhooks:manage.

Headers

​
Idempotency-Key
string
required

Stable source submission identifier, unique for this source and route

Required string length: 1 - 200
Example:

"01J9ZQ2YD15Y2YZ5H0W3J7D3E2"

Body

application/json
​
externalId
string
required

Stable source identity for this immutable control version.

Required string length: 1 - 240
​
controlId
string
required

Stable source control identity shared by all of its versions.

Required string length: 1 - 240
​
controlVersion
string
required

Source-owned control version or release identifier.

Required string length: 1 - 240
​
obligationRefs
string[]
required

Authoritative policy or regulatory obligations addressed by this control.

Required array length: 1 - 50 elements
Required string length: 1 - 240
​
policyVersion
string
required
Required string length: 1 - 240
​
owner
string
required
Required string length: 1 - 240
​
controlType
enum<string>
required
Available options:
SCREENING,
DOCUMENT,
ACTIVITY_MONITORING,
ENHANCED_TREATMENT,
WARNING_REVIEW,
RFI,
OTHER
​
effectiveFrom
string<date-time>
required
​
cadence
string
required

Human-readable expected cadence, such as CONTINUOUS or MONTHLY.

Required string length: 1 - 240
​
configured
boolean
required
​
scheduled
boolean
required
​
scopeFingerprint
string
required

SHA-256 of the canonical covered population and subject scope.

Pattern: ^[a-f0-9]{64}$
​
depthFingerprint
string
required

SHA-256 of the canonical checks, categories, and evidence depth.

Pattern: ^[a-f0-9]{64}$
​
configurationFingerprint
string
required

SHA-256 of the canonical source configuration after secrets are removed.

Pattern: ^[a-f0-9]{64}$
​
effectiveAt
string<date-time>
required
​
provider
string | null
Required string length: 1 - 240
​
effectiveTo
string<date-time> | null
​
schedule
string | null

Optional source schedule or trigger expression.

Required string length: 1 - 240
​
costMinorUnits
integer | null
Required range: 0 <= x <= 9007199254740991
​
costCurrency
string | null
Pattern: ^[A-Z]{3}$
​
providerDetails
object | null

Optional bounded source metadata. Credentials and signed URLs are rejected.

Response

The identical source monitoring control already exists

​
outcome
enum<string>
required
Available options:
CREATED,
EXISTING
​
resourceId
string
required
Minimum string length: 1
​
observedAt
string<date-time>
required