CANCanada has no AI Act — and four privacy regulators applied existing law to OpenAI anywayQCQuébec's automated-decision duty has applied since 22 September 2023 — notice at the decision, explanation on requestONOntario employers with 25+ staff must say when AI screens applicants — in force 1 January 2026CANFederal institutions and their vendors: the Directive on Automated Decision-Making, amended June 2025CAN2 bills would change all of this — C-36 and C-34 — and neither has passed

Connect GOVERNBOX.ai to the tools you already run

Each integration below says which plan it needs, who sets it up, and exactly where to click.

REST API

Read: Starter+ · Write: Pro+

Read and write your governance records — AI use cases, risks, incidents, vendors, AI systems and more — from your own scripts and tools.

Set up by: An Admin or Owner

  1. Go to Settings › Admin Console › Integrations and find the API keys card.
  2. Give the key a name and choose its scope: read only, or read and write.
  3. Click Create key and copy it right away. It is shown once.
  4. Send it as a bearer token on every request. Each key may make 300 reads and 60 writes a minute. There are no delete calls.
Base URL
https://api.governbox.ai/api/v1
Header
Authorization: Bearer gbx_…
Reference
https://api.governbox.ai/api/v1/machine-docs

Outbound webhooks

Pro+

Get a signed HTTPS message in your own system the moment something changes: a use case is created, a risk is logged, an incident opens or closes, a document is approved, and more.

Set up by: An Admin or Owner

  1. Go to Settings › Admin Console › Integrations and find the Webhooks card.
  2. Enter your endpoint's address (it must start with https://) and a description.
  3. Tick the events you want. Leave them all unticked to receive every event.
  4. Click Add endpoint and copy the signing secret. It is shown once.
  5. Click Send test to send a ping. Failed deliveries are retried automatically.
Signature header
X-Governbox-Signature: t=<unix time>,v1=<hex>
How to verify
HMAC-SHA256 of "<t>.<raw body>" with your signing secret (the same scheme Stripe uses). Reject anything older than 5 minutes.
Deduplicate on
X-Governbox-Delivery

Zapier, Jira, ServiceNow or any webhook

Pro+

Let another system file an AI-tool request — a Jira ticket, a ServiceNow request, a form — straight into your Staff Reports queue, where an Admin approves or dismisses it.

Set up by: An Admin or Owner creates the key

  1. Create a read-and-write key under Settings › Admin Console › Integrations.
  2. In your tool, add a step that sends a POST to the intake address with the key. In Zapier, use Webhooks by Zapier › Custom Request.
  3. Set source to zapier, jira, servicenow, webhook, email or other, and send your own ticket number as the external reference. Sending the same one twice updates the request instead of duplicating it.
  4. Requests appear under Inventory › Staff Reports.
Address
POST https://api.governbox.ai/api/v1/intake/connector

Okta, Google Workspace, Microsoft Entra, Netskope, Zscaler, Cloudflare One

Pro+

Upload the app list from your identity provider or CASB. The AI tools in it join your AI Discovery review queue, so shadow AI is found from the systems you already run.

Set up by: An Admin or Owner

  1. Export the app list from your platform. Okta: Reports › App Usage or the Applications export. Google Workspace: Admin console › Reports › Apps reports › Third-party app access › Download. Microsoft Entra: Enterprise applications › Usage & insights, or Defender for Cloud Apps › Discovered apps. Netskope, Zscaler and Cloudflare One: the Shadow IT or application discovery export.
  2. In GOVERNBOX.ai, go to Inventory › AI Discovery and open the Discovery+ import tab.
  3. Choose the platform and drop in the CSV or Excel file.
  4. To send it on a schedule instead, POST the rows (up to 5,000 at a time) with a read-and-write key.
Scheduled push
POST https://api.governbox.ai/api/v1/ai-discovery/imports/connector

OpenTelemetry (AI agent signals)

Pro+

Point a second exporter at GOVERNBOX.ai and each AI agent's daily runs, tool calls, human overrides, guardrail trips and failures appear on its record. We keep the counts and store no spans.

Set up by: An Admin or Owner creates the key

  1. Create a read-and-write key under Settings › Admin Console › Integrations.
  2. Under Inventory › AI Agents, set each agent's External id to the agent id or name your traces carry.
  3. Add an OTLP/HTTP exporter (protobuf or JSON; gRPC is not accepted). In the OpenTelemetry Collector, use the otlphttp exporter.
Endpoint
https://api.governbox.ai/api/v1/agents/signals/otlp
Header
Authorization: Bearer gbx_…

MCP server for your own AI agents

Read: Starter+ · Write: Pro+

Give your own AI agents read access to your governance records, and on Pro let them file incidents, risks and intake requests into the same queues your people review.

Set up by: An Admin or Owner creates the key

  1. Create a key under Settings › Admin Console › Integrations: read only, or read and write.
  2. Add the address to any MCP client that supports Streamable HTTP with a bearer token.
  3. For a client that only runs local servers, use mcp-remote: npx mcp-remote <address> --header "Authorization: Bearer gbx_…"
Address
https://api.governbox.ai/api/v1/mcp

Zoom, Microsoft Teams and Google Meet transcripts

Every plan

Bring a governance meeting's transcript or AI summary into the meeting's record. You upload the file; nothing connects to your meeting account.

Set up by: Anyone who can edit meetings

  1. Download the transcript from your meeting tool (.vtt, .txt or .docx), or copy its text.
  2. In GOVERNBOX.ai, go to Governance › Governance Meetings and open the meeting.
  3. Use Import meeting notes to upload the file or paste the text.

Need a connection that is not listed?

Tell us what you run and we will tell you how it connects.

See plans →Talk to us