This guide is for the agency administrator (role FUNDER_ADMIN) of a department or funding agency on GrantCore. Everything described here is configuration in Funder Portal → Agency Settings and Competitions & Intakes; nothing requires code. Applicant-side instructions are in the Team User Guide.
Every change described here is written to the audit log with who did it and when. Secrets (client secrets, signing secrets, API keys) are shown once at creation and never again.
| I want to… | Where |
|---|---|
| Brand the tenant, pick languages and modules | Agency Settings → Identity & branding, Languages & modules |
| Decide who may do what | Agency Settings → Roles & capabilities |
| Let staff and applicants sign in with the department’s identity provider | Agency Settings → Sign-in — institutional identity provider |
| Ask applicants for consent before they apply | Agency Settings → Applicant consent |
| Keep Protected B data on the private AI only | Agency Settings → AI & data policy |
| Push events to the ERP, warehouse or case system | Agency Settings → Webhooks & event outbox |
| Let an external system call the funder API | Agency Settings → API access — service principals |
| Write eligibility rules and test them before publishing | Competitions & Intakes → competition → Eligibility rules |
| See the agency’s operating picture in one place | Executive — Impact & Results |
Eight agency roles exist (Admin, Program officer, Competition manager, Panel chair, Reviewer, Financial oversight, Compliance officer, Auditor). What each role may do is a matrix of 14 capabilities (read the agency, write configuration, manage intake, read evaluations, read/write finance, oversight, controls, compliance, reports, analytics, agency admin). Tick to grant, untick to revoke; Admin always holds everything. The matrix is enforced by the server on every request; the audit log records every denied call with the capability that was missing.
GrantCore accepts any OpenID Connect issuer (Microsoft Entra ID, Keycloak, Okta, university IdPs). GCKey / Sign-In Canada are not OIDC issuers themselves; they can be used only through a broker your department already exposes as an OIDC provider — confirm that with your IT security group before promising it.
https://grantcore.ai/api/auth/sso/callback, and the same
path on your tenant domain if you use one.https://login.microsoftonline.com/<tenant-id>/v2.0),
the client ID and, unless the client is public, the
client secret.asc-csa.gc.ca), and decide whether unknown
identities get a GrantCore account created (Create GrantCore
accounts for new identities).What the platform does on each sign-in: authorization code with PKCE, one-time state and nonce; it adopts an existing account only when your provider asserts a verified email or the account is already linked to that identity; a different identity claiming a linked email is refused; the person becomes an applicant member of your agency; the sign-in is written to the login audit. The client secret is masked after saving and kept when you save the form again.
Declare which scopes the agency needs from an applicant (identity, researcher profile, organization identity, applications and documents, CV, funding history with other agencies) and write the privacy notice. When Require consent is on, an applicant must consent under the current notice before starting an application here; changing the notice or the scopes asks everyone to renew; an applicant may withdraw, which blocks new applications only. The applicants directory shows each person’s consent state.
Set the data classification of the agency’s records. Protected B (or Never for cloud fallback) means every agent and every AI feature runs on the private AI only; if the private AI is unavailable the request waits instead of going to a cloud provider. Every agent run records the classification in the agent ledger.
Open a competition and find Eligibility rules. A rule set is a JSON list; each rule is either
{ "rule_key": "canadian_entity", "rule_value": true, "label": "Canadian entity" },
which the platform explains to applicants in English and French, or{ "rule_key": "qc_sme", "severity": "BLOCKER", "message": "…", "message_fr": "…", "when": { "all": [ { "field": "classes", "op": "has", "value": "sme" }, { "field": "organization.province", "op": "in", "value": ["QC"] } ] } }.Expressions use field / op / value over the applicant
context (derived classes such as academic, sme, not_for_profit,
canadian; profile.*; organization.*;
has_cv) with all, any and
not. Twenty operators are available (equals, ranges,
between, list membership, has / has_any / has_all for
lists, text contains / starts with / regex, present / missing / empty).
The same grammar drives form conditions and workflow guards.
Buttons: Catalogue (operators, context fields, typed rules, an example you can insert), Validate (the server refuses what it could not evaluate; unknown typed keys become “to confirm” items and are flagged as warnings), Test (dry-run against a sample profile or a real applicant of the tenant, with the verdict and the exact context the rules saw), Simulate on applicants (who among this competition’s applicants would be ready, conditional or blocked, and which rule stops whom), History (every saved version with author, time and note; load one into the editor or restore it — a restore is a new version, nothing is deleted), Save rules. Saved rules are evaluated for every applicant in the Funding Inbox with the messages you wrote.
Add a webhook with the receiving URL and the
events it should get
(application.submitted,
application.acknowledged, noi.decided,
decision.recorded, competition.transitioned,
panel.voting.closed,
organization.signoff.decided, award.created,
or *). The signing secret is shown once.
Each delivery is an HTTPS POST with JSON
{ id, type, agency_id, entity, occurred_at, data } and
headers X-GrantCore-Event,
X-GrantCore-Delivery, X-GrantCore-Timestamp
and
X-GrantCore-Signature: sha256=HMAC-SHA256(secret, timestamp + "." + body).
Your receiver should verify the signature and answer 2xx. Failures are
retried with backoff (1, 4, 16, 64, 256 minutes) and then dead-lettered;
nothing is deleted. Event log shows every event with
its deliveries and a replay link; Test
sends a signed test event; Pause, Rotate
secret and Delete do what they say.
Template reshapes what a webhook receives. Give a
JSON object in the receiving system’s schema; any string may contain
{{type}}, {{agency_id}},
{{occurred_at}}, {{entity.id}},
{{data.<field>}} or {{now}}, and a
string that is exactly one placeholder keeps the raw value (numbers stay
numbers). Example for a payment request:
{ "vendor_ref": "{{data.application_id}}", "amount": "{{data.award_amount}}", "currency": "{{data.currency}}", "source": "GrantCore" }.
Payment bridges also get disbursement.certified (s.34),
disbursement.requisitioned (s.33) and
disbursement.erp_synced events.
Issue key creates a key for an external system. Give
it a name, an agency role (never
Admin), an optional capability allowlist, an
expiry (1–730 days) and a per-minute limit. The key
(gck_…) is shown once. The system calls the funder API with
Authorization: Bearer gck_…;
GET /api/funder/agencies/<id>/whoami confirms the
principal, its role and allowlist.
A key is pinned to your agency, limited to the funder, evaluation and impact APIs (never applicant data, billing, authentication or platform administration), cannot issue or rotate keys, and its service account cannot log in, use SSO or reset a password. Rotate issues a new key for the same principal; Revoke deactivates it and its service account. Every call and every denial is audited under the key’s service account.
The executive page opens with the Executive overview: intake pipeline (submitted, drafts, notices of intent, competitions open and closing soon, amounts awaiting decision), decisions and success rate, agreements signed and payments disbursed, scheduled payments overdue and confirmed payments lacking s.34 certification, service-standard attainment per stage, agent automation (actions, human-equivalent minutes, exceptions routed to people), awards by oversight risk tier, governance (open panel votes, pending invitations, unverified organizations, integrations health), then the impact headline and the Departmental Results tables. Platform administrators can switch the scope to Government of Canada — all departments for the departmental comparison table.
Can a service principal or a webhook receive Protected B data? Webhook payloads carry identifiers and decisions, not documents. Whether a receiving system may hold the data is your call under your AI & data policy and your privacy notice.
We rotated a secret and the receiver was not updated. Deliveries fail, retry with backoff and dead-letter; fix the receiver, then use replay on the dead deliveries.
A rule blocks everyone. Use Simulate on applicants before saving; the blocking-rules list names the rule and how many applicants it stops.
Can two agencies share one identity provider? Yes; each agency registers its own client (or the same one with both redirect URIs) and configures it in its own Sign-in section.