Migration
The migration tool brings a customer’s existing records from a legacy system into their new Veona tenant. You connect to the source, map its fields to Veona’s, run a safe dry-run, then commit — with reconcile and rollback to keep it honest.
Who can do this:
- migration_engineer — the full tool: connections (including sealed credentials), templates, and the job lifecycle.
- onboarding — may read and run migrations during white-glove onboarding, but cannot edit mapping templates or manage sealed credentials.
The migration screens live under migration/.
Source connections
Section titled “Source connections”A connection points at a legacy source (for example, a CSV export).
- List connections (
migration/connections). - Create a connection (
migration/connection-new). Source credentials are sealed in the vault and never echoed back — you only ever see whether a secret is set. - Probe the connection (
POST /migration/connections/:id/probe). The live ETL service reaches the source and profiles it, reporting real reachability and true row/column counts. An unreachable source reportsunreachablehonestly — nothing is fabricated. - Edit, archive, or rotate the secret as needed; every change is audited.
Mapping templates
Section titled “Mapping templates”A template maps the source’s fields to Veona’s data model.
- List templates (
migration/templates). - Create or edit a template in the mapper pane (
migration/template-new/-edit/:id). Templates are versioned and immutable once published (v1 → v2). Editing requiresmigration.template.write— onboarding cannot.
The job lifecycle
Section titled “The job lifecycle”A migration job runs a connection through a template into the target tenant:
- Create the job (the wizard at
migration, orPOST /jobs). - Validate (
POST /jobs/:id/validate) — the ETL computes real pass/fail counts over the source. - Dry-run (
POST /jobs/:id/dry-run) — projects what would load and writes nothing. Use this to preview before committing. - Commit (
POST /jobs/:id/commit) — the ETL drives records across the bridge into the tenant’s EHR. Records that can’t be loaded are parked for review. - Reconcile (
POST /jobs/:id/reconcile) — confirms the counts balance. - Resolve parked records, or pause/resume.
Rollback
Section titled “Rollback”A committed job is reversible: rollback (POST /jobs/:id/rollback) removes the loaded records cross-plane — they disappear from the tenant’s clinical app. Rollback is gated and audited.