diff --git a/Koha/REST/V1/Biblios.pm b/Koha/REST/V1/Biblios.pm
index a4d50e3800..c9d59e5860 100644
--- a/Koha/REST/V1/Biblios.pm
+++ b/Koha/REST/V1/Biblios.pm
@@ -22,6 +22,7 @@ use Mojo::Base 'Mojolicious::Controller';
 use Koha::Biblios;
 use Koha::DateUtils;
 use Koha::Ratings;
+use Koha::RecordSources;
 use C4::Biblio qw( DelBiblio AddBiblio ModBiblio );
 use C4::Search qw( FindDuplicate );
 
@@ -720,9 +721,14 @@ sub update {
 
     my $biblio = Koha::Biblios->find( $c->param('biblio_id') );
 
-    $c->render_resource_not_found("Bibliographic record")
+    return $c->render_resource_not_found("Bibliographic record")
         unless $biblio;
 
+    return $c->render(
+        status  => 403,
+        openapi => { error => 'You do not have permission to edit a locked record' }
+    ) unless ( $biblio->can_be_edited( $c->stash('koha.user') ) );
+
     try {
         my $headers = $c->req->headers;
 
@@ -753,7 +759,52 @@ sub update {
             );
         }
 
-        ModBiblio( $record, $biblio->id, $frameworkcode );
+        my $record_source_id = $headers->header('x-record-source-id');
+
+        my $options = {
+            overlay_context => {
+                userid       => $c->stash('koha.user')->userid,
+                categorycode => $c->stash('koha.user')->categorycode,
+            }
+        };
+
+        if ($record_source_id) {
+
+            # We've been passed a record source. Verify they are allowed to
+            unless (
+                haspermission(
+                    $c->stash('koha.user')->userid,
+                    { editcatalogue => 'set_record_sources' }
+                )
+                )
+            {
+                return $c->render(
+                    status  => 403,
+                    openapi => { error => 'You do not have permission to set the record source' }
+                );
+            }
+
+            # find record source name to given id
+            my $record_source = Koha::RecordSources->search( { record_source_id => $record_source_id } )->single;
+
+            unless ($record_source) {
+                return $c->render(
+                    status  => 409,
+                    openapi => { error => 'Given record_source_id does not exist' }
+                );
+            }
+
+            $options->{'overlay_context'}->{'source'} = $record_source->name;
+
+            # this will update the record source id in biblio metadata
+            $options->{'record_source_id'} = $record_source_id;
+        }
+
+        unless ( $options->{'overlay_context'}->{'source'} ) {
+            $options->{'overlay_context'}->{source} = '*';
+        }
+
+        ModBiblio( $record, $biblio->id, $frameworkcode, $options );
 
         $c->render(
             status  => 200,
diff --git a/api/v1/swagger/paths/biblios.yaml b/api/v1/swagger/paths/biblios.yaml
index 18120c5dd9..94a5092c93 100644
--- a/api/v1/swagger/paths/biblios.yaml
+++ b/api/v1/swagger/paths/biblios.yaml
@@ -251,6 +251,7 @@
       - $ref: "../swagger.yaml#/parameters/framework_id_header"
       - $ref: "../swagger.yaml#/parameters/marc_schema_header"
       - $ref: "../swagger.yaml#/parameters/confirm_not_duplicate_header"
+      - $ref: "../swagger.yaml#/parameters/record_source_id_header"
     produces:
       - application/json
     responses:
@@ -279,6 +280,10 @@
           description: Accepted content-types
           items:
             type: string
+      "409":
+        description: Conflict
+        schema:
+          $ref: "../swagger.yaml#/definitions/error"
       "500":
         description: |
           Internal server error. Possible `error_code` attribute values: