We use essential cookies to run this site. With your permission, we also use analytics and marketing cookies. Cookie policy
Keepnet API
The Keepnet API runs the routine work from your own tools and AI agents, and puts the results where you report.
Your HR or identity system adds and updates employees, and sets leavers inactive or deletes them, as your policy needs.
POST /api/target-usersPOST /api/target-users
Authorization: Bearer $TOKEN
{
"email": "jane.smith@example.com",
"phoneNumber": "+44 7700 900123",
"firstName": "Jane",
"lastName": "Smith",
"department": "Engineering",
"isActive": true,
"targetGroupResourceIds": ["<group id>"],
"preferredLanguageId": "0",
"managerEmail": "robert.johnson@example.com"
}SCIM, LDAP and Google Workspace sync are set up through the API too.
A new joiner or a policy change in your workflow can start an enrolment.
POST /api/enrollmentsPOST /api/enrollments
Authorization: Bearer $TOKEN
{
"trainingId": "<training id>",
"name": "Security awareness Q1",
"targetGroupResourceIds": ["<group id>"],
"languageIds": ["0"],
"awardCertificate": true,
"sendTeamsNotification": true
}Then follow progress with POST /api/enrollments/search.
Who opened, clicked or reported, per employee and per campaign, delivered to your data warehouse or BI tool on a schedule.
POST …/job-report/…/searchPOST /api/phishing-simulator/phishing-campaign-job-report/Reported/search/{resourceId}/{instanceGroup}
Authorization: Bearer $TOKEN
{
"filter": {"searchInputTextValue": "", "condition": "AND", "filterGroups": [{"condition": "AND", "filterItems": [], "filterGroups": []}]},
"pageNumber": 1,
"pageSize": 20,
"orderBy": "Email",
"ascending": false
}Swap Reported for Opened, Clicked, NoResponse or AttachmentOpened. Smishing and quishing follow the same pattern.
Your SIEM or SOAR pulls reported emails and acts on the verdicts.
POST /api/notified-emails/searchPOST /api/notified-emails/search
Authorization: Bearer $TOKEN
{
"filter": {"searchInputTextValue": "", "condition": "AND", "filterGroups": [{"condition": "AND", "filterItems": [{"fieldName": "EmailCategory", "operator": "Include", "value": "Spam,Marketing"}], "filterGroups": []}]},
"pageNumber": 1,
"pageSize": 20,
"orderBy": "CreateTime",
"ascending": false
}The same widgets as your executive reports, delivered to your own dashboards.
POST /api/executive-report/get-widget-datasPOST /api/executive-report/get-widget-datas
Authorization: Bearer $TOKEN
{
"widgetIds": ["widget-phishing-overview", "widget-training-progress"],
"datePeriod": "LastMonth"
}The same widgets your scheduled executive reports use.
Admin and service account actions export whenever a review or an auditor asks.
POST /api/audit-logs/search/exportPOST /api/audit-logs/search/export
Authorization: Bearer $TOKEN
{
"filter": {"searchInputTextValue": "", "condition": "AND", "filterGroups": [{"condition": "AND", "filterItems": [], "filterGroups": []}]},
"pageNumber": 1,
"pageSize": 25,
"orderBy": "CreateTime",
"ascending": false,
"reportAllPages": true,
"exportType": "Excel"
}MSSPs and resellers onboard a customer in one script, then run its campaigns and track renewals with the same Reseller client.
POST /api/companies, then 4 more calls# 1. Create the customer company
POST /api/companies
# 2. Optional: an API client for the customer
POST /api/companies/clients
# 3. SCIM token and URL for the customer IdP
POST /api/scim
# 4. Direct Email Creation for Microsoft 365 or Google Workspace
POST /api/companies/direct-email-settings
# 5. Make it the default delivery
PUT /api/companies/direct-email-settings/make-default/{resourceId}Steps after the first carry X-KEEPNET-Company-Id: <customer id>.
Your HR or identity system adds and updates employees, and sets leavers inactive or deletes them, as your policy needs.
Request bodies follow the published examples. As of 12 October 2026.
Each integration gets its own client, role and IP range, and switches off on its own.
Client credentials flow. The secret is shown once, at creation.
Bearer tokens expire after an hour. There is no long-lived refresh token.
Company Admin, Reseller or a custom role with only the privileges a job needs.
Restrict each client to the addresses your servers use.
Set a client to inactive and its calls stop. Other clients keep working.
Certified for information security and for AI management.
Agent actions wait for approval by default. Customer data is not used to train AI models.
Integrations keep working as the API grows. Test in a separate tenant first.
Your data stays in the region you choose: the UK, EU, US, Canada, Türkiye or the UAE. New regions open on request.
Company Settings, Rest API, New. One client per integration, so each one can be switched off on its own.
The console issues a Client ID and a Client Secret. The secret is shown once, so it goes straight to your vault.
A custom role with only the privileges the job needs decides which endpoints the client can reach. An IP allow-list limits where calls come from.
OAuth 2.0 client credentials return a bearer token that lasts one hour. Request a new one when it expires.
# 1. Token (form-encoded, not JSON)
TOKEN=$(curl -s -X POST https://api.keepnetlabs.com/connect/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=$KEEPNET_CLIENT_ID" \
-d "client_secret=$KEEPNET_CLIENT_SECRET" \
-d "scope=api1" | jq -r .access_token)
# 2. First call: your company
curl https://api.keepnetlabs.com/api/companies/my \
-H "Authorization: Bearer $TOKEN"Company Settings, Rest API, New. One client per integration, so each one can be switched off on its own.
Example data Client names are labels, and keys and addresses are placeholders. Read the quickstart
1,000+ operations, documented in one OpenAPI 3.0 specification.Keepnet OpenAPI specification, October 2026
Swipe to see more
Create and start email campaigns, then pull what each employee did.
Start smishing campaigns and pull their results.
Start quishing campaigns, resend to employees who did not open, and pull results.
Create callback scenarios and campaigns, then pull their results.
Enrol employees, follow completion and certificates, and pull survey results.
Add, import and export employees, and set up SCIM, LDAP or Google Workspace sync.
Executive and scheduled reports, gamification badges and leaderboards.
Reported emails, investigations, delete and warn actions, and analysis engines.
Queue a nudge from behaviour already recorded for an employee, and manage Power BI access.
SIEM forwarding, SAML, white labelling and sending domains.
List customers with licence details, onboard a customer and scope calls to one company.
Search and export admin and service account actions.
1 of 12
Ask these before you choose, and check each answer in the reference.
| Question | Keepnet |
|---|---|
| Can it create and change things, or only read reports? | Both. It creates and changes employees, groups, enrolments, campaigns and settings. |
| Does it cover simulations, training, reporting and response? | Yes, in one API. |
| Is it in my plan, or a higher tier? | Included in every plan. |
| Is there a machine-readable specification? | Yes, OpenAPI 3.0, with request examples. |
| Can AI assistants work with it within your controls? | Yes. They read the reference over MCP, and every call runs with your own client, its role, IP allow-list and one-hour tokens. |
| Can a partner manage many customers? | Yes. One Reseller client reaches every customer, and each call picks the customer with one header. |
Public reference and specification. No sales call needed to read them.
Credentials, token, first call and common errors.
Endpoints, request examples and try-it-out in the browser.
Generate a client in the language you use.
Connect the reference to your assistant.
# 1. Swap your Client ID and Client Secret for a token (valid one hour)
TOKEN=$(curl -s -X POST https://api.keepnetlabs.com/connect/token \
-d grant_type=client_credentials -d scope=api1 \
-d client_id=$KEEPNET_CLIENT_ID \
-d client_secret=$KEEPNET_CLIENT_SECRET | jq -r .access_token)
# 2. List your ten newest phishing campaigns
curl -X POST https://api.keepnetlabs.com/api/phishing-simulator/phishing-campaign/search \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"filter":{"searchInputTextValue":"","condition":"AND","filterGroups":[]},
"pageNumber":1,"pageSize":10,"orderBy":"CreatedDate","ascending":false}'
# Results come back in data, with status and message beside themPrefer a ready connector? See the integrations
Creates a nightly export of campaign results for your data warehouse.
Adds a step that closes a confirmed report and thanks the employee.
Enrols the week's new joiners in training, with a certificate.
Creates a nightly export of campaign results for your data warehouse.
Example session Any coding agent that supports MCP works the same way. Product names are trademarks of their owners.
https://doc.keepnetlabs.com/~gitbook/mcpAPI pricing
The API comes with every plan, along with admin accounts, SSO and SAML.
Short answers, with the detail below each one.
Yes. The Keepnet REST API covers phishing simulation, security awareness training, reporting and incident response, with 1,000+ operations in one OpenAPI 3.0 specification.
It comes with every Keepnet plan.
An admin creates an API client under Company Settings, Rest API. Keepnet issues a Client ID and a Client Secret in place of a single API key, and the secret is shown once.
Pick a role for the client, limit it to your IP addresses, and switch it off at any time.
Send the Client ID and Client Secret to POST /connect/token with grant_type=client_credentials and scope=api1.
The bearer token lasts one hour and there is no refresh token, so request a new one when it expires.
The interactive reference (Swagger UI) is at api.keepnetlabs.com/docs, with the OpenAPI 3.0 specification on the same site. The quickstart and use-case guides are on doc.keepnetlabs.com.
Most platform work. For example: add and remove employees, start simulations and training enrolments, pull campaign and training results, export audit logs and act on reported emails.
It covers email, SMS, QR code and callback phishing simulations, awareness training, reporting, incident response and company settings.
Yes. Power BI connects with DirectQuery, using SQL credentials scoped to your company that you can rotate at any time.
Other BI tools pull campaign, training and report data through the API.
Yes. Create a SCIM integration in Keepnet and your identity provider adds, updates and removes employees, with the attributes you map. The SCIM token can be rotated at any time.
LDAP and Google Workspace sync are also available.
Yes. SIEM forwarding sends Keepnet audit logs and events to Microsoft Sentinel, Splunk, QRadar or a syslog server, and you can send a test event before going live.
Your SOAR can also act on Incident Responder verdicts through the API.
There is no fixed request quota. Limits follow your organisation's usage, and a request over the limit returns HTTP 429.
Wait and retry with back-off, and reuse a token until it expires instead of requesting one per call.
Yes. The API is versioned and stays backward compatible, so existing integrations keep working as it grows.
Build and test against a test environment or a test tenant before you go live.
Not by default. Agents run in approval-gated mode: they recommend an action and run it only after an admin approves.
A system admin can turn on autonomous execution, which then runs within the operational and governance safeguards you set.
Yes, for the API reference. Connect doc.keepnetlabs.com/~gitbook/mcp to Claude, ChatGPT, Cursor, Codex or another MCP client, and it finds the right endpoint and builds the call.
The calls run with your own API client, so its role, IP allow-list and one-hour tokens limit what an agent can do.
No. The API, admin accounts, SSO and SAML come with every Keepnet plan, with no API tier or add-on.
Yes. One Reseller client reaches every customer: it lists them with licence details, onboards new ones, and picks the customer for each call with the X-KEEPNET-Company-Id header.
Partners can also list customers over their licence limit and renewals due within a window they set.
Thirty minutes, no cost and no obligation.
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tabPage reviewed