Welcome to the CanIPhish Public API (v3.0). Use it to drive your tenant programmatically — pull reporting and intelligence data (campaign results, human risk, dark‑web breaches, domain supply‑chain posture and the tenant IDs you can access) and manage configuration (campaigns, employee lists, the content library and platform settings).

Base URL

All endpoints are served under:

https://api.caniphish.com/api/v3

Every endpoint is a POST that accepts and returns JSON.

API keys

API keys are assigned to user accounts. Find yours on the User Profile page. If your account has access to more than one tenant, the same key works across all of them. If this is your first time using the API, click Refresh Key to generate one.

Authentication

Every request must include two headers:

Header	Value
`X-API-Key`	Your tenant API key (User Profile → Refresh Key).
`X-Email-Address`	The email address of the user the key belongs to.

Each successful call consumes one unit of your tenant's API quota.

Find your tenant ID

Almost every request takes a tenantID in its body. If you don't know yours, ask the API — this is the one call that needs only the auth headers:

curl -X POST https://api.caniphish.com/api/v3/account/get-tenant-access \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "X-Email-Address: you@example.com"

["tenant-abc-123", "tenant-def-456"]

Use account/get-tenant-access-detailed if you also want company names, quota usage and organisation‑level risk per tenant.

Making a request

Send the tenantID (plus any endpoint‑specific fields) as a JSON body. For example, to read your phishing campaign results:

curl -X POST https://api.caniphish.com/api/v3/reporting/phishing/get-all-campaigns \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "X-Email-Address: you@example.com" \
  -H "Content-Type: application/json" \
  -d '{ "tenantID": "tenant-abc-123" }'

Responses

Status	Meaning
`200`	Success, with a JSON body.
`400`	Authentication or validation error — `{ "Error": "message" }`.
`403`	Authorization error (role / subscription) on a gated endpoint.

What you can call

Read & reporting endpoints — tenant lookups, campaign and training reporting, employee information, dark‑web data and the domain supply‑chain scan — are available to any authenticated user with access to the tenant. Some depend on the matching feature being enabled on the tenant (for example, dark‑web monitoring).

Management / write endpoints — creating, updating, deleting or duplicating campaigns, employee lists, content‑library items and platform settings — additionally require both of the following:

the requesting user is a Platform Admin or Platform Super Admin on the tenant; and
the tenant is entitled — an active Professional or Enterprise subscription, an active Enterprise trial, or a partner‑managed tenant operating under an Enterprise master subscription.

Call account/get-entitlements to check whether the current user and tenant are allowed to make gated calls before you attempt them.

Where to next

Browse the reference by area:

My Account — entitlements, your profile, and the tenant IDs you can access.
Campaigns — create, run, duplicate and manage phishing & training campaigns, historic campaigns and per‑target actions.
Employee Lists — build and manage target lists and directory integrations.
Content Library — phishing emails, sender IDs, phishing websites, voice‑phishing templates and training modules.
Platform Settings — users, authentication (MFA/SSO), language, notifications, email delivery and more.
Reporting — campaign results, human risk, leaderboards, PDF and scheduled reports, phish‑report triage, plus employee, dark‑web and campaign‑data reads.
Domain Verification — verify and lock your sending domains, and scan a domain's supply‑chain posture.
Integrations — outbound event webhooks.