Unique campaign name. Sanitized server-side (apostrophes/periods/special chars become hyphens).

Mail infrastructure instance name (e.g. "Managed Instance").

Guidance (max 500 chars) steering per-employee auto-phish lure selection. Recommended to supply. If omitted, the platform applies the default: "Do not restrict the payload type or style of phishing email. Select whichever phishing email is most contextually appropriate for each individual employee based on their profile, role, and organizational context."

Campaign channel. "email" (the default) sends a standard email phishing simulation; "voicePhish" runs a voice phishing (vishing) campaign, which requires voice phishing to be active on the tenant. Omitting the field is equivalent to "email".

Phishing email language — ISO culture (e.g. "en", "fr") or "dynamic".

Guidance (max 500 chars) steering per-employee auto-train module selection. Recommended to supply. If omitted, the platform applies the default: "Select whichever training modules are most contextually appropriate for each individual employee based on their role, prior training history, demonstrated skill level, and any recent phishing interactions."

How often the training recurs. "once" = a single assignment.

"allTrainings" assigns every selected module; "randomTraining" lets CanIPhish intelligently assign a module per employee. (Any value other than "allTrainings" is treated as randomTraining.)

ISO culture or "dynamic".

Training expiry "MMM dd, yyyy" (capped at 4 years).

Who gets trained (phishTrain campaigns): "compromised" = employees who interacted with the payload, "payloadCompromised" = employees who submitted data to the payload, "all" = every targeted employee. For train-type campaigns the scope is assigned server-side, so this is ignored.