Learn how to authenticate with the PhishFortress API and manage API keys
PhishFortress provides a RESTful API that allows you to programmatically interact with the platform. All API requests must be authenticated using one of the supported authentication methods.
https://api.phishfortress.com/v1PhishFortress supports two authentication methods:
API keys provide a simple way to authenticate with the PhishFortress API. Each API key is associated with a specific user account and has defined permissions.
X-API-Key: your_api_key_herecurl -X GET "https://api.phishfortress.com/v1/campaigns" -H "X-API-Key: your_api_key_here"You can create and manage API keys through the PhishFortress web interface:
Note: Once revoked, an API key cannot be restored. You will need to create a new key if needed.
API keys can be granted specific permissions to limit their access to certain resources:
| Permission | Description | Endpoints |
|---|---|---|
| campaigns:read | View campaign information | GET /campaignsGET /campaigns/{id} |
| campaigns:write | Create and modify campaigns | POST /campaignsPUT /campaigns/{id}DELETE /campaigns/{id} |
| users:read | View user information | GET /usersGET /users/{id} |
| users:write | Create and modify users | POST /usersPUT /users/{id}DELETE /users/{id} |
| reports:read | Access report data | GET /reportsGET /reports/{id} |
| templates:read | View phishing templates | GET /templatesGET /templates/{id} |
| templates:write | Create and modify templates | POST /templatesPUT /templates/{id}DELETE /templates/{id} |
To ensure the stability and performance of the API, PhishFortress implements rate limiting:
The API includes rate limit information in the response headers:
X-RateLimit-Limit: Maximum number of requests allowed per minuteX-RateLimit-Remaining: Number of requests remaining in the current windowX-RateLimit-Reset: Time in seconds until the rate limit resetsWhen you exceed the rate limit, the API will respond with:
429 Too Many Requests{
"error": "rate_limit_exceeded",
"message": "Rate limit exceeded. Please try again later.",
"retry_after": 30
}retry_after value when handling rate limit errors.