KnowBe4 API

The common uses are onboarding and offboarding (add a new hire to KnowBe4 and their training groups; archive a leaver), monthly training and phishing reports, and PhishER Threat tickets.

​

What it does

• Find, create, update, archive, restore and delete users, and manage their group memberships and email aliases
• Create, update, clone and archive groups
• Read training campaigns, enrollments and completion; enroll a user, extend a due date, and manage campaigns, policies and the content library
• Read phishing, callback, QR code and USB test campaigns and who clicked, replied, entered data or reported; manage campaigns and templates
• Read risk score history for users, groups and the account
• Add, read and delete security events on a user’s record (User Event API)
• Read reported emails in PhishER and set their category, status, severity, tags and comments; read and manage PhishER rules (Account & Settings)
• Read and manage admins, security roles and account settings

The Reporting API only reads. The User Event API adds and deletes events and event types, and KnowBe4’s GraphQL API reads and changes everything else. It names one GraphQL field per call and the fields it wants back, and Neo writes the query, so each call does exactly one thing and Neo checks its permission group.

​

Safety Controls

• Always asks a technician: permanently deleting users. Archiving a user, which keeps their training and phishing history, is the removal agents use.
• Asks under IT Admin: a change that grants or removes access (making a user an admin, assigning security roles to a user or a group, turning a user’s MFA off, partner access) and account settings.
• Groups with a security role: before any change that adds users to groups (adding members, creating or importing users into groups, smart-group criteria, cloning a group), Neo reads the target groups’ security roles. When a group carries one, Neo does not make the change, because the role gives its members KnowBe4 console access; a person adds that user in the KnowBe4 console. If Neo cannot read the groups, it does not make the change either.
• Never sent: a password, one-time code or client secret in any call (so a user turns MFA on themselves); creating, regenerating or deleting API, User Event or SCIM tokens; turning the account’s API off; and changes that act on every PhishER message or user event a search or filter matches. The agent changes those one at a time by id.
• Never read: fields that hold a credential, such as a user’s MFA secret, an API token’s secret, the PST token and the download link of a reported email.

​

Permission groups

​

Access profiles