Authentication

Every API request is authenticated with an org-scoped API key in the X-API-Key header.

API keys

In the dashboard go to Developers → API keys. Create a key and store the secret securely — it is shown once.

Send X-API-Key on every API request. Org scope is inferred from the key.

Full machine-readable spec at /api/v1/openapi.json. View spec

Endpoints

Get catalog

GET/api/v1/catalog

Returns template, landing, SMTP, and group names and IDs for your org. Call this before launching a campaign.

Headers

NameTypeDescription
X-API-KeyrequiredstringOrg API key

Responses

{
  "templates": [{ "id": "…", "name": "Microsoft 365" }],
  "landings": [{ "id": "…", "name": "Microsoft login" }],
  "smtp": [{ "id": "…", "name": "Corporate" }],
  "groups": [{ "id": "…", "name": "All staff" }]
}

Example

terminal
curl -s -X GET \
  -H "X-API-Key: YOUR_KEY" \
  https://app-fish.pandaone.dev/api/v1/catalog

Bootstrap resources

POST/api/v1/setup/bootstrap

Create an SMTP profile and/or import a recipient group in one request. Useful for first-time org setup via API.

Headers

NameTypeDescription
X-API-KeyrequiredstringOrg API key

Request body

NameTypeDescription
smtp.namestringSending profile name
smtp.hoststringSMTP host:port
smtp.from_emailstringFrom address
group.namestringGroup name
group.csvstringGophish-format CSV

Responses

{ "catalog": { "smtp": [...], "groups": [...] } }

Example

terminal
curl -s -X POST \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  https://app-fish.pandaone.dev/api/v1/setup/bootstrap
  -d ''{"smtp":{"name":"Corporate","host":"smtp.example.com:587","from_email":"security@example.com"},"group":{"name":"All staff","csv":"First Name,Last Name,Email,Position\nAda,Lovelace,ada@example.com,Engineer"}}''