Automation — PandaONE Phish

Webhooks

Subscribe to sent, opened, clicked, submitted, and reported events. Configure under Developers → Webhooks or POST /webhooks.

Verify payloads with the X-Phish-Signature HMAC header when a secret is configured.

AI agents

AI agents and integrations should use API keys, not browser sessions. Fetch recipes first, validate setup, then launch.

GET /meta/agent — recipes, field names, and example payloads
GET /catalog — resolve template, landing, SMTP, and group names to IDs
POST /setup/validate — dry-run before sending
POST /campaigns/quick — launch the simulation
GET /campaigns/{id}/status — poll until complete

Endpoints

Create webhook

POST/api/v1/webhooks

Registers a webhook URL for campaign events. Payloads are signed with X-Phish-Signature when a secret is set.

Headers

Name	Type	Description
`X-API-Key`required	`string`	Org API key

Request body

Name	Type	Description
`name`	`string`	Webhook label
`url`required	`string`	HTTPS endpoint
`secret`	`string`	HMAC secret
`events`	`string`	Event filter or *

Responses

{ "id": "…", "url": "https://ops.example.com/hooks/phish" }

Example

terminal

curl -s -X POST \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  https://app-fish.pandaone.dev/api/v1/webhooks
  -d ''{"name":"Ops","url":"https://ops.example.com/hooks/phish","events":"*"}''

Get agent recipes

GET/api/v1/meta/agent

Returns field names, example payloads, and recommended call order for AI agents and integrations.

Headers

Name	Type	Description
`X-API-Key`required	`string`	Org API key

Responses

{ "recipes": [...], "endpoints": [...] }

Example

terminal

curl -s -X GET \
  -H "X-API-Key: YOUR_KEY" \
  https://app-fish.pandaone.dev/api/v1/meta/agent

Plan from goal

POST/api/v1/agent/plan

Turns a natural-language goal into ordered API steps an agent can execute.

Headers

Name	Type	Description
`X-API-Key`required	`string`	Org API key

Request body

Name	Type	Description
`goal`required	`string`	What you want to accomplish

Responses

{ "steps": ["GET /catalog", "POST /campaigns/quick"] }

Example

terminal

curl -s -X POST \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  https://app-fish.pandaone.dev/api/v1/agent/plan
  -d ''{"goal":"Run a Microsoft 365 drill for finance next week"}''