Skip to content

REST APIv1

PhishFort Client API

Report threats, follow takedowns and query every incident PhishFort is handling for you, from your own systems. One key, one base URL, JSON in and out.

Get an API key working Browse endpoints

Base URLhttps://capi.phishfort.com/v1/All requests over HTTPS, authenticated with the x-api-key header

Deprecation Notice

The statusVerbose field will be deprecated on December 25, 2026. Please use the status field instead, which returns the same computed verbose status values. See Status Values for details.

Quick Start#

Every request carries your API key in the x-api-key header. GET /v1/whoami confirms the key works and lists the clients it can act for, so it is the first call worth making. See Authentication for the details.

curl -X GET 'https://capi.phishfort.com/v1/whoami' \
  -H 'accept: application/json' \
  -H 'x-api-key: YOUR_API_KEY'

import requests

response = requests.get(
    "https://capi.phishfort.com/v1/whoami",
    headers={
        "accept": "application/json",
        "x-api-key": "YOUR_API_KEY",
    },
)
print(response.json())

const response = await fetch("https://capi.phishfort.com/v1/whoami", {
  headers: {
    accept: "application/json",
    "x-api-key": "YOUR_API_KEY",
  },
});
const data = await response.json();
console.log(data);

Endpoints#

Incidents

GET/v1/incidentsList incidents, with filters and cursor pagination GET/v1/incident/{id}Full detail for one incident, including insights and blocklist listings GET/v1/incident/subject/{subject}Look an incident up by URL, domain or subject GET/v1/incident/{id}/snapshotsDNS, WHOIS and certificate captures over the incident's lifetime POST/v1/incident/tkdReport an incident for takedown POST/v1/incident/monitorReport an incident for monitoring POST/v1/incident/{id}/{action}Ask for a takedown, monitoring or other action on an existing incident POST/v1/incident/{id}/approve-takedownApprove a takedown that is waiting on your sign-off POST/v1/incident/{id}/attachAttach evidence files to an incident POST/v1/incident/{id}/commentAdd a comment to an incident

Account

GET/v1/whoamiVerify your key and list the clients it represents GET/v1/clientsClients your key is authorised for, including managed sub-clients GET/v1/usersDashboard users on your account GET/v1/documentsLetters of authorisation and other documents held on file GET/v1/usageRemaining credit balance for a client

Webhooks

POST/v1/webhooksSubscribe a URL to incident events, signed with HMAC-SHA256 GET/v1/webhooksList, update, test, rotate or delete your subscriptions

Response Format#

Every successful response has the same envelope:

{
    "message": "success",
    "data": { ... }
}

Paginated endpoints add a paging object. Field-level definitions for every object live in Data Structures.

Keep going#