API and webhooks
Manage employees, inject real security events and receive real-time notifications from your own tools.
What each surface covers
List, create, update, delete. Campaign-event history per person. It is the program roster, not an eternal parallel directory: SCIM remains the happy path.
An external security event is tied to an employee and hits the Human Risk Score like a simulation event. Without this door, the index only sees what Whalemate fired.
Phishing reports that did not come from the native button. The program can absorb a channel the SOC already has.
Real-time outbound to your tools. Signature verification. Retries. Idempotency. Keys rotate. Generating and revoking in console is customer documentation.
The index and the events, in the tools you already use
Whalemate’s awareness API is not a promise portal
It is the declared set: Employees API (list, create, update, delete, campaign-event history), Custom Events API (external security events tied to an employee; they hit the Human Risk Score like a simulation event), External Phishing Reports API, and outbound webhooks with signature verification, retries and idempotency. Rotatable API keys. Technical documentation is the contract; here is why it exists.
The integrations hub names the API in a grid
This is the awareness API and the webhooks. We do not repeat SSO. We do not publish an invented OpenAPI or attack-payload examples.
Injecting a real event
The score does not live in a silo of “our drills only”.
What it is for when the stack already exists
It is for IT that will not live inside Whalemate
It is for injecting the signal the SIEM already has. It is so the risk score is not a locked number. It is so you do not fake coverage of a contractor who only exists in another system: they enter through SCIM, or through API, or they do not enter.
It is not the “how to generate an API key” guide
The technical-doc link is below.
How it connects to integrations and analytics
Identity provisions. The API operates and notifies. The Human Risk Score — analytics pillar — consumes simulation events and injected events. We do not publish the Human Risk Score formula. It declares that a custom event counts like a campaign event. The integrations hub remains the map. Three children: identity, SCORM, API. There is no fourth URL for “webhooks” alone: they live here.
How this module is used
Questions about API and webhooks
Already a customer? See how it is configured — The technical reference lives in customer documentation.
Connect the program to the tools you already have
In the demo we look at employees, events and webhooks on your case. No API-key playground here.