<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Security Awareness Governance

## Phishing Simulation Platforms

### GoPhish (Open Source)

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/campaigns/` | GET | List all campaigns |
| `/api/campaigns/` | POST | Create new campaign |
| `/api/campaigns/{id}/results` | GET | Get campaign results |
| `/api/templates/` | POST | Create email template |
| `/api/groups/` | POST | Create target group |
| `/api/pages/` | POST | Create landing page |

### KnowBe4 API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/v1/users` | GET | List enrolled users |
| `/v1/phishing/campaigns` | GET | List phishing campaigns |
| `/v1/phishing/campaigns/{id}/results` | GET | Campaign results with click data |
| `/v1/training/enrollments` | GET | Training enrollment status |
| `/v1/reports/phishing` | GET | Aggregate phishing metrics |

## Metrics Collection

### Key Performance Indicators

| KPI | Formula | Benchmark |
|-----|---------|-----------|
| Phish-Prone Percentage | Clicks / Delivered × 100 | Industry avg: 30% (untrained) |
| Report Rate | Reports / Delivered × 100 | Target: > 70% |
| Resilience Ratio | Reports / Clicks | Target: > 14:1 |
| Training Velocity | Completed / Assigned × 100 | Target: > 95% in 30 days |

## Compliance Mapping

| Framework | Control | Requirement |
|-----------|---------|-------------|
| NIST 800-50 | § 4.2 | Role-based awareness training program |
| ISO 27001 | A.7.2.2 | Information security awareness education |
| CIS v8 | Control 14 | Security awareness and skills training |
| PCI DSS | 12.6 | Security awareness program for all personnel |
| HIPAA | § 164.308(a)(5) | Security awareness and training |
