Overview

The Arsen API v1 provides endpoints for managing phishing campaigns, employees, and groups.

• The Arsen API adheres to REST principles
• Features predictable resource-based URLs
• Returns responses in JSON format
• Utilizes standard HTTP response codes, authentication methods, and verbs
• Supports bulk updates, allowing operations on one or multiple resources at a time
• Date and time values are returned in ISO 8601 format (e.g., 2021-01-01T00:00:00Z) and are expected in the same format for input
• Dates are always in UTC

Authentication

• The API key is required for all Arsen API requests and must be included in the x-api-key header
• The API key is either associated with:
  • a single Organization: all API requests are scoped to that Organization
  • a Partner: all API requests are scoped to a specified Organization, and the Partner can access multiple Organizations
• Multiple API keys for one Organization are not allowed
• All API requests must be made over HTTPS; calls over plain HTTP will fail

Note

You have to ask Customer Support to get your API keys.

Caution

API keys have significant privileges, so it is crucial to keep them secure. Do not share secret API keys in publicly accessible places like GitHub, client-side code, etc.

Versioning

• The Arsen API is versioned to ensure that changes to the API do not break existing integrations
• The API version is specified in the URL path, e.g. https://api.arsen.co/v1/
• A Changelog is available to track changes between versions

See the Changelog

Rate Limiting

• The Arsen API has rate limits to prevent abuse and ensure fair usage
• Rate limits are applied per Organization and are subject to change
• Current rate limits are available in each endpoint’s documentation