Create a phishing campaign

First, let’s define what a phishing campaign is at Arsen. It involves sending a set of emails to a group of recipients, referred to as employees. Each email includes a link to a fake phishing page - a clone of a real page - designed to trick the target into clicking on the link.

The cloned pages are referred to as scenarios.

A campaign progresses through the following statuses:

scheduled: The campaign has been created but not yet sent.
running: Emails are in the process of being sent.
completed: The campaign has been terminated.

Create campaign

The first step is to create a campaign. The endpoint is as follows:

the base URL: https://api.arsen.co
the route: campaigns
name: the name of the campaign
jitTraining: true: employees will receive training emails only if they click on the phishing link
compromisedOn: 'click': the employee is considered compromised if they click on the phishing link
scenarioIds: the IDs of the scenarios to use They wil be distributed randomly
employeeIds: the IDs of the employees to target
runAt: the date and time to start the campaign with timezone

curl --request POST \
  --url https://api.arsen.co/v1/campaigns \
  --header 'x-api-key: <<AUTH_TOKEN>>' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "Campaign 1",
    "jitTraining": true,
    "compromisedOn": "click",
    "employeeIds": ["1Tu8NoS8yQLux2Wl0WKV", "50FhXNNynqiY7PkrXwfj", "8VTDkrPcvfO4B6fyudMr"],
    "scenarioIds": ["2FUnM8A40IrHpmO1ATWw", "4HvHbae7syUNul7CAnMR"],
    "runAt": "2025-01-02T12:00:00.000Z"
  }'

import axios from 'axios';

const options = {
  method: 'POST',
  url: 'https://api.arsen.co/v1/campaigns',
  headers: {
    'Content-Type': 'application/json'
  },
  data: {
    name: 'Campaign 1',
    jitTraining: true,
    compromisedOn: 'click',
    employeeIds: ['1Tu8NoS8yQLux2Wl0WKV', '50FhXNNynqiY7PkrXwfj', '8VTDkrPcvfO4B6fyudMr'],
    scenarioIds: ['2FUnM8A40IrHpmO1ATWw', '4HvHbae7syUNul7CAnMR'],
    runAt: '2025-01-02T12:00:00.000Z'
  }
};

try {
  const { data } = await axios.request(options);
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "https://api.arsen.co/v1/campaigns"

payload = {
  "name": "Campaign 1",
  "jitTraining": True,
  "compromisedOn": "click",
  "employeeIds": ["1Tu8NoS8yQLux2Wl0WKV", "50FhXNNynqiY7PkrXwfj", "8VTDkrPcvfO4B6fyudMr"],
  "scenarioIds": ["2FUnM8A40IrHpmO1ATWw", "4HvHbae7syUNul7CAnMR"],
  "runAt": "2025-01-02T12:00:00.000Z"
}
headers = {
  "Content-Type": "application/json",
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())

The response should be as follows:

{
  "status": "success",
  "data": {
    "campaign": {
      "id": "DHudgiEZ7e8tFN8FQAy8"
    }
  }
}

Export campaign details

The next step is to export a CSV file to retrieve the campaign details:

Export campaign

This time, the endpoint is easier to configure:

the base URL: https://api.arsen.co
the route: campaigns
the campaign ID from the previous call
the action: export
the export format: format=csv

curl --request GET \
  --url 'https://api.arsen.co/v1/campaigns/<<CAMPAIGN_ID>>/export?format=csv' \
  --header 'x-api-key: <<AUTH_TOKEN>>' \
  --header 'Content-Type: application/json'

import axios from 'axios';

const options = {
  method: 'GET',
  url: 'https://api.arsen.co/v1/campaigns/<<CAMPAIGN_ID>>/export',
  params: {
    format: 'csv'
  },
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': '<<AUTH_TOKEN>>'
  }
};

try {
  const { data } = await axios.request(options);
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "https://api.arsen.co/v1/campaigns/<<CAMPAIGN_ID>>/export"

querystring = {
  "format":"csv"
}

headers = {
  "Content-Type": "application/json"
  "x-api-key": "<<AUTH_TOKEN>>"
}

response = requests.get(url, headers=headers, params=querystring)

print(response.json())

The call may take a few seconds to complete. The result should be as follows:

{
  "status": "success",
  "data": {
    "fileUrl": "https://firebasestorage.googleapis.com/v0/b/arsen-campaignreports/o/organizations%2F<<ORGANIZATION_ID>>%2Fc%2F<<CAMPAIGN_ID>>%2Fexport_1728463131999.csv?alt=media&token=null"
  }
}

It is now easy to get the actual file by copy/paste the value of fileUrl in a browser tab or handle it programmatically.