NoPhishy Getting Started: Account Setup & First Request (2026)

Getting started overview

To begin using NoPhishy, the process involves creating a new account, configuring initial settings, generating API credentials, and then executing a basic API request to confirm connectivity and authentication. NoPhishy facilitates security awareness and threat protection through its platform, which includes phishing simulations, training modules, and email threat detection capabilities NoPhishy homepage. This guide will walk through the initial setup steps to get a basic integration operational.

Before proceeding with API interactions, users typically access the NoPhishy web portal to configure core elements like target groups for simulations, email templates, and reporting preferences. While the API allows for programmatic management of these resources, initial setup often benefits from the graphical user interface (GUI).

Quick Reference: Getting Started Steps

Create an account and get keys

The first step to integrating with NoPhishy is to establish an active account. NoPhishy offers a free trial, which can be initiated from their website. During the registration process, you will typically provide organizational details and user credentials for the primary account administrator.

1. Navigate to the NoPhishy Website: Go to the NoPhishy pricing and signup page.
2. Select a Plan: Choose a subscription plan or opt for the free trial. Complete the registration form, providing required information such as company name, email address, and desired password.
3. Verify Account: Follow any instructions to verify your email address. This often involves clicking a link sent to your registered email.
4. Log In to Dashboard: Once verified, log into your new NoPhishy dashboard using the credentials you created.
5. Locate API Settings: Within the NoPhishy dashboard, navigate to the API settings section. This is commonly found under 'Settings', 'Integrations', or 'Developer Options'. The exact path may vary based on product updates, but a search bar within the dashboard can usually help locate 'API' related options.
6. Generate API Key: Follow the prompts to generate a new API key. This key is a unique string used for authenticating your API requests. It is critical to treat this key as sensitive information, similar to a password. API keys grant programmatic access to your NoPhishy account and its resources.
7. Store API Key Securely: Copy the generated API key and store it in a secure location. Avoid hardcoding API keys directly into source code. Environment variables or secure configuration management systems are preferred methods for storing API keys for applications Google Cloud API key best practices. NoPhishy's API typically expects the key to be sent in an Authorization header or as a query parameter.

Your first request

After obtaining your API key, you can make your first authenticated request to the NoPhishy API. This initial request serves to confirm that your API key is valid and your environment is correctly configured. For this example, we'll assume a common endpoint for retrieving a list of available phishing templates or simulation campaigns.

NoPhishy's API generally adheres to REST principles, using standard HTTP methods (GET, POST, PUT, DELETE) and JSON for request and response bodies W3C REST architecture overview. Specific endpoint URLs and data structures will be detailed in the NoPhishy API documentation, accessible from your dashboard.

Example: Listing Phishing Templates

Let's assume an endpoint /api/v1/templates that returns a list of available phishing email templates.

Using curl (Command Line)

curl is a command-line tool designed for transferring data with URLs, supporting various protocols. It is useful for quickly testing API endpoints without writing code.

curl -X GET \
  "https://api.nophishy.co.uk/v1/templates" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

Replace YOUR_API_KEY with the actual API key you generated from your NoPhishy dashboard.

Using Python with the requests library

The requests library in Python simplifies making HTTP requests. Install it if you haven't already: pip install requests.

import requests
import os

# It's best practice to load API keys from environment variables
api_key = os.getenv("NOPHISHY_API_KEY") 

if not api_key:
    print("Error: NOPHISHY_API_KEY environment variable not set.")
    exit()

url = "https://api.nophishy.co.uk/v1/templates"
headers = {
    "Authorization": f"Bearer {api_key}",
    "Accept": "application/json"
}

try:
    response = requests.get(url, headers=headers)
    response.raise_for_status()  # Raises an HTTPError for bad responses (4xx or 5xx)
    
    print("Status Code:", response.status_code)
    print("Response Body:", response.json())

except requests.exceptions.HTTPError as errh:
    print(f"Http Error: {errh}")
except requests.exceptions.ConnectionError as errc:
    print(f"Error Connecting: {errc}")
except requests.exceptions.Timeout as errt:
    print(f"Timeout Error: {errt}")
except requests.exceptions.RequestException as err:
    print(f"Something went wrong: {err}")

Before running the Python script, set your API key as an environment variable:

• Linux/macOS: export NOPHISHY_API_KEY="YOUR_API_KEY"
• Windows (Command Prompt): set NOPHISHY_API_KEY="YOUR_API_KEY"
• Windows (PowerShell): $env:NOPHISHY_API_KEY="YOUR_API_KEY"

Expected Successful Response

A successful response for retrieving templates will typically return an HTTP 200 OK status code and a JSON array of template objects. The exact structure of the template objects will be defined in NoPhishy's API documentation.

{
  "data": [
    {
      "id": "tmpl_abc123",
      "name": "Standard Phishing Template 1",
      "type": "email",
      "language": "en",
      "description": "A generic phishing email targeting credential theft."
    },
    {
      "id": "tmpl_def456",
      "name": "Software Update Scam",
      "type": "email",
      "language": "en",
      "description": "A template simulating a fake software update notification."
    }
  ],
  "count": 2,
  "total_pages": 1
}

Common next steps

After successfully making your first API call, you can proceed with more advanced integrations to automate and scale your security awareness programs using NoPhishy.

1. Explore NoPhishy API Documentation: Thoroughly review the official NoPhishy API documentation for detailed information on available endpoints, request parameters, response structures, and error codes. This will guide you in implementing specific features.
2. Manage Target Users and Groups: Use the API to import, update, and manage your list of employees who will receive phishing simulations or training. This often involves endpoints like /api/v1/users or /api/v1/groups.
3. Create and Launch Campaigns: Programmatically create and schedule phishing simulation campaigns or assign security awareness training modules using the API. This would typically involve POST requests to campaign-related endpoints, specifying target groups, templates, and scheduling.
4. Monitor and Report on Campaign Results: Integrate API calls to retrieve real-time data on campaign performance, such as click rates, reported emails, and training completion status. This data can be used to build custom dashboards or integrate with existing security information and event management (SIEM) systems.
5. Implement Webhooks for Real-time Notifications: Configure webhooks within NoPhishy to receive automated notifications to your application when certain events occur, such as a user failing a phishing test or completing a training course. This enables event-driven automation.
6. Error Handling and Logging: Implement robust error handling in your application to gracefully manage API rate limits, invalid requests, or server-side issues. Log API interactions for auditing and debugging purposes.

Troubleshooting the first call

If your first API request to NoPhishy does not return the expected 200 OK status, consider the following troubleshooting steps:

• Check API Key: Double-check that the API key included in your request header matches the key generated in your NoPhishy dashboard exactly. Ensure there are no leading or trailing spaces.
• Verify Authorization Header Format: Ensure the Authorization header is correctly formatted as Bearer YOUR_API_KEY. Some APIs may use different schemes like Token or custom headers. Consult NoPhishy's specific API documentation for the required format.
• Confirm Endpoint URL: Ensure the base URL and the specific endpoint path are accurate. A common error is a typo in the URL (e.g., v1 instead of v2, or incorrect domain).
• Review HTTP Method: Confirm you are using the correct HTTP method (e.g., GET for retrieving data, POST for creating resources). Using the wrong method will often result in a 405 Method Not Allowed error.
• Check Network Connectivity: Verify that your system has network access to api.nophishy.co.uk. Firewall rules or proxy settings could be blocking the outgoing request.
• Examine Response Body for Error Messages: If you receive a non-200 status code (e.g., 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests, 500 Internal Server Error), the response body will often contain a JSON object with a detailed error message explaining the issue. For example, a 401 Unauthorized response clearly indicates an authentication problem, while a 400 Bad Request points to an issue with the request's parameters or body.
• Consult NoPhishy API Documentation: Refer to the official NoPhishy API documentation for specific error codes and their meanings. This is the authoritative source for resolving API-specific issues.
• Check for Rate Limiting: If you are making multiple requests in quick succession, you might encounter a 429 Too Many Requests status code, indicating you have hit an API rate limit. Implement exponential backoff or ensure your application respects the documented rate limits.