Skip to content

Integrating SailPoint with CanIPhish

CanIPhish is a cloud-based security awareness and human risk management platform built for organizations to test, train, and monitor employee resilience against phishing and social engineering attacks. It combines phishing simulation campaigns (email, and voice phishing) with integrated security awareness training, dark web exposure monitoring, and human risk scoring into a single unified system. This document provides instructions to configure a new direct connection to a CanIPhish source.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The CanIPhish connector supports the following:

Account Management

  • Aggregate Account (Users) - via POST /settings/users/list-users

Entitlement Management

  • Aggregate Entitlement (Roles) - derived from the role/roleName attribute on each user object

Note

This connector is read-only. It supports test connection, account aggregation, and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

  1. Log in to CanIPhish with a Platform Super Admin or Platform Admin account.
  2. Go to Profile icon > User Profile > Account API Key.
  3. Under Account API Key, an API key is generated by default for every account. To rotate or create a fresh key, select Generate a new API key.
  4. Select Copy next to the API Key field to copy it.
  5. Copy and securely store the following details, required during connector configuration:
    • Base URL - https://api.CanIPhish.com/api/v3
    • Tenant ID - found on the same User Profile page, under Tenant ID
    • Account Email Address - the email of the user the key belongs to; this is required as a second auth header alongside the API key

Note

  • These API keys are linked to a specific user account. If the user is deactivated, the key's behavior is inherited from that user's access loss - since the token has no independent identity beyond the user it belongs to.
  • CanIPhish requires two credentials together for every API call, not just the key alone: the x-api-key header and an X-Email-Address header identifying the account the key belongs to.

For more information about obtaining an API key, refer to the CanIPhish API Reference.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

  • Platform Super Admin - Full access, including settings and user management. Can generate API keys and fetch all user and entitlement data across the tenant.
  • Platform Admin - Elevated access, one tier below Super Admin; typically includes user and campaign management but may have restrictions on certain platform-wide settings.