---
title: "Get phishing enrollments"
method: GET
path: "/v2/phishing/campaigns/enrollments"
tags: ["Phishing"]
---

# Get phishing enrollments

`GET /v2/phishing/campaigns/enrollments`

Retrieve details about phishing enrollments with campaign, simulation, and user filters

## Query parameters

- `user_id` string
- `campaign_id` string
- `simulation_id` string
- `page_after` string
- `page_size` integer

## Response `200`

Successfully retrieved phishing enrollment details

- PhishingEnrollmentListResponseDto — Paginated list of phishing enrollments
  - `enrollments` PhishingEnrollmentDto[] — List of phishing enrollments
    - `campaign_id` string — Campaign identifier
    - `clicked_at` string, date-time — When the user clicked a link in the email
    - `credentials_entered_at` string, date-time — When the user entered credentials
    - `deep_fake_played_at` string, date-time — When the user played the deep fake
    - `delivered_at` string, date-time — When the phishing email was delivered
    - `enrollment_id` string — Unique identifier for the enrollment
    - `failed_at` string, date-time — When the user failed the phishing test
    - `ip` string — IP address from the failure condition
    - `ip_location` string — Geographic location of the IP address
    - `opened_at` string, date-time — When the user opened the email
    - `phone_number_called_at` string, date-time — When the user called the phone number
    - `qr_code_scanned_at` string, date-time — When the user scanned a QR code
    - `reported_at` string, date-time — When the user reported the phishing email
    - `scenario_id` string — Scenario identifier
    - `scheduled_at` string, date-time — When the phishing email was scheduled to be sent
    - `simulation_id` string — Simulation execution identifier
    - `text_replied_at` string, date-time — When the user replied to the text message
    - `user` PhishingEnrollmentUserDto — User information for phishing enrollment
      - `email` string — User's email address
      - `id` string — Unique identifier for the user
  - `page_after` string — Cursor for the next page

## Other responses

- `401` — Unauthorized - Invalid or missing authentication token
- `429` — Too many requests - Rate limit exceeded
- `500` — Internal server error

---

[API](https://skmtc.dev/adaptivesecurity/apis/adaptive-api.md) · [All operations](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/adaptivesecurity/adaptive-api/revisions/aaa99c15ecc7/schema)