ADadaptivesecurity
Webhooks

phishing.simulation.reported

A user reported an Adaptive phishing simulation. Fires once per report; reporting the same simulation again produces a new event. Reports of emails that are not Adaptive simulations are delivered as separate event types.

Subscription filters

  • campaign — filter to specific campaign ids
postWebhookphishing.simulation.reported

Payload

datacontenttypestring

media type of data

idstring

unique id for event

sourcestring

the event source; always /adaptive

specversionstring

CloudEvents spec version

subjectstring

reserved for the event's primary entity id; currently never set, so always omitted

timestring date-time

when the event occurred

type'phishing.simulation.reported'

the event type

Example payload

{
  "data": {
    "payload": {
      "campaign": {
        "id": "a1b2c3d4-e5f6-4789-a0b1-c2d3e4f5a6b7",
        "name": "Q2 Finance Department Phishing"
      },
      "simulation": {
        "id": "3f9a2b7c-1d4e-4a8b-9c0f-7e6d5a4b3c21"
      },
      "user": {
        "email": "jordan.lee@example.com",
        "id": "8d2c1f6a-9b3e-4c7a-bf21-2a5e9c1d4b88"
      }
    }
  },
  "datacontenttype": "application/json",
  "id": "9b2f6c1e-8d3a-4f0b-a1c2-5e7d9f3b6a48",
  "source": "/adaptive",
  "specversion": "1.0",
  "time": "2026-06-09T18:00:00Z",
  "type": "phishing.simulation.reported"
}

Response

Return any 2xx status to acknowledge the delivery. Timeouts, 408, 429, and 5xx responses other than 501 are retried; any other status is a permanent failure.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.