Get one possible campaign / suspected cluster

Full campaign object: the index summary fields plus an evidence breakdown, the per-pair relationships drill-down, and every member indicator. Shared-infrastructure grouping of public detections, not an attribution claim.

Since the data-state-honesty change, a key that is no longer LIVE but whose history the sidecar still retains (not weak, not suppressed) is still a 200, with "state": "archived" and the thinner ArchivedCampaign shape - see that schema. 404 is reserved for an identifier the sidecar has never seen, a manually-suppressed key (the kill switch), or a "weak" cluster (never surfaced).

get/api/v1/campaigns/{id}

Request

  • Base URL: https://phishunt.io
  • URL: https://phishunt.io/api/v1/campaigns/{id}
  • Auth: none declared

Path parameters

idstring required
Example:0c1b79ab9b24

Stable campaign key (preferred, e.g. 0c1b79ab9b24) or the legacy numeric cluster id, which is resolved for the last 180 days.

Response

Full campaign object. state: "live" uses the Campaign schema; state: "archived" (a key that is no longer live but whose history is retained) uses the thinner ArchivedCampaign schema.

OR

Changes

No recorded changes to this operation across all 1 revision of this API.