Docs
Documentation / SOC mailbox and API / Handle reports and integrate safely

Handle reports and integrate safely

Open SOC reports to work the Needs review queue. Check the reporter, subject, and whether the report matches a live campaign before you mark it handled.

SOC reports

Open SOC reports to review the Needs review queue and recently handled items. On the Pro and Enterprise plans with a connected mailbox, reports arrive automatically whenever an employee uses Outlook's "Report Phishing" button. Check the reporter address, the subject, and whether the report matches a live Phishtime campaign, then mark it handled.

API keys

Open Settings → Access & security → API keys. The Base URL and the required Authorization: Bearer pht_xxxx header are shown at the top, with a link to the full endpoint reference. An API access switch turns all keys on or off at once.

  1. Under New API key, give it a name that describes its purpose (for example "SOC integration · staging").
  2. Check only the scopes the integration needs: campaigns:read, targets:read, events:read, reports:read.
  3. Click Generate key and copy the value now. It is shown only once and stored bcrypt-hashed, so it cannot be retrieved later.
  4. Check Active keys now and then (name, prefix, scopes, created, last used) and revoke any key that is no longer in use or that you do not recognize.