BaitProof

Documentation

Quickstart

How a campaign runs — and the safety rules that never bend.

1. Create a campaign

Pick a template, name your company, list the targets. The API renders the simulation — it does not send email itself.

curl -s -H "Authorization: Bearer <key>" -X POST https://sim.baitproof.example/v1/campaigns \
  -H "Content-Type: application/json" \
  -d '{"name":"October sim","company":"Acme Law",
       "template_id":"invoice","targets":["don+baitproof@lifeofmorr.com","don+baitproof@lifeofmorr.com"]}'

# {"id":"cmp_0001","note":"NOT SENT — v1 renders simulations only. ...","rendered":[...]}

2. Deliver with authorization

Rendered messages are logged NOT SENT. Delivery runs through your ESP (or ours) only with your written authorization on file, per SOP-01.

3. Track the recipient journey

Pixel opens, click redirects to the disclosure landing page, and one-click 'I reported this' — all tracked per recipient.

# open pixel (public)
curl -s -o /dev/null https://sim.baitproof.example/t/<token>.png
# click follows a 302 to the disclosure + training page
curl -sL https://sim.baitproof.example/c/<token> | grep -o "simulated phishing test"

4. Read the report

Click rate, report rate, and the needs-training list.

curl -s -H "Authorization: Bearer <key>" https://sim.baitproof.example/v1/campaigns/cmp_0001/report

# {"sent":2,"opened":1,"clicked":1,"reported":0,"click_rate":50.0,
#  "needs_training":["don+baitproof@lifeofmorr.com"]}

Honest limits