Look up the complete event history of a specific campaign (sends, opens, clicks, reports, compromised credentials, etc.) from your own systems: reporting, internal dashboards, integrations with your SIEM.
For the list of campaigns with their aggregated statistics, see Campaigns API. This article covers only the event by event detail of a specific campaign.
Base URL: all endpoints live under the prefix {{base_url}}/api/companies/v1.
To get the production host (
base_url), contact your Whalemate representative or write to us through the support chat.
Authentication: header X-API-KEY.
X-API-KEY: tu_api_key_de_empresa
Generate or look up your key from Configuración → Integraciones → Claves API card → Claves Activas. Detail in API Keys: how to generate, use, and revoke them.
The company is resolved automatically from the API Key: you don't send company_id, and the endpoint only returns events for campaigns that belong to your company.
Header | Value | Required |
|---|---|---|
| Your company API Key | ✅ Yes |
|
| ✅ Yes |
GET {{base_url}}/api/companies/v1/campaigns/{id}/events
Returns the complete event history of a specific campaign (not paginated).
Param | Type | Description |
|---|---|---|
| integer | Campaign ID (path param) |
Example Request: GET {{base_url}}/api/companies/v1/campaigns/88/events
Response (200 OK):
{
"data": [
{
"id": 4567,
"date_time": "2026-03-05T09:15:32Z",
"type": "Clicked Link",
"ip": "192.168.1.45",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"victim": {
"id": 789,
"email": "[email protected]",
"first_name": "Juan",
"last_name": "Pérez",
"department": "Finanzas",
"position": "Analista Senior",
"country": "México"
}
}
]
}
Sorted by date_time descending. Does not include events of type Automatic Clicked (automatic clicks from corporate security scanners, not from the victim), nor events after the campaign closes (closes_at): the same cutoff applied by the statistics in the list in Campaigns API.
type can be any of: Email Sent, Failed, Clicked Link, Email Reported, Email Opened, Credential Harvesting, File Open, Download, Reported, Impersonated.
Error response (404): the campaign doesn't exist or doesn't belong to your company:
{
"message": "No query results for model [Src\\Domain\\Campaign\\Models\\Campaign]."
}
Code | Cause | Body |
|---|---|---|
| Missing |
|
| Nonexistent/revoked API Key |
|
| The campaign doesn't exist or doesn't belong to your company |
|
curl -X GET "https://api.whalemate.io/api/companies/v1/campaigns/88/events" \
-H "X-API-KEY: tu_api_key_aqui" -H "Accept: application/json"
Is it paginated? No, all events of the campaign are returned at once.
Why don't I see events of type Automatic Clicked? The endpoint excludes them on purpose: they are automatic clicks from corporate security scanners/proxies, not from the victim, and they would clutter the analytics.
What time zone are the dates in? In UTC, same as the rest of the Company API.
How do I get the campaign's id? With the list from Campaigns API (GET /campaigns).
Where do I get my API Key? In Configuración → Integraciones → Claves API card → Claves Activas.
Have feedback or want to request improvements? Let us know at roadmap.whalemate.com/roadmap