Create a company with SCIM and DEC

As a Reseller you can onboard a new customer and configure SCIM (user provisioning) and Direct Email Creation (DEC) for that company in a single workflow. The flow: create the company, then configure SCIM so the customer's IdP provisions users, and set up DEC so phishing simulations and training emails are sent via the customer's Microsoft 365 or Google Workspace tenant. Use a credential with Client Role = Reseller. After company creation, send X-KEEPNET-Company-Id with the new company's resourceId.

---

POST /api/companies

Creates a new company. The request uses multipart/form-data. Required fields: Name, CountryResourceId, IndustryResourceId, LicenseTypeResourceId, LicensePeriodTypeResourceId, NumberOfUsers, TimeZoneId, DateFormat, TimeFormat. Reference IDs are platform-specific — use values from your environment. See Endpoints → Company for the full schema.

Creates a new company

post

Required scopes

This endpoint requires the following scopes:

• : API

Authorizations

oauth2bearerAuth

OAuth2clientCredentialsRequired

Client ID and Client Secret from Company → Company Settings → REST API. Enter credentials to auto-fetch token.

Token URL:

Body

multipart/form-data

Filestring · binaryOptional

Namestring · max: 64Required

Descriptionstring · max: 300Optional

IndustryResourceIdstringRequired

CountryResourceIdstringRequired

Addressstring · max: 200Optional

WebsiteUrlstring · max: 2000Optional

LicenseTypeResourceIdstringRequired

LicenseModuleResourceIdArraystring[]Optional

LicensePeriodTypeResourceIdstringRequired

LicenseStartDatestring · date-timeOptional

LicenseEndDatestring · date-timeOptional

IsNumberOfUsersLimitedbooleanOptional

NumberOfUsersinteger · int32Required

NotificationTemplateTypeResourceIdstringOptional

TrainingContentTypeResourceIdstringOptional

SmtpConfigurationTypeResourceIdstringOptional

PreferredLanguageTypeResourceIdstringOptional

IsVersionVisiblebooleanOptional

IsReleaseNotesVisiblebooleanOptional

ReleaseNotesUrlstring · max: 2000Optional

CompanyGroupResourceIdArraystring[]Optional

BaseManHourCostinteger · int32Optional

BaseManHourinteger · int32Optional

StatusIdinteger · int32Optional

TimeZoneIdstringRequired

DateFormatstringRequired

TimeFormatstringRequired

CallBackNumberBookingCountinteger · int32Optional

Tagsstring[]Optional

Responses

200

OK

application/json

statusstringOptional

messagestring · nullableOptional

validationMessagesstring[] · nullableOptional

post

/api/companies

HTTPcURLJavaScriptPython

POST /api/companies HTTP/1.1
Host: api.keepnetlabs.com
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: multipart/form-data
Accept: */*
Content-Length: 828

{
  "File": "binary",
  "Name": "text",
  "Description": "text",
  "IndustryResourceId": "text",
  "CountryResourceId": "text",
  "Address": "text",
  "WebsiteUrl": "text",
  "LicenseTypeResourceId": "text",
  "LicenseModuleResourceIdArray": [
    "text"
  ],
  "LicensePeriodTypeResourceId": "text",
  "LicenseStartDate": "2026-03-09T13:38:38.315Z",
  "LicenseEndDate": "2026-03-09T13:38:38.315Z",
  "IsNumberOfUsersLimited": true,
  "NumberOfUsers": 1,
  "NotificationTemplateTypeResourceId": "text",
  "TrainingContentTypeResourceId": "text",
  "SmtpConfigurationTypeResourceId": "text",
  "PreferredLanguageTypeResourceId": "text",
  "IsVersionVisible": true,
  "IsReleaseNotesVisible": true,
  "ReleaseNotesUrl": "text",
  "CompanyGroupResourceIdArray": [
    "text"
  ],
  "BaseManHourCost": 1,
  "BaseManHour": 1,
  "StatusId": 1,
  "TimeZoneId": "text",
  "DateFormat": "text",
  "TimeFormat": "text",
  "CallBackNumberBookingCount": 1,
  "Tags": [
    "text"
  ]
}

200

OK

{
  "data": {
    "resourceId": "text"
  },
  "status": "text",
  "message": "text",
  "validationMessages": [
    "text"
  ]
}

From the response, note the new company's resourceId. Use it as X-KEEPNET-Company-Id in all subsequent requests.

---

POST /api/companies/clients

Creates REST API credentials (Client ID / Client Secret) for the new company. This is required if the customer will use the API themselves. Send X-KEEPNET-Company-Id with the new company's resourceId.

Creates a new client for company

post

Required scopes

This endpoint requires the following scopes:

• : API

Authorizations

oauth2bearerAuth

OAuth2clientCredentialsRequired

Client ID and Client Secret from Company → Company Settings → REST API. Enter credentials to auto-fetch token.

Token URL:

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

namestring · min: 1 · max: 64Required

clientIdstring · min: 1 · max: 32Required

clientSecretstring · min: 1 · max: 100Required

statusIdinteger · int32Required

hasIpAddressRestrictionbooleanOptional

allowedIpAddressesstring[] · nullableOptional

roleResourceIdListstring[] · nullableOptional

Responses

200

OK

application/json

statusstringOptional

messagestring · nullableOptional

validationMessagesstring[] · nullableOptional

post

/api/companies/clients

HTTPcURLJavaScriptPython

POST /api/companies/clients HTTP/1.1
Host: api.keepnetlabs.com
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 159

{
  "name": "text",
  "clientId": "text",
  "clientSecret": "text",
  "statusId": 1,
  "hasIpAddressRestriction": true,
  "allowedIpAddresses": [
    "text"
  ],
  "roleResourceIdList": [
    "text"
  ]
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

200

OK

{
  "data": {
    "resourceId": "text"
  },
  "status": "text",
  "message": "text",
  "validationMessages": [
    "text"
  ]
}

---

POST /api/scim

Creates a new SCIM integration for the company. Send X-KEEPNET-Company-Id. Body: name (required, max 30 chars), optional groupResourceId (assign provisioned users to a target group), and optional fieldMappings (map SCIM attributes to Keepnet fields). The response includes token and baseUrl — provide these to the customer for their IdP (Entra ID, Okta, etc.).

Creates a new scim integration

post

Required scopes

This endpoint requires the following scopes:

• : API

Authorizations

oauth2bearerAuth

OAuth2clientCredentialsRequired

Client ID and Client Secret from Company → Company Settings → REST API. Enter credentials to auto-fetch token.

Token URL:

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

namestring · max: 30RequiredExample: Entra ID SCIM

groupResourceIdstring · nullableOptional

Assign provisioned users to a target group

syncPlatformGroupbooleanOptionalExample: false

Responses

200

OK

application/json

statusstringOptional

messagestring · nullableOptional

validationMessagesstring[] · nullableOptional

post

/api/scim

HTTPcURLJavaScriptPython

POST /api/scim HTTP/1.1
Host: api.keepnetlabs.com
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 92

{
  "name": "Entra ID SCIM",
  "groupResourceId": null,
  "fieldMappings": [],
  "syncPlatformGroup": false
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

200

OK

{
  "data": {
    "token": "text"
  },
  "status": "text",
  "message": "text",
  "validationMessages": [
    "text"
  ]
}

Example body:

{
  "name": "Entra ID SCIM",
  "groupResourceId": "<targetGroupResourceId>",
  "fieldMappings": [],
  "syncPlatformGroup": false
}

---

GET /api/scim/fields

Returns all available SCIM fields that can be mapped. Use these values to configure fieldMappings in the SCIM integration if needed. Send X-KEEPNET-Company-Id.

Returns all available scim fields

get

Required scopes

This endpoint requires the following scopes:

• : API

Authorizations

oauth2bearerAuth

OAuth2clientCredentialsRequired

Client ID and Client Secret from Company → Company Settings → REST API. Enter credentials to auto-fetch token.

Token URL:

Responses

200

OK

application/json

statusstringOptional

messagestring · nullableOptional

validationMessagesstring[] · nullableOptional

get

/api/scim/fields

HTTPcURLJavaScriptPython

GET /api/scim/fields HTTP/1.1
Host: api.keepnetlabs.com
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

200

OK

{
  "data": {
    "fields": [
      {
        "resourceId": "text",
        "name": "text"
      }
    ]
  },
  "status": "text",
  "message": "text",
  "validationMessages": [
    "text"
  ]
}

---

POST /api/companies/direct-email-settings

Creates a Direct Email Creation (DEC) setting for the company. Send X-KEEPNET-Company-Id. Body: name (required), tenantId (required — the customer's Microsoft 365 or Google Workspace tenant ID), allowedDomains (required — list of email domains authorized for sending), and type (1 = Microsoft 365, 2 = Google Workspace).

Creates a new Direct Email setting for a company

post

Required scopes

This endpoint requires the following scopes:

• : API

Authorizations

oauth2bearerAuth

OAuth2clientCredentialsRequired

Client ID and Client Secret from Company → Company Settings → REST API. Enter credentials to auto-fetch token.

Token URL:

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

namestring · max: 64RequiredExample: Acme Corp M365 DEC

tenantIdstringRequiredExample: a1b2c3d4-e5f6-7890-abcd-ef1234567890

allowedDomainsstring[]RequiredExample: ["acmecorp.com"]

typeintegerOptional

1 = Microsoft 365, 2 = Google Workspace

Example: 1

Responses

200

OK

application/json

statusstringOptional

messagestring · nullableOptional

validationMessagesstring[] · nullableOptional

post

/api/companies/direct-email-settings

HTTPcURLJavaScriptPython

POST /api/companies/direct-email-settings HTTP/1.1
Host: api.keepnetlabs.com
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 122

{
  "name": "Acme Corp M365 DEC",
  "tenantId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "allowedDomains": [
    "acmecorp.com"
  ],
  "type": 1
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

200

OK

{
  "data": {
    "resourceId": "text"
  },
  "status": "text",
  "message": "text",
  "validationMessages": [
    "text"
  ]
}

Example body (Microsoft 365):

{
  "name": "Acme Corp M365 DEC",
  "tenantId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "allowedDomains": ["acmecorp.com", "acme.co.uk"],
  "type": 1
}

---

POST /api/companies/direct-email-settings/test

Tests the DEC connection by sending a test email through the customer's tenant. Send X-KEEPNET-Company-Id. Use the resourceId from the DEC create response.

Performs a connection test of a direct email setting

post

Required scopes

This endpoint requires the following scopes:

• : API

Authorizations

oauth2bearerAuth

OAuth2clientCredentialsRequired

Client ID and Client Secret from Company → Company Settings → REST API. Enter credentials to auto-fetch token.

Token URL:

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

resourceIdstringOptionalExample: <decResourceId>

fromstringOptionalExample: [email protected]

fromNamestringOptionalExample: Keepnet

tostringOptionalExample: [email protected]

messagestringOptionalExample: DEC test email

tenantIdstringOptionalExample: a1b2c3d4-e5f6-7890-abcd-ef1234567890

typeintegerOptionalExample: 1

Responses

200

OK

application/json

statusstringOptional

messagestring · nullableOptional

validationMessagesstring[] · nullableOptional

post

/api/companies/direct-email-settings/test

HTTPcURLJavaScriptPython

POST /api/companies/direct-email-settings/test HTTP/1.1
Host: api.keepnetlabs.com
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 195

{
  "resourceId": "<decResourceId>",
  "from": "[email protected]",
  "fromName": "Keepnet",
  "to": "[email protected]",
  "message": "DEC test email",
  "tenantId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "type": 1
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

200

OK

{
  "data": {
    "resourceId": "text"
  },
  "status": "text",
  "message": "text",
  "validationMessages": [
    "text"
  ]
}

Example body:

{
  "resourceId": "<decResourceId>",
  "from": "[email protected]",
  "fromName": "Keepnet",
  "to": "[email protected]",
  "message": "DEC test email",
  "tenantId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "type": 1
}

---

PUT /api/companies/direct-email-settings/make-default/{resourceId}

Sets the DEC as the default email delivery method for this company. Replace {resourceId} with the DEC ID. Send X-KEEPNET-Company-Id.

Sets a DEC as default

put

Required scopes

This endpoint requires the following scopes:

• : API

Authorizations

oauth2bearerAuth

OAuth2clientCredentialsRequired

Client ID and Client Secret from Company → Company Settings → REST API. Enter credentials to auto-fetch token.

Token URL:

Path parameters

resourceIdstringRequired

Responses

200

OK

application/json

statusstringOptional

messagestring · nullableOptional

validationMessagesstring[] · nullableOptional

put

/api/companies/direct-email-settings/make-default/{resourceId}

HTTPcURLJavaScriptPython

PUT /api/companies/direct-email-settings/make-default/{resourceId} HTTP/1.1
Host: api.keepnetlabs.com
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

200

OK

{
  "data": {
    "resourceId": "text"
  },
  "status": "text",
  "message": "text",
  "validationMessages": [
    "text"
  ]
}

---

Common errors

• 403 Forbidden — Credential is not Reseller. Set Client Role = Reseller. Roles and permissions →

• 401 Unauthorized — Missing or invalid token. Request a new token via POST /connect/token.

• 400 Bad Request — Missing required fields. For company creation: check Name, CountryResourceId, IndustryResourceId, etc. For SCIM: name is required (max 30 chars). For DEC: name, tenantId, and allowedDomains are required.

• 409 Conflict — A SCIM integration or DEC with the same name already exists for this company.

Platform UI: Configure SCIM under Company → Company Settings → SCIM Settings. SCIM Settings →. Configure DEC under Company → Company Settings → Direct Email Creation. Direct Email Creation →

Related: Create a company → (basic company creation). Set up SCIM for a customer →. Scope API requests to a customer →.