Changelog#
Client API additions, behavior changes, deprecations, fixes, and documentation updates, newest first. Entries flagged Breaking altered an existing request or response contract.
API changelog feed and MCP tool
Client API changes are available as a rendered changelog, a machine-readable JSON feed and the get_changelog tool on the Docs MCP server.
DocumentationConsistent incidentClass values
incidentClass now uses the documented six-value vocabulary across incident responses and webhook payloads. Values are derived from the threat classification, and unclassified incidents return other instead of n/a.
GET /v1/incidentsGET /v1/incident/{incidentId}statusVerbose deprecation date updated
The planned deprecation date for statusVerbose is December 25, 2026. Use status for filtering and reading the computed verbose status value.
GET /v1/incidentsGET /v1/incident/{incidentId}Optional author on incident comments
Adding a comment accepts an optional author email so the comment is attributed to the right person in your organization. Omitting it attributes the comment to the API key owner.
POST /v1/incident/{incidentId}/commentApprove takedowns via the API
New endpoint to approve a takedown that is waiting on your confirmation, as an alternative to approving from the dashboard.
POST /v1/incident/{incidentId}/approve-takedownBlocklist listings on incident detail
The incident detail response includes a new blocklists field showing which blocklist partners the threat has been submitted to and where it is actively listed.
GET /v1/incident/{incidentId}Credit usage endpoint
New endpoint returning your plan's credit usage and remaining balance.
GET /v1/usageIncident snapshots endpoint documented
The endpoint returning page snapshots captured for an incident is now documented.
GET /v1/incident/{incidentId}/snapshotsTechnical insights on incident detail
The incident detail response includes a new insights field with technical detail about the threat, including hosting, page and capture indicators.
GET /v1/incident/{incidentId}Docs MCP server
This documentation site is available as an MCP server at https://api-docs.phishfort.com/mcp, so AI assistants can search pages, read full docs and fetch OpenAPI specs while helping you build an integration.
DocumentationTotal counts for incident lists
Passing includeTotal=true to the incident list returns the total number of matching incidents in paging.total.
GET /v1/incidentsClients and Documents endpoints documented
The endpoints for listing your client accounts and retrieving documents (including signed download URLs) are now documented.
GET /v1/clientsGET /v1/documentsGET /v1/documents/{documentId}GET /v1/documents/{documentId}/signed-urlList users endpoint
New endpoint listing the dashboard users of your organization.
GET /v1/usersAuthor attribution on incident history
Incident history entries now identify who wrote each entry (a PhishFort analyst or a member of your organization) via the author classification documented in Data Structures.
GET /v1/incident/{incidentId}Attachment and throttling limits clarified
The Limits page now states attachment size limits and request throttling behavior precisely.
DocumentationWebhooks
Webhook subscriptions deliver HTTP notifications for incident events (created, status changed, history added, takedown updated, action required), signed with HMAC-SHA256.
POST /v1/webhooksGET /v1/webhooksPATCH /v1/webhooks/{id}DELETE /v1/webhooks/{id}Cursor-based pagination for incident lists
The incident list supports cursor-based pagination for stable iteration over large result sets, alongside the existing limit/offset paging.
GET /v1/incidentsRegistrar, hosting provider and expanded threat taxonomy on incident detail
The incident detail response includes registrar and hostingProvider fields and an expanded threatTaxonomy structure.
GET /v1/incident/{incidentId}Migration from statusVerbose
The status parameter began returning verbose values, starting the migration away from statusVerbose. statusVerbose remains accepted and returned for compatibility and is planned for deprecation on December 25, 2026.
GET /v1/incidentsGET /v1/incident/{incidentId}Threat taxonomy and classification fields
Incident responses include threatTaxonomy, incidentClass and related classification fields describing the type of threat.
GET /v1/incidentsGET /v1/incident/{incidentId}Verbose status values
Incident status values moved to the verbose set (pending_review, case_building, takedown_in_progress, …) and the other status was replaced by closed.
GET /v1/incidentsGET /v1/incident/{incidentId}Comments must be non-empty
Adding a comment with a null or empty body is rejected with a validation error.
POST /v1/incident/{incidentId}/commentAdd a comment to an existing incident
New endpoint to add a comment to an incident you have already reported.
POST /v1/incident/{incidentId}/comment50 MB attachment limit
Attachment uploads are limited to 50 MB per request.
POST /v1/incident/{incidentId}/attachcase_building status
New case_building incident status, covering incidents where PhishFort is gathering evidence before enforcement.
GET /v1/incidentsGET /v1/incident/{incidentId}reportedBy on incident reports
Reporting an incident accepts an optional reportedBy field identifying the reporter.
POST /v1/incident/tkdIncident attachments
Attachments can be included when reporting an incident and added to existing incidents.
POST /v1/incident/{incidentId}/attachstatusVerbose parameter and new incident types
The incident list gained the statusVerbose parameter (since deprecated in favor of status) and support for additional incident types.
GET /v1/incidents