Skip to main content

​
What Living Security needs

Scopes: None to configure — KnowBe4 Reporting API tokens are read-only by design and are not scoped. The token grants read access to users, training enrollments, and phishing security test results, which is exactly what the sync reads. Required role: Account Admin in KnowBe4 (only account administrators can access Account Settings → API)

​
Prerequisites

  • You must be signed in to your KnowBe4 console with an Account Admin role. Only account administrators can access Account Settings → API to enable the Reporting API and generate tokens.

​
Part A — In KnowBe4

Your KnowBe4 administrator completes these steps.
1

Enable the Reporting API and generate a token

  1. Sign in to your KnowBe4 console.
  2. Click your account name in the top-right corner and select Account Settings.
  3. In the left navigation, select API.
  4. Enable the Reporting API if it is not already enabled, then generate a new API token.
Give the token a descriptive purpose (e.g., Living Security Platform) if your console prompts for one.
KnowBe4 displays the API token value only once when it is generated. Copy it immediately and store it in a secure location (e.g., a password vault or secrets manager). If you navigate away without copying it, you must generate a new token.
The Reporting API is read-only. It exposes users, training enrollments, and phishing security test results — the data Living Security ingests for scoring and reporting. No write access is required.
2

Add the Living Security egress IPs to the Allowed IP Addresses list

KnowBe4 lets you restrict Reporting API access to a specific set of source IP addresses. This setting lives in the same place as the token:
  1. In your KnowBe4 console, go to Account Settings → API → Allowed IP Addresses.
  2. Add each Living Security egress IP range for your region to the allowlist.
If the Allowed IP Addresses list is configured, it is enforced at the network layer. The connection dialog will succeed at authentication time, but data syncs will fail (blocked at the network layer, typically surfacing as a 403) until the Living Security egress IPs are added to the allowlist. If you add any address to this list, you must also add the Living Security ranges, or our requests will be rejected even though your token is valid.
Living Security’s egress IP ranges can change when infrastructure is updated. If data syncs begin failing after previously working, verify the Allowed IP Addresses list is current and add any new ranges.
3

Identify your regional Reporting API host

KnowBe4 serves the Reporting API from a region-specific host. The value you enter for Reporting API host depends on the server your KnowBe4 account is provisioned on:Enter the host only — no https:// prefix and no trailing slash.If you are unsure which region your account uses, check the domain of your KnowBe4 console URL or contact your KnowBe4 administrator.

​
Part B — In the Living Security Platform

The program owner completes this step, or the system admin if using delegated setup.
1
You are now connected to KnowBe4.

​
Troubleshooting

The API token is invalid or expired. Verify the token is correct and has not been regenerated in Account Settings → API.
Either the token lacks Reporting API access, or the request IP is not on the Allowed IP Addresses list. Verify the Reporting API is enabled and that all Living Security egress IP ranges are on the allowlist.
The Reporting API may not yet have data to return, or the token’s account lacks visibility into the users and campaigns Living Security ingests. Verify the token was generated by an Account Admin.