Phishing simulation campaigns

Simulated phishing emails go to real client staff, so every send is checked against the client's signed authorisation (the authorised email domains and dates) at the moment it goes out, both at launch and on resend.

Launching

A draft or paused campaign can be launched once it has targets and a template. Launching an already-running campaign is refused (HTTP 409 ALREADY_ACTIVE), and each person is sent the email at most once, even if two sends overlap.

End dates

An end date is optional. If you set one it must be a real date that hasn't passed. The campaign runs to the end of that day (UTC); after that it can't be launched or resent (CAMPAIGN_ENDED) and opens, clicks and reports are no longer recorded, the same as a paused or completed campaign.

Resending failed emails

Resend retries only the people whose email failed. If the authorisation check refuses the resend, those people go back to *failed*; anyone who was never attempted is left as they were.

What's tracked

Opens, clicks and "report this email" are recorded per person, at most once per hour each, and only while the campaign is active.