aid: proofpoint
name: Proofpoint
description: 'Proofpoint is an enterprise cybersecurity company focused on human-centric
  security — email and collaboration security, data loss prevention, insider threat
  management, digital communications governance, security awareness training and threat
  intelligence. Its public API surface is substantial but gateway-shaped rather than
  developer-portal-shaped: the Targeted Attack Protection (TAP) v2 API, the Threat
  Protection dashboard Reports API, the Emerging Threats (ET) Intelligence Query API,
  the ZenGuide / Security Awareness Training Results API, the Secure Email Relay email
  submission API, the Proofpoint Essentials SIEM API and the Proofpoint on Demand (PoD)
  log stream. Every one of them is documented in public HTML and every one of them is
  credential-gated at runtime; Proofpoint publishes no OpenAPI, AsyncAPI, GraphQL or
  MCP contract for any of them.'
url: https://raw.githubusercontent.com/api-evangelist/proofpoint/refs/heads/main/apis.yml
image: https://kinlane-productions2.s3.amazonaws.com/api-evangelist-site/company-logos/proofpoint.png
x-type: company
x-source: harvest:absent-parent
specificationVersion: '0.20'
created: '2026-09-13'
modified: '2026-09-13'
tags:
- Security
- Cybersecurity
- Email Security
- Threat Intelligence
- Data Loss Prevention
- Security Awareness Training
- Insider Threat
- SIEM
- Compliance
- Email
apis:
- aid: proofpoint-tap
  name: Proofpoint Targeted Attack Protection (TAP) API v2
  image: https://kinlane-productions2.s3.amazonaws.com/api-evangelist-site/company-logos/proofpoint.png
  description: 'The TAP v2 API exposes the Threat Insight Dashboard to machines: SIEM
    event download (blocked/permitted clicks, blocked/delivered messages, issues, all),
    campaign identifiers and detail, forensic evidence for a threat or campaign, Very
    Attacked People and top-clicker rosters, threat summaries and URL Defense decoding.
    All endpoints are GET (URL Decoder is POST) over HTTPS with HTTP Basic authentication
    using a service principal and secret minted in the TAP Settings page.'
  humanURL: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
  baseURL: https://tap-api-v2.proofpoint.com/v2
  tags:
  - Threat Intelligence
  - SIEM
  - Email Security
  properties:
  - type: APIReference
    url: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
  - type: Documentation
    url: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API
  - type: TermsOfService
    url: https://www.proofpoint.com/us/legal/api-terms-of-use
  - type: RateLimits
    url: rate-limits/proofpoint-rate-limits.yml
  - type: Authentication
    url: authentication/proofpoint-authentication.yml
- aid: proofpoint-threat-protection-reports
  name: Proofpoint Threat Protection Dashboard Reports API v1
  image: https://kinlane-productions2.s3.amazonaws.com/api-evangelist-site/company-logos/proofpoint.png
  description: 'The Dashboard Reports API returns the same executive-summary,
    effectiveness, people, organization and threat-landscape report cards the Threat
    Protection dashboard renders, plus mail-bomb (email bomb) events. It is the newer
    of the two Proofpoint threat APIs and the only one using OAuth 2.0 client
    credentials: an API key and secret are exchanged at https://auth.proofpoint.com/v1/token
    for a one-hour Bearer token.'
  humanURL: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API
  baseURL: https://threatprotection-api.proofpoint.com/api/v1/dash/reports
  tags:
  - Reporting
  - Email Security
  - Analytics
  properties:
  - type: APIReference
    url: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Reports_API
  - type: Documentation
    url: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/Email_Bomb_Events_API
  - type: Authentication
    url: authentication/proofpoint-authentication.yml
  - type: RateLimits
    url: rate-limits/proofpoint-rate-limits.yml
- aid: proofpoint-et-intelligence
  name: Emerging Threats (ET) Intelligence Query API v1
  image: https://kinlane-productions2.s3.amazonaws.com/api-evangelist-site/company-logos/proofpoint.png
  description: 'The ET Intelligence Query API is Proofpoint''s threat-intelligence
    lookup service, reached at api.emergingthreats.net. Thirty-six documented GET
    endpoints pivot across domains, IP addresses, malware samples (by MD5), Suricata/Snort
    signature IDs, CVEs, malware families, threat actors and reputation categories.
    Authentication is a single API key sent in the Authorization header; the default
    rate is 200 queries per minute per key.'
  humanURL: https://apidocs.emergingthreats.net/
  baseURL: https://api.emergingthreats.net/v1
  tags:
  - Threat Intelligence
  - Reputation
  - Malware
  properties:
  - type: APIReference
    url: https://apidocs.emergingthreats.net/
  - type: GitHubRepository
    url: https://github.com/EmergingThreats/query-api-docs
  - type: SignUp
    url: https://etadmin.proofpoint.com/api-access
  - type: RateLimits
    url: rate-limits/proofpoint-rate-limits.yml
- aid: proofpoint-psat-results
  name: Proofpoint Security Awareness Training (ZenGuide) Results API
  image: https://kinlane-productions2.s3.amazonaws.com/api-evangelist-site/company-logos/proofpoint.png
  description: 'The Results API exports Security Awareness Training outcomes for
    business-intelligence and LMS integration: CyberStrength knowledge assessments,
    PhishAlarm reports, ThreatSim simulated-phishing events, training assignments,
    training enrollments and users. Proofpoint publishes a machine-readable apiDoc
    description of it — the only machine-readable contract found anywhere on the
    Proofpoint estate — alongside the rendered reference.'
  humanURL: https://proofpoint.securityeducation.com/api/reporting/documentation/
  baseURL: https://results.us.securityeducation.com/api/reporting/v0.3.0
  tags:
  - Security Awareness Training
  - Reporting
  - Education
  properties:
  - type: APIReference
    url: https://proofpoint.securityeducation.com/api/reporting/documentation/
  - type: X-APIDoc
    url: apidoc/proofpoint-psat-results-api_data.json
  - type: X-APIDocProject
    url: apidoc/proofpoint-psat-results-api_project.json
  - type: DataModel
    url: data-model/proofpoint-data-model.yml
- aid: proofpoint-secure-email-relay
  name: Proofpoint Secure Email Relay (SER) Email Submission API
  image: https://kinlane-productions2.s3.amazonaws.com/api-evangelist-site/company-logos/proofpoint.png
  description: 'Secure Email Relay lets applications send authenticated transactional
    mail through Proofpoint rather than through an unmanaged relay, which is what
    makes a strict DMARC policy achievable. The Email Submission API accepts a message
    at mail.ser.proofpoint.com after an OAuth client-credential exchange; Proofpoint
    ships first-party client libraries for Python, Java and .NET against it.'
  humanURL: https://api-docs.ser.proofpoint.com/docs/email-submission
  baseURL: https://mail.ser.proofpoint.com
  tags:
  - Email
  - DMARC
  - Transactional Email
  properties:
  - type: APIReference
    url: https://api-docs.ser.proofpoint.com/docs/email-submission
  - type: SDKs
    url: packages/proofpoint-packages.yml
- aid: proofpoint-essentials-siem
  name: Proofpoint Essentials Threat (SIEM) API
  image: https://kinlane-productions2.s3.amazonaws.com/api-evangelist-site/company-logos/proofpoint.png
  description: 'Proofpoint Essentials — the SMB and MSP edition of the platform —
    exposes the same /v2/siem shape as TAP on its own regional hosts, returning blocked
    and permitted clicks and blocked and delivered messages in syslog or JSON for
    SIEM ingestion. HTTP Basic with a service principal and secret, GET only, same
    rolling 24-hour throttle.'
  humanURL: https://help.proofpoint.com/Essentials/Additional_Resources/API_Documentation/Essentials_Threat_API
  baseURL: https://us-siem.proofpointessentials.com/v2
  tags:
  - SIEM
  - Email Security
  - SMB
  properties:
  - type: APIReference
    url: https://help.proofpoint.com/Essentials/Additional_Resources/API_Documentation/Essentials_Threat_API
  - type: Authentication
    url: authentication/proofpoint-authentication.yml
- aid: proofpoint-pod-log
  name: Proofpoint on Demand (PoD) Log API
  image: https://kinlane-productions2.s3.amazonaws.com/api-evangelist-site/company-logos/proofpoint.png
  description: 'The PoD Log API is Proofpoint''s streaming surface rather than a
    request/response one: a client opens a WebSocket to logstream.proofpoint.com and
    subscribes to either the filter (message) log or the MTA (maillog) stream, then
    receives events continuously. It is the only event-shaped Proofpoint API, and it
    is the one whose documentation is not public — help.proofpoint.com redirects the
    PoD Log API article to a customer login.'
  humanURL: https://help.proofpoint.com/Proofpoint_on_Demand/Log_API
  baseURL: https://logstream.proofpoint.com
  tags:
  - Streaming
  - Logging
  - WebSocket
  properties:
  - type: Documentation
    url: https://help.proofpoint.com/Proofpoint_on_Demand/Log_API
common:
- type: Website
  url: https://www.proofpoint.com/us
- type: DeveloperPortal
  url: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
- type: Documentation
  url: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation
- type: APIReference
  url: https://apidocs.emergingthreats.net/
- type: TermsOfService
  url: https://www.proofpoint.com/us/legal/api-terms-of-use
- type: PrivacyPolicy
  url: https://www.proofpoint.com/us/legal/privacy-policy
- type: Blog
  url: https://www.proofpoint.com/us/blog
- type: Support
  url: https://www.proofpoint.com/us/support-services
- type: Community
  url: https://proofpoint.my.site.com/community/s/
- type: GitHubOrganization
  url: https://github.com/pfptcommunity
- type: Packages
  url: packages/proofpoint-packages.yml
- type: SDKs
  url: packages/proofpoint-packages.yml
- type: CLI
  url: cli/proofpoint-cli.yml
- type: Authentication
  url: authentication/proofpoint-authentication.yml
- type: RateLimits
  url: rate-limits/proofpoint-rate-limits.yml
- type: ErrorCatalog
  url: errors/proofpoint-error-codes.yml
- type: Conventions
  url: conventions/proofpoint-conventions.yml
- type: Lifecycle
  url: lifecycle/proofpoint-lifecycle.yml
- type: Conformance
  url: conformance/proofpoint-conformance.yml
- type: Compliance
  url: https://www.proofpoint.com/us/legal/trust/product-certifications
- type: TrustCenter
  url: security/proofpoint-trust-center.yml
- type: Trust
  url: https://www.proofpoint.com/us/legal/trust
- type: VulnerabilityDisclosure
  url: security/proofpoint-vulnerability-disclosure.yml
- type: Security
  url: https://www.proofpoint.com/us/security/vulnerability-disclosure-policy
- type: DomainSecurity
  url: security/proofpoint-domain-security.yml
- type: Plans
  url: plans/proofpoint-plans-pricing.yml
- type: DataModel
  url: data-model/proofpoint-data-model.yml
- type: LLMsTxt
  url: llms/proofpoint-llms.txt
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
x-enrichment:
  date: '2026-09-13'
  status: enriched
  artifacts_added: 19
  pass: local-v3
x-coverage:
  state: covered
  reason: null
  detail: 'Seven public Proofpoint APIs were documented from the provider''s own public
    reference pages and every artifact below is grounded in a fetched URL. The one wall
    hit was narrow and is recorded in lifecycle/: the Proofpoint on Demand Log API
    article and the help.proofpoint.com section indexes 302 to a customer login while
    their leaf articles stay public.'
  evidence:
  - url: https://help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API
    status: 200
  - url: https://apidocs.emergingthreats.net/
    status: 200
  - url: https://proofpoint.securityeducation.com/api/reporting/documentation/api_project.json
    status: 200
  - url: https://help.proofpoint.com/Proofpoint_on_Demand/Log_API
    status: 302
  checked: '2026-09-13'