KnowBe4 — Partner Mode

Overview

This integration connects Bumblebee to KnowBe4 through the KSAT Graph API for read-only security awareness reporting. It supports Partner Mode: connect one partner-level KSAT Graph API token from your management admin console; Bumblebee validates it and discovers your entire managed-customer roster automatically — no per-account token entry. This integration is read-only.

Typical questions Bumblebee can answer across your managed accounts:

• "How many customer accounts do I manage, and what's each one's phish-prone percentage?"
• "Which customers have the highest current risk score?"
• "How are risk scores trending across the accounts I manage?"

Discovery vs. deep reporting

A partner token is a discovery and fleet-posture credential. It enumerates your customer roster and returns account-level aggregates per customer (phish-prone %, % of users phished, current risk score, seat counts, campaign counts). It does not itself expose per-campaign click detail, per-recipient outcomes, or risk-score history — those live in the single-account KSAT schema and need a per-tenant reporting token.

There are two distinct kinds of keys:

• The partner API key — created once, in your management (partner) admin account. Used for discovery and posture.
• Tenant API keys — one per managed customer account. Used for that customer's deep reporting. Tenant keys are always Read Only, however they are created.

How the tenant keys come into existence is decided by the scope you choose for the partner key:

• Read/Write partner key (partner_public_kmsat) → automatic. You create the partner key once; Bumblebee then creates a Read Only tenant key for each customer on demand (KnowBe4's apiTokensGenerateJit). Nothing else to enter, ever.
• Read Only partner key (partner_public_kmsat_readonly) → manual. You must create one tenant API key per customer, in that customer's own account, with Scopes = Read Only. In the Managed customer accounts table, click Add key on the customer's row and paste it — Bumblebee verifies the token belongs to that account before saving.

Either way, every key Bumblebee uses for reporting is Read Only — the Read/Write scope on the partner key is used solely to create tenant keys.

Partner Model

You generate one partner token and connect it once. Bumblebee stores it as your discovery credential and reads your roster from KnowBe4 live:

• Connecting the partner token discovers every managed customer account under your partner.
• The managed-accounts table is a live projection of the KnowBe4 accounts roster — add or remove customers in the KnowBe4 console, not in Bumblebee.
• Disconnecting forgets your stored partner token in Bumblebee. It does not delete the token in KnowBe4 — delete it there too if you want it gone entirely.

Prerequisites & Setup

Before setting up this integration, you need:

• Access to your management (partner) admin account in the KnowBe4 console.
• A KnowBe4 subscription tier that includes KSAT Graph API access.

Generate the Partner KSAT Graph API Token

You do this once:

1. Sign in to your management (partner) admin account — the top-level account you use to manage your customers.
2. Open Account Settings → Account Integrations → API.
3. In the Product API section, ensure Enable KSAT Graph API Access is checked, then open the Product API link.
4. On the Product API subtab, click + Create New API Token.
5. Set Products to KSAT, then choose Scopes for this partner key: Read/Write for automatic tenant-key provisioning, or Read Only if you prefer to create one tenant key per customer manually (see Discovery vs. deep reporting above). Give it a name, user, expiration, and active status.
6. Copy the token immediately — KnowBe4 displays it only once. If you navigate away, delete it and create a new one.

Create Tenant API Keys (Read Only partner key only)

Skip this if your partner key is Read/Write — tenant keys are created automatically. Otherwise, for each customer whose detailed reporting you want:

1. Sign in to that customer's KnowBe4 account (not the management console) and open Account Settings → Account Integrations → API → Product API → + Create New API Token.
2. Set Products to KSAT and Scopes to Read Only — tenant keys are always Read Only.
3. In Bumblebee's Managed customer accounts table, click Add key on that customer's row and paste the token.

Identify Your Region

The API base URL depends on where your KnowBe4 partner account is hosted. Match the console URL to a region:

The region defaults to us if not specified.

Configure in Bumblebee

1. Go to the Integrations page in Bumblebee and select KnowBe4 — Partner Mode.
2. In the Connect your partner token form, paste the partner token and choose the Region.
3. Click Connect partner. Bumblebee validates the token against KnowBe4 (an invalid or non-partner token is rejected with an inline error) and reports how many managed accounts it discovered.
4. The Managed customer accounts table lists every discovered customer. It is read from KnowBe4 live — manage the roster in the KnowBe4 console.

Available Tools

All tools are read-only.

Deep per-customer reporting tools (account, users, groups, phishing campaigns / security tests / per-recipient results, training campaigns / enrollments, risk-score history) run against a per-tenant reporting token — minted automatically for a write-scoped partner token, or added per customer for a read-only one. See Discovery vs. deep reporting above.

Notes

• Accounts with anonymization enabled return no user-level data through the API.
• Your partner token is metered against your KnowBe4 API rate limits.