## Hoxhunt integration

Hoxhunt is a security-awareness and human risk management platform that runs adaptive phishing simulations and training, and lets security teams triage user-reported emails through its SOC incident workflow. It exposes a GraphQL API for reading organizations, users, training quests, incidents, threats, and feedback rules, and for orchestrating incident response. Integrating Hoxhunt with Frontegg lets your application query training and threat data and manage incidents on behalf of your users through a single admin access token.

Prerequisites
- A Hoxhunt account with the **Admin** or **Role Management Admin** role — only these roles can generate access tokens
- Some incident operations (notes, tags, SOC classification, feedback) require an **Incident Orchestration** license
- The Hoxhunt API is GraphQL-only and authenticates with the `Authorization: Authtoken <token>` header


### Connect Hoxhunt

#### Step 1: Sign in to the Hoxhunt admin console

Go to [https://admin.hoxhunt.com](https://admin.hoxhunt.com) and sign in with an account that has the Admin or Role Management Admin role.

#### Step 2: Open the access tokens page

Open **Account settings** and select the **Access tokens** section, or go directly to [https://admin.hoxhunt.com/account-settings/access-tokens](https://admin.hoxhunt.com/account-settings/access-tokens).

#### Step 3: Generate a new access token

Click to create a new token, give it a descriptive name such as `Frontegg Integration`, and confirm. Hoxhunt generates the token and ties it to your user account.

Tokens are tied to your user
Access tokens inherit the permissions of the user who created them and are revoked if that user is removed or loses the required role. Use a dedicated service admin account if you want the integration to remain stable across staff changes.

#### Step 4: Copy the access token

Hoxhunt displays the token once. Copy the value and store it in a safe location — you will not be able to view it again after leaving the page.

Keep your credentials secure
The access token is shown only at creation time. Never share it or commit it to version control. Anyone with the token can read and modify your organization's Hoxhunt data.

### Configure the Frontegg portal

Once you have your access token from the steps above, enter it in the integration configuration page of the Frontegg portal:

1. Open the **Frontegg portal** and navigate to [ENVIRONMENT] → Integrations → Hoxhunt.
2. Paste the token into the **API Key** field.
3. Click **Save**.


### What you can do with this integration

- **Users and organizations** — list users and the organizations accessible to the connected account, with search, filtering, and paging.
- **Training quests** — list the phishing simulations and training sent to users.
- **Incidents** — list SOC incidents and update their state, notes, tags, SOC classification, and sensitivity, or send feedback to reporters.
- **Threats** — list user-reported threats and threat observables (indicators of compromise).
- **Feedback rules** — list the automated feedback rules configured in your organization.


Incident orchestration
Incident mutations — adding notes and tags, setting SOC classification or sensitivity, sending SOC feedback, and removing threats — require an Incident Orchestration license on your Hoxhunt account.

### Additional resources

- [Hoxhunt GraphQL API documentation](https://app.hoxhunt.com/docs/graphql-external/)
- [Hoxhunt API help center](https://support.hoxhunt.com/hc/en-us/sections/11930695623836-Hoxhunt-API)
- [How to get your Redirect URL](/agen-for-work/connectors/redirect-url)