Integration

KnowBe4 User Events integration

KnowBe4 User Event API: push security-related events about your users from external tools into a KnowBe4 security awareness (KSAT) console, where they appear on the user's timeline and, with a risk factor, change the user's Risk Score; also list, read and delete those events, manage custom event types and check the processing status of submitted events. Available on Platinum, Diamond, SAT Foundation and SAT Advanced subscriptions, limited to 10 calls per licensed seat per day. Posting a batch of events in one call and deleting events in bulk by filter are not exposed (one event per call). Reading users, phishing and training data is the separate KnowBe4 (Reporting API) integration. Authentication is a User Event API key (its own console, not the Reporting API key) sent as a Bearer token, plus the server region of the account.

Connect KnowBe4 User Events How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in KnowBe4 User Events.Built from the 11 KnowBe4 User Events tools below, on the connection you add once.

What you can do with KnowBe4 User Events

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Event type, 5 operations

create_event_typeCreate event typePOSTCreates a new custom event type in the KnowBe4 account (name and optional description). Events can then be pushed with it through create_event.
delete_event_typeDelete event typeDELETEDeletes one event type from the KnowBe4 account for real (id from list_event_types).
get_event_typeGet event typeGETReturns one event type by id (from list_event_types): id, name and description.
list_event_typesList event typesGETLists the event types defined in the KnowBe4 account (id, name, description). Filter by name.
update_event_typeUpdate event typePUTChanges the name and/or description of an existing event type for real (id from list_event_types). Both fields are optional; KnowBe4 does not document whether an omitted field keeps its value, so send both to be safe.

Event, 4 operations

create_eventCreate eventPOSTPushes one event about a user into KnowBe4 for real: it shows on the user's timeline, a factor changes their Risk Score, and security_coach sends it on to SecurityCoach. Returns a status id: read it with get_event_status.
delete_eventDelete eventDELETEDeletes one event from the KnowBe4 account for real (id from list_events).
get_eventGet eventGETReturns one event by id (from list_events or get_event_status): user, event type, source, external id, description, occurred date, risk factor and risk details.
list_eventsList eventsGETLists the events pushed into the KnowBe4 account, filtered by event type name, target_user (email), external_id, source or occurred_date. Paginate with page and per_page (max 100); sort with order_by and order_direction.

Status, 2 operations

get_event_statusGet event statusGETReturns the processing status of one create_event request (its returned id): the event ids created (details.events), per account, the failures and when it was processed. Events are processed asynchronously.
list_event_statusesList event statusesGETLists the processing statuses of submitted event requests: for each, the event ids created, the events per account and the failures. Filter by processed date; paginate with page and per_page (max 100).

Use KnowBe4 User Events from Claude Code, Cursor or Codex

Connect KnowBe4 User Events in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its KnowBe4 User Events operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect KnowBe4 User Events

Create your workspace
Sign up free. Nothing to install.
Connect KnowBe4 User Events once
Add your KnowBe4 User Events connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.