Connect KnowBe4 to Conduit

This walkthrough connects KnowBe4 (security awareness training, in Conduit’s email-security category) to Conduit. KnowBe4 authenticates with a single API key plus an optional Region selection that tells Conduit which regional KnowBe4 API server your account lives on.

Menu labels can change

The KnowBe4 steps below reflect the Reporting API key flow at time of writing; menu labels can shift between releases. If a label differs, see KnowBe4’s Reporting API overview.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A KnowBe4 admin login able to create a Reporting API key (see KnowBe4’s Reporting API overview).
• To know which region your KnowBe4 account is hosted in — check the domain you sign in to (for example an eu.knowbe4.com address means the eu region). If you’re unsure, it’s most likely us.

Step 1 — Create a Reporting API key in KnowBe4

1. Sign in to your KnowBe4 console as an admin.
2. Create a Reporting API key following KnowBe4’s guide. Expected: an API key value, shown at creation.
3. Copy the key.

Caution

Copy the key now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the key, regenerate it in KnowBe4 first; the exposed key becomes useless immediately.

Step 2 — Connect KnowBe4 in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find KnowBe4 in the catalog (under Email Security) and click Connect. Expected: a credential form with two fields.
3. Fill the fields:
   • API Key (required) — the Reporting API key from Step 1.
   • Region (optional) — a dropdown with us, eu, uk, de, and ca. Pick the region your KnowBe4 account is hosted in (match the domain you sign in to). Leave it blank to use us, the default.
4. Click Connect. Expected: Conduit validates the key immediately against the selected region’s KnowBe4 API and shows a green Connected status. A bad key — or the right key checked against the wrong region — is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this KnowBe4 connection. (For per-technician keys, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only KnowBe4 tool. You should get real data back, and the call appears in your audit log with the correct user, vendor (knowbe4), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid KnowBe4 API key for the selected region.”	Either the key is wrong/revoked, or the key is fine but the Region doesn’t match where your account is hosted. Check the domain you sign in to and reconnect with the matching region.
Connect fails with “KnowBe4 returned HTTP …”	KnowBe4’s API answered with an unexpected status — often a transient service issue. Wait a moment and retry.
Connect fails with “KnowBe4 request failed: …”	Conduit couldn’t reach the KnowBe4 API at all (network error or timeout). Retry; if it persists, check KnowBe4’s service status.
Tool calls return 403 “no credentials for vendor”	KnowBe4 isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a key.
Need to rotate the key	Regenerate the Reporting API key in KnowBe4, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.