Knowbe4 module

Setup

Configure credentials via environment variables. We recommend sourcing them through 1Password or your secrets manager rather than committing them to the shell rc.

Official API reference

weave commands for this module are checked against the vendor's published API.

KnowBe4 API

Variable	Description	Status
KNOWBE4_API_KEY	Required for authentication.	required
KNOWBE4_SERVER	Required for authentication.	required

Sanity-check the wiring:

weave secrets check
weave knowbe4 --help
weave doctor   # reports KNOWBE4_API_KEY status

Capabilities

What this module can do, by entity and verb. ✓ means a working CLI surface; · means not (yet) wired.

Entity	find	list	show	do	snapshot	diff	apply
campaign	·	✓	·	·	·	·	·
group	·	✓	·	·	·	·	·
user	✓	✓	✓	✓	✓	✓	✓

Commands

Every registered CLI command, grouped by verb. Each example uses placeholder arguments — substitute real values for your environment.

find (1)

find user

read

Find a user by email or id.

weave knowbe4 find user <identifier>

list (3)

list campaigns

read

List phishing campaigns (security tests).

weave knowbe4 list campaigns <arg>

list groups

read

List groups.

weave knowbe4 list groups <arg>

list users

read

List KnowBe4 users.

weave knowbe4 list users <arg>

show (1)

show user

read

Show full user record.

weave knowbe4 show user <user-id>

do (2)

do enroll

write

Enroll user in training (placeholder — confirm campaign in UI).

weave knowbe4 do enroll <user-id>

do unenroll

write

Remove user enrollment.

weave knowbe4 do unenroll <user-id>

snapshot / diff / apply are generated automatically from the State Kinds declared on this module — see the State kinds section below for per-kind details. Workflow: snapshot → edit YAML → diff → apply --yes (or confirm interactively; apply --dry-run previews the same diff).

State kinds

Resources this module can snapshot and diff; apply where the kind supports live writes (see Round-trip per kind). Always run diff before apply; use --yes in automation after review. Files live under .weave-state/knowbe4/.

This module is on the thinner integration path — use snapshot / diff for audit; confirm apply per kind below before relying on writes.

users

snapshot diff apply

KnowBe4 users — email and name via PATCH /v1/users/:id.

Scope: —
Round-trip: Full round-trip — snapshot, diff, apply.

State file skeleton

module: knowbe4
kind: users
items:
  - # <fields specific to this kind — see snapshot output>

Workflows

End-to-end recipes from operators who already run this module in production. Copy, adapt, and put under change-control.

User directory audit

weave knowbe4 snapshot users
weave knowbe4 diff users
weave knowbe4 apply users

List users

weave knowbe4 list users

Terraform parity

For each Terraform resource in the canonical provider, here's the equivalent live-API verb in weave. Use this as a migration cheat-sheet, not a 1:1 contract — weave deliberately stays in the live-state lane, not the desired-state lane.

Terraform resource	weave equivalent
knowbe4_user	weave knowbe4 snapshot/diff/apply users

Troubleshooting & source

Missing credentials

Run weave doctor — it reports which env vars (including KNOWBE4_API_KEY) are set and which are blank.

Unexpected behaviour from a state apply

Re-run weave knowbe4 diff <kind> to confirm the controller's current state, then re-snapshot before the next apply. The driver always re-snapshots before diffing.

Open the source

The module lives at https://github.com/andy-broyles/weavewhatever/tree/main/src/weave/modules/knowbe4. File a bug or feature request at https://github.com/andy-broyles/weavewhatever/issues.