Workflows, Hiring & HRTraining, Phishing & Policy Signing

On this page0

Unfamiliar word? See Glossary: words used in these docs. Looking for the tasks in order? Begin at Start Here.

Reference

Included in: Team and Advanced. Which Plan Includes What

Training, Phishing & Policy Signing

Training gives each person one list of what they have to read, watch, answer or sign, and gives whoever runs training the other side of it: courses, learning paths, a starter library, a roster of who is late, phishing simulation and the policies people sign.

A course can be a link to training held elsewhere, or text, video and questions held in Zonitix itself.

One List For Each Person

My to-do needs no permission. It shows a person their training under To do and Done, with the policies they are asked to sign in the same list. A manager sees what is open and overdue for the people below them in the reporting line, also without a permission. Building courses, assigning them and chasing them is a permission, listed in the technical part of this page.

Which Plan Includes What

Courses, learning paths, the starter library and phishing simulation are on Team and Advanced. Policy signing is available from Team. The Compliance Hub’s registers, and the automatic feed of completions and signatures into audit evidence, are Advanced. My WorkMy to-do is on every plan; without the licensed modules it is simply empty. On a plan without Training the TRAINING menu section is not shown. All Zonitix pricing is per instance, never per seat.

Where Everything Is In The Menu

Training has its own menu section, TRAINING, because HR runs it in some companies and security in others. The section appears for people whose role includes the training permission or the phishing-simulation permission, and each person sees only the pages their permission covers. The permission names are in the technical part of this page.

For Everyone: My Work

My WorkMy to-do is each person’s own list of training to do and policies to sign. My WorkMy Team appears for anyone with people reporting to them, and shows each person’s open training and policies in their row.

Overview

TrainingOverview starts with “Needs attention”: what is overdue, with a “Remind all” button next to it. Below are three headline numbers, a card for each course and each policy to sign, and the picture “By department”. Needs the training permission.

Courses And Paths

TrainingCourses is where courses are written, edited, assigned and retired, and where the “Library” opens. TrainingPaths holds learning paths: courses done in order. Both need the training permission.

People

TrainingPeople is the roster across every course: the “Who is late” list, with filters, a CSV download, a signed roster PDF for one course and actions on several rows at once. Needs the training permission.

Policy Signatures And Phishing Simulation

TrainingPolicy Signatures is shown to people with the training permission. TrainingPhishing Simulation has its own permission; the training permission does not open it. Each has its own page: Policy Signing and Phishing Simulation.

Settings

TrainingSettings has three cards: “Reminders”, “Import completions” and “Exemptions”. Needs the training permission.

The Pages Of This Reference

The detail of training is on its own pages, one per subject. Each opens with a short description in plain words, followed by the technical part. The permissions and the typed fields of the API objects are in the technical part of this page.

Training Courses: what a course is made of, knowledge checks, the starter library, assigning, reminders and completion.
Learning Paths, Imports & Exemptions: learning paths, importing completions from another system, SCORM packages and exemptions.
Phishing Simulation: practice phishing emails, what is recorded and what the person sees.
Policy Signing: when a signature is due, signed copies and rosters, and how signatures become compliance evidence.

What It Is Not

Not A Full SCORM Platform

Only SCORM 1.2 packages with a single lesson can be imported. SCORM 2004 and packages with several lessons are refused. A lesson’s score is not recorded and a person cannot carry on where they left off. Uploaded video and SCORM import are part of the preview and not yet validated end-to-end.

Not Proof That A Video Was Watched

“Must watch” holds the person at the video in their browser. The server does not record or check it. What counts as evidence is the way the course is marked done: the tick, the knowledge check or the certificate.

Not A Long Annual Course

The 13 library courses are short: each is described as about 8 to 12 minutes of reading and questions, with a video of roughly a minute. They are starting texts written to be generally true for an office-based company. Read each one and make it yours before people get it.

If something here is not working as you expect, start with When something goes wrong.

The plain explanation is above. This part is for IT and developers: the exact settings, permission names, API addresses and data fields behind it. Closed: select the heading above to open it. While it is closed, your browser’s find-on-page (Ctrl+F or Cmd+F) does not search this part.

Permissions

Training is run by HR in some companies and by security in others, so two built-in roles hold manage_employee_training out of the box: hr_manager and security_analyst. Phishing simulation is security’s own right and hr_manager does not hold it. The administrator role holds every permission. Give any of them to other people through a role in Access Control.

Permission	Plan	Built-in Roles	What It Allows
manage_employee_training	Team	hr_manager, security_analyst	Write, edit and retire courses, use the library, assign, build learning paths, see the roster and its CSV, download the signed roster of a course, remind, mark done for someone, import completions, change the reminder settings and record exemptions from a course. Opens every page of the Training section except Phishing Simulation.
manage_phishing_simulation	Team	security_analyst	Open Training → Phishing Simulation. The training permission alone does not open it.
manage_compliance	Team	security_analyst	Add, edit and delete entries in the policy register, read who has signed a policy and download its signed roster, download everything on record for one person as a PDF, and record exemptions from a policy or a course. The rest of the Compliance Hub this permission opens is on Advanced.
No permission needed	All plans	Every signed-in person	A person’s own My to-do: do their training, answer their own knowledge check, upload their own certificate, download their certificate of completion and sign their policies.
No permission needed	Team	Anyone with people reporting to them	A manager’s read-only view of what is open and overdue for the people below them in the reporting line. A manager cannot complete training for them.

Courses, learning paths, the starter library and phishing simulation are the training licence entitlement. On a plan without it the Training API routes answer 403.

Data Objects (Typed Fields)

In plain words: a call to the API answers with objects such as a training item, one person’s assignment, a learning path or a phishing simulation. This section lists what is inside each one: every field, its type, and whether it can be empty. Open an object to see its fields. The routes that return them are in the API reference under Training: Courses, Learning Paths & Imports and Phishing Simulation, where a capitalised name in a row’s returns line is one of these objects.

Types. integer, number, string, boolean, object and arrays written as string[]. string (date-time) is ISO 8601; string (date) is YYYY-MM-DD. A type followed by a colon and values separated by | takes only those values. A capitalised type is another object in this list.
The third column. “nullable” means the field can be null; “optional” means the key can be missing; “no” means neither. Do not fail on a field you do not recognise: a reply can carry fields beyond these. A card marked “request body” is what you send, not what comes back: its third column is headed Required, where “required” means the field must be sent and every other field is optional.
Never returned: the correct answers of a knowledge check. TrainingQuiz carries the questions and the options only.

TrainingCoursein a reply21 fields

A training item. The correct answers of its knowledge check are never part of this object.

Field	Type	Null / optional / read-only	Note
id	integer	no
title	string	no
description	string	nullable
url	string	nullable
renewEveryMonths	integer	nullable
isActive	boolean	no	false for a retired item.
content	string	nullable	The text to read; up to 20,000 characters.
autoAssign	boolean	no
dueDays	integer	no
proof	string	no	What finishing takes; none when nothing is asked.
securityAwareness	boolean	no
securityAwarenessSince	string (date)	nullable
topic	string	nullable	The compliance topic the item counts under.
topicLabel	string	nullable
videoUrl	string	nullable
videoRequired	boolean	no
hasVideoFile	boolean	no
scorm	object	nullable	{ title:string\|null, launch:string, files:integer, bytes:integer, importedAt:string (date-time)\|null }.
audience	object	nullable	{ kind: "everyone" } or { kind: "rule", departments:string[], positions:string[], locations:string[] }; null when people are assigned by hand.
audienceText	string	no	The same audience in words.
quiz	TrainingQuiz	nullable

TrainingQuizin a reply6 fields

A knowledge check as a person sees it: questions and options only.

Field	Type	Null / optional / read-only	Note
passMark	integer	no
maxAttempts	integer	nullable	Tries per day; null when unlimited.
perTry	integer	nullable	How many questions one try draws from the pool.
draw	string	optional	Present on one person's try: identifies the questions drawn. Send it back with the answers.
pool	integer	optional	Present with draw.
questions	object[]	no	Each { id, text:string, options:string[], example? }.

TrainingAssignmentin a reply15 fields

Field	Type	Null / optional / read-only	Note
id	integer	no
courseId	integer	no
userId	integer	no
dueDate	string (date)	nullable
status	string	no	assigned or completed.
completedAt	string (date-time)	nullable
lastCompletedAt	string (date-time)	nullable
expiresAt	string (date)	nullable	When a completion that has to be renewed runs out.
overdue	boolean	no	Worked out on each read: assigned, past its due date, and the item is not retired.
acknowledgedAt	string (date-time)	nullable
hasCertificate	boolean	no
quizTriesLeft	integer	nullable	null when tries are not limited or the item was not loaded.
quiz	TrainingQuiz	nullable	This try's questions, only while the item is still to be done.
course	TrainingCourse	nullable
exemptUntil	string (date)	optional	Present only on an open item the person is excused from; overdue is then false.

LearningPathin a reply10 fields

Field	Type	Null / optional / read-only	Note
id	integer	no
title	string	no
description	string	nullable
isActive	boolean	no	false for a paused path.
autoAssign	boolean	no
autoAssignFrom	string (date)	nullable
steps	object[]	no	Each { courseId:integer, position:integer, title:string, isActive:boolean, dueDays:integer }, in order.
people	integer	optional	In the path list only: active members.
finished	integer	optional	In the path list only.
percent	integer	optional	In the path list only: finished as a whole percentage of people.

PhishingCampaignin a reply20 fields

A practice phishing simulation with its totals.

Field	Type	Null / optional / read-only	Note
id	integer	no
title	string	no
templateKey	string	no
difficulty	string	nullable
subject	string	no
status	string: draft \| pending_approval \| approved \| sending \| sent \| cancelled	no
createdBy	string	no
createdById	integer	nullable
approvedBy	string	nullable
approvedAt	string (date-time)	nullable
sendAt	string (date-time)	nullable
sentAt	string (date-time)	nullable
courseId	integer	nullable	The training item a person who clicks is pointed to.
resultsPrunedAt	string (date-time)	nullable
recipients	integer	no
sent	integer	no
clicked	integer	no
reported	integer	no
clickRate	integer	nullable	A whole percentage of emails sent; null when none was sent.
reportRate	integer	nullable	A whole percentage of emails sent; null when none was sent.

TrainingCourseWriterequest body14 fields

Create and update take the same keys. A course with a topic must be redone at least every 12 months and cannot use proof none.

Field	Type	Required	Note
title	string	required
description	string	optional, null clears it	At most 2000 characters.
url	string	optional, null clears it	An http or https address, at most 1000 characters.
content	string	optional	The text of the course, at most 20000 characters.
proof	string: none \| acknowledge \| certificate \| quiz	optional	How a person marks it done. Default none.
quiz	object	optional	The knowledge check. With proof quiz it needs at least one question.
renewEveryMonths	integer	optional, null clears it	1 to 120.
dueDays	integer	optional	Days to finish, 1 to 365. Default 30.
topic	string	optional, null clears it	One of the training topics the instance lists.
autoAssign	boolean	optional	Default false.
isActive	boolean	optional	Default true. false retires the course.
videoUrl	string	optional
videoRequired	boolean	optional	Takes effect only when the course has a video.
audience	object	optional	Who autoAssign applies to.

LearningPathWriterequest body5 fields

Field	Type	Required	Note
title	string	required
courseIds	integer[]	required	2 to 20 courses in order, each once, none retired.
description	string	optional, null clears it	At most 2000 characters.
isActive	boolean	optional	Default true.
autoAssign	boolean	optional	Default false.

PhishingCampaignWriterequest body5 fields

Field	Type	Required	Note
templateKey	string	required	One of the built-in templates.
title	string	optional	Cut to 160 characters. Defaults to the name of the template.
userIds	integer[]	required	1 to 2000 active people.
courseId	integer	optional, null clears it	A training course in use, linked to the simulation.
sendAt	string (date-time)	optional, null clears it	When to send.

TrainingCompleterequest body2 fields

Field	Type	Required	Note
acknowledged	boolean	optional	Must be true when you finish your own item that asks you to confirm you have read it.
reason	string	optional	Read when HR marks an item done for someone else; cut to 500 characters.

LibraryAdoptrequest body1 field

Field	Type	Required	Note
replace	boolean	optional	true gives a training item you already have under the same title the library text and knowledge check. Only the value true counts.

TrainingAssignrequest body4 fields

Field	Type	Required	Note
audience	string: everyone \| department \| people	required	Any other value is refused with 400.
department	string	required for department
userIds	integer[]	required for people	At most 2,000 ids.
dueDate	string (date)	optional	Default: the item's days to finish, counted from today.

TrainingBatchFilterrequest body3 fields

Selects every assignment on the roster that matches, in place of a list of ids.

Field	Type	Required
courseId	integer	optional
department	string	optional
status	string	optional

TrainingBatchActionrequest body5 fields

Field	Type	Required	Note
action	string: remove \| due \| remind \| complete	required	Any other value is refused with 400.
ids	integer[]	optional	At most 2,000 assignment ids. When empty or left out, filter is read.
filter	TrainingBatchFilter	optional	Read only when ids is empty or left out.
dueDate	string (date)	required for due
reason	string	optional	Cut to 500 characters. Needed to remove open security-awareness training from someone, or to move its deadline later; without it that assignment is listed in skipped.

CompletionRowrequest body2 fields

Field	Type	Required	Note
email	string	required	Matched to an active person without regard to letter case. An address listed twice is used once.
completedAt	string (date)	required	YYYY-MM-DD; not in the future and not more than 5 years ago.

CompletionsImportrequest body2 fields

Field	Type	Required	Note
source	string	required	Where the completions come from; at least 3 characters, cut to 200.
rows	CompletionRow[]	required	1 to 5,000 rows. A row that cannot be used is listed in skipped with its reason.

PathMembersAddrequest body2 fields

Field	Type	Required	Note
userIds	integer[]	optional	At most 500 people. Send this or userId.
userId	integer	optional	One person; read only when userIds is not a list.

PhishingReportrequest body2 fields

Says which practice email you are reporting. Only your own practice email can match; nothing you send is stored.

Field	Type	Required	Note
token	string	optional	The link in the email, or the 64-character code at the end of it.
campaign	integer	optional	A simulation id; read when token is absent or not a valid code.

Related reference

HR Checks, Limits & Data Objects

Training Courses