<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Email Security Monitoring

## Microsoft 365 Management Activity API

| Endpoint | Description |
|---|---|
| `/api/v1.0/{tenant}/activity/feed/subscriptions/content` | Retrieve audit log content |
| `Operation: New-InboxRule` | Inbox rule creation events |
| `Operation: Set-Mailbox` | Mailbox property changes |
| `Operation: MailItemsAccessed` | Mail item access (E5) |

## Exchange PowerShell

| Command | Description |
|---|---|
| `Get-MessageTrace` | Retrieve message trace logs |
| `Get-MailboxAuditLog` | Mailbox audit events |
| `Get-InboxRule -Mailbox <user>` | List inbox forwarding rules |
| `Search-UnifiedAuditLog -Operations New-InboxRule` | Search for rule creation |

## DMARC/SPF/DKIM

| Record | DNS Type | Purpose |
|---|---|---|
| `_dmarc.domain.com` | TXT | DMARC policy |
| `domain.com` | TXT | SPF record |
| `selector._domainkey.domain.com` | TXT | DKIM public key |

## Agent Script

```bash
# Parse DMARC report
node agent.js parse-dmarc reports/dmarc-aggregate.xml

# Analyze email headers
node agent.js analyze-headers headers/suspicious.txt

# Generate phishing detection query
node agent.js generate-detection --type phishing
```
