<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Configuration Compliance Scanning

## OpenSCAP CLI

| Command | Description |
|---|---|
| `oscap info <datastream>` | List available profiles in SCAP content |
| `oscap xccdf eval --profile <id> <ds>` | Evaluate system against profile |
| `oscap xccdf generate fix --fix-type bash` | Generate bash remediation script |
| `oscap xccdf generate fix --fix-type ansible` | Generate Ansible remediation |
| `oscap oval eval <oval.xml>` | Evaluate OVAL definitions |

## Lynis CLI

| Command | Description |
|---|---|
| `lynis audit system` | Full system audit |
| `lynis audit system --quick` | Quick audit (skip interactive) |
| `lynis audit system --tests-from-group <grp>` | Specific test group |
| `lynis audit system --pentest` | Pentest-oriented profile |
| `lynis show profiles` | List available profiles |

## Nessus Compliance API

| Endpoint | Description |
|---|---|
| `POST /scans` | Create compliance scan with policy |
| `GET /scans/{id}/export?chapters=compliance` | Export compliance results |
| `GET /policies` | List available compliance policies |

## Agent Script

```bash
# OpenSCAP CIS scan
node agent.js oscap /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server

# Lynis audit
node agent.js lynis --group authentication

# Generate fix script
node agent.js generate-fix compliance_results.xml --type bash

# Parse results
node agent.js parse compliance_results.xml
```
