<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Identity Analytics Platform

## UEBA and Analytics Platforms

### Microsoft Sentinel UEBA

| Table | Description |
|-------|-------------|
| `BehaviorAnalytics` | Entity behavior anomaly events |
| `IdentityInfo` | User identity enrichment data |
| `IdentityDirectoryEvents` | Directory change events |
| `IdentityLogonEvents` | Authentication events |
| `IdentityQueryEvents` | Directory query activities |

### Exabeam API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/auth/sessions` | GET | User session timelines |
| `/api/risks/users` | GET | User risk scores |
| `/api/entities/users/{id}/events` | GET | User event history |
| `/api/rules` | GET | Analytics rules inventory |
| `/api/watchlists` | GET | Monitored entities |

## Identity Governance APIs

### SailPoint IdentityNow

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/v3/search` | POST | Search identities and access |
| `/v3/access-profiles` | GET | List access profiles |
| `/v3/roles` | GET | List roles |
| `/v3/certifications` | GET | Access certification campaigns |
| `/beta/role-mining-sessions` | POST | Start role mining |

### Saviynt API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/ECM/api/v5/getUser` | POST | Get user details |
| `/ECM/api/v5/getEntitlements` | POST | List entitlements |
| `/ECM/api/v5/analytics/runAnalytics` | POST | Execute analytics job |
| `/ECM/api/v5/certifications` | GET | Certification campaigns |

## Data Pipeline Components

| Component | Technology | Purpose |
|-----------|-----------|---------|
| Ingestion | Kafka, Kinesis | Real-time event streaming |
| Processing | Spark, Flink | Stream/batch analytics |
| Storage | Elasticsearch, ClickHouse | Time-series event storage |
| ML Models | scikit-learn, PyTorch | Anomaly detection |
| Visualization | Grafana, Kibana | Risk dashboards |
