<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Incident Classification Framework

## Classification Endpoints

| Endpoint | Method | Purpose |
|---|---|---|
| `/api/incidents` | POST | Create incident with classification |
| `/api/incidents/{id}/classify` | PUT | Update classification |
| `/api/incidents/{id}/validate` | GET | Validate classification completeness |
| `/api/taxonomy/categories` | GET | List category taxonomy |
| `/api/taxonomy/impacts` | GET | List impact rating scales |

## NIST 800-61 Categories

| Code | Name | Scope |
|------|------|-------|
| CAT-1 | Unauthorized Access | Credential compromise, privesc |
| CAT-2 | Denial of Service | DDoS, resource exhaustion |
| CAT-3 | Malicious Code | Ransomware, trojan, worm |
| CAT-4 | Improper Usage | Policy violations |
| CAT-5 | Scans / Probes | Reconnaissance activity |
| CAT-6 | Investigation | Unconfirmed suspicious activity |

## Severity Derivation

Composite score = functional_impact_index + information_impact_index + recoverability_index

| Composite Score | Severity | Response SLA |
|----------------|----------|-------------|
| 7+ | S1-CRITICAL | 15 min |
| 5–6 | S2-HIGH | 30 min |
| 3–4 | S3-MEDIUM | 2 hr |
| 0–2 | S4-LOW | 8 hr |

## Agent Script

```bash
node agent.js list
node agent.js classify --category CAT-3 --functional-impact HIGH \
  --information-impact CONFIRMED --recoverability EXTENDED
node agent.js validate --ticket-json '{"category":"CAT-1","functional_impact":"HIGH","information_impact":"SUSPECTED","recoverability":"SUPPLEMENTED"}'
```
