<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing SOC Knowledge Base

## Wiki Platform APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Confluence | `POST /wiki/rest/api/content` | Create knowledge article |
| Confluence | `PUT /wiki/rest/api/content/{id}` | Update article |
| Confluence | `GET /wiki/rest/api/content/search?cql=text~"query"` | Search KB |
| Wiki.js | `POST /graphql` (mutation: pages.create) | Create page |
| Wiki.js | `POST /graphql` (query: pages.search) | Search pages |
| GitBook | `POST /v1/spaces/{space}/content` | Create content |

## Version Control APIs (Git-backed KB)

| Operation | Command | Purpose |
|---|---|---|
| Create | `git add runbooks/new-runbook.md && git commit` | Add runbook |
| Update | `git diff HEAD~1 -- runbooks/` | Review changes |
| History | `git log --oneline -- runbooks/{file}.md` | Audit trail |
| Review | `gh pr create --title "Update phishing runbook"` | Peer review |

## Search and Analytics

| Platform | Endpoint | Purpose |
|---|---|---|
| Confluence | `GET /wiki/rest/api/analytics/content/{id}/views` | Article usage |
| Elasticsearch | `POST /kb-index/_search` | Full-text search |
| Algolia | `POST /1/indexes/{index}/query` | Search-as-you-type |

## Agent Script

```bash
# List KB sections
node agent.js sections

# Audit runbook coverage
node agent.js audit --section runbooks --total 25 --documented 18

# Check review schedule
node agent.js review --section detection_logic --days-since-update 45

# Generate runbook scaffold
node agent.js scaffold --incident-type "Ransomware"
```
