<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Incident Ticket Management

## ServiceNow Security Incident APIs

| Endpoint | Method | Purpose |
|---|---|---|
| `/api/now/table/sn_si_incident` | POST | Create security incident |
| `/api/now/table/sn_si_incident/{sys_id}` | PUT | Update incident status |
| `/api/now/attachment/file` | POST | Attach evidence files |
| `/api/now/table/sn_si_incident?sysparm_query=active=true` | GET | List active incidents |

## Jira Security Project APIs

| Endpoint | Method | Purpose |
|---|---|---|
| `/rest/api/3/issue` | POST | Create incident issue |
| `/rest/api/3/issue/{key}` | PUT | Update issue fields |
| `/rest/api/3/issue/{key}/transitions` | POST | Transition ticket status |
| `/rest/api/3/issue/{key}/attachments` | POST | Attach evidence |
| `/rest/api/3/search` | POST | Query incidents with JQL |

## SIEM-to-Ticket Integration APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk SOAR | `POST /rest/container` | Create case from notable |
| Elastic Cases | `POST /api/cases` | Create case from alert |
| Sentinel | `POST /incidents/{id}/comments` | Add investigation notes |

## Agent Script

```bash
# List ticket requirements
node agent.js requirements

# Create an incident ticket
node agent.js create --title "Credential harvesting campaign" --severity P2 --category Phishing --alerts "ALERT-001,ALERT-002"

# Validate ticket quality gate
node agent.js validate --status resolved --fields root_cause containment_actions remediation_plan
```
