<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Secure IoT Architecture — API Reference

## agent.js CLI

```bash
# Inventory IoT devices
node scripts/agent.js --action inventory --devices devices.json

# Design security controls per device class
node scripts/agent.js --action design --devices devices.json --output controls.json

# Generate network segmentation policies
node scripts/agent.js --action network --devices devices.json --output net-policies.json

# Validate security posture
node scripts/agent.js --action validate --controls controls.json
```

## Device JSON Schema

```json
{
  "id": "sensor-001",
  "name": "Temperature Sensor",
  "profile": "constrained | standard | gateway",
  "tpm": false,
  "firmware": "1.0.3",
  "firmware_age_days": 400,
  "default_credentials": true
}
```

## Device Security Profiles

| Profile | Protocol | Auth | TLS | Secure Boot | OTA |
|---------|----------|------|-----|-------------|-----|
| constrained | CoAP | PSK | DTLS 1.2 | No | No |
| standard | MQTT | X.509 | TLS 1.3 | Yes | Yes |
| gateway | HTTPS | X.509 mTLS | TLS 1.3 | Yes | Yes |

## Network Segments

| Segment | VLAN | Allowed Destinations |
|---------|------|---------------------|
| iot-constrained | 100 | IoT gateway (UDP 5684) |
| iot-standard | 101 | IoT gateway (TCP 8883) |
| iot-gateway | 102 | Cloud endpoint (TCP 443) |
