<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Implementing Identity Threat Detection

## ITDR Platform APIs

### Microsoft Entra ID Protection

| Endpoint | Description |
|---|---|
| `GET /identityProtection/riskDetections` | List risk detections |
| `GET /identityProtection/riskyUsers` | List risky users |
| `POST /identityProtection/riskyUsers/{id}/dismiss` | Dismiss risk |
| `POST /identityProtection/riskyUsers/{id}/confirmCompromised` | Confirm compromise |

### OCSF Identity Activity Schema

| Field | Type | Description |
|---|---|---|
| `activity_id` | integer | Activity type identifier |
| `actor.user` | object | User performing the action |
| `src_endpoint` | object | Source endpoint details |
| `auth_protocol` | string | Authentication protocol used |
| `is_mfa` | boolean | MFA was used |

### Agent Script

```bash
# Create ITDR rule
node agent.js create-rule --name "impossible_travel" --signals geo_anomaly velocity_check --severity high

# Test detection
node agent.js test --rule impossible_travel --data test_events.json

# List sources
node agent.js list-sources
```
