<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Root Cause Analysis

## RCA Endpoints

| Endpoint | Method | Purpose |
|---|---|---|
| `POST /api/rca` | POST | Create RCA record |
| `GET /api/rca/{incident_id}` | GET | Retrieve RCA report |
| `PUT /api/rca/{id}/actions` | PUT | Update remediation actions |
| `GET /api/rca/overdue` | GET | List RCAs past due date |

## RCA Methods

| Method | Best For | Complexity |
|--------|---------|-----------|
| 5 Whys | Simple causal chains | Low |
| Ishikawa | Multi-factor root causes | Medium |
| Fault Tree | Complex system failures | High |

## Agent Script

```bash
node agent.js five-whys --incident "Data breach" --whys "Unparameterized query" "Bypassed ORM" "No SAST rule"
node agent.js ishikawa --incident "Ransomware" --categories-json '{"technology":["missing patches"],"process":["no change mgmt"]}'
node agent.js template --incident-id INC-2026-0142 --description "Data exfil" --severity S1 --method five_whys
```
