<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security API Integrations — API Reference

## CrowdStrike Falcon OAuth2

```python
import requests

CS_URL = "https://api.crowdstrike.com"

# Get OAuth2 token
token_resp = requests.post(f"{CS_URL}/oauth2/token", data={
    "client_id": "your-client-id",
    "client_secret": "your-client-secret",
})
access_token = token_resp.json()["access_token"]
headers = {"Authorization": f"Bearer {access_token}"}

# Query detections
requests.get(f"{CS_URL}/detects/queries/detects/v1", headers=headers)
```

## MISP REST API

```python
MISP_URL = "https://misp.corp.local"
HEADERS = {"Authorization": "your-misp-api-key", "Accept": "application/json"}

# Search attributes (IOCs)
requests.post(f"{MISP_URL}/attributes/restSearch", headers=HEADERS, json={
    "type": {"OR": ["ip-dst", "domain", "sha256"]},
    "tags": ["tlp:white"],
    "published": True,
    "limit": 100,
})
```

## Webhook HMAC Verification

```python
import hashlib
import hmac

def verify(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature)
```

## Resilient Session Builder

```python
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

session = requests.Session()
retry = Retry(total=3, backoff_factor=0.5, status_forcelist=[429, 500, 502, 503])
session.mount("https://", HTTPAdapter(max_retries=retry))
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Integration healthy |
| 1 | Partial sync — some indicators failed |
| 2 | Connection or authentication failure |
