<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Timeline Reconstruction

## SIEM APIs

| Platform | Endpoint | Purpose |
|----------|---------|---------|
| Splunk | `POST /services/search/jobs` | Execute search |
| Elastic | `POST /{index}/_search` | Query events |
| Sentinel | `POST /query` | KQL query |

## Confidence Levels

| Level | Definition |
|-------|-----------|
| CONFIRMED | Directly observed in logs |
| CORROBORATED | 2+ sources support |
| INFERRED | Logically derived |
| UNVERIFIED | Single source |

## Agent Script

```bash
node agent.js normalize --events-json '[{"timestamp":"2026-01-15T08:12:00-07:00","source":"auth"}]'
node agent.js build --events-json '[{"timestamp":"2026-01-15T08:12:00Z","source":"auth","description":"Failed login"}]'
node agent.js gaps --events-json '[{"timestamp":"2026-01-15T08:00:00Z"},{"timestamp":"2026-01-15T10:00:00Z"}]'
```
