<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Detecting Identity Governance Violations

## Identity Governance APIs

### Microsoft Graph — Identity Governance

| Endpoint | Description |
|---|---|
| `GET /identityGovernance/accessReviews/definitions` | List access reviews |
| `POST /identityGovernance/accessReviews/definitions` | Create access review |
| `GET /identityGovernance/entitlementManagement/accessPackages` | Access packages |
| `GET /identityGovernance/appConsent/appConsentRequests` | App consent requests |

### SailPoint IdentityNow API

| Endpoint | Description |
|---|---|
| `GET /v3/roles` | List roles |
| `GET /v3/access-profiles` | List access profiles |
| `POST /v3/certifications` | Create certification campaign |
| `GET /v3/sod-violations` | List SoD violations |

### Agent Script

```bash
# Scan for SoD violations
node agent.js scan-sod --policies sod_matrix.json

# Detect orphaned accounts
node agent.js detect-orphans --tenant contoso.onmicrosoft.com

# Audit privilege drift
node agent.js audit-drift --baseline privilege_baseline.json
```
