<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Implementing Identity Zero Trust

## Zero Trust Identity APIs

### Microsoft Graph — Continuous Access Evaluation

| Endpoint | Description |
|---|---|
| `GET /identity/conditionalAccess/policies` | CA policies |
| `GET /identity/continuousAccessEvaluationPolicy` | CAE policy |
| `PATCH /identity/continuousAccessEvaluationPolicy` | Update CAE |
| `GET /privilegedIdentityManagement/azureResources/roleAssignments` | PIM assignments |

### NIST 800-207 Compliance Checks

| Check | API Source | Threshold |
|---|---|---|
| MFA all users | Graph: authenticationMethods | 100% enrollment |
| No legacy auth | Graph: conditionalAccess | Block legacy protocols |
| CA coverage | Graph: conditionalAccess | All apps covered |
| PIM enabled | Graph: PIM | All admin roles |
| CAE enabled | Graph: CAE policy | Enabled for all |

### Agent Script

```bash
# Assess ZT maturity
node agent.js assess-maturity --tenant contoso.onmicrosoft.com

# Create ZT policy
node agent.js create-policy --name "block_legacy_auth" --conditions '{"protocols": ["legacy"]}' --enforcement block

# Evaluate compliance
node agent.js evaluate-compliance --scope all_identities
```
