<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Just-in-Time Access — API Reference

## Azure AD PIM (Microsoft Graph)

```bash
# List eligible role assignments
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleInstances" \
  | jq '.value[] | {principalId, roleDefinitionId, startDateTime, endDateTime}'

# Activate eligible role
curl -s -X POST -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests" \
  -d '{
    "action": "selfActivate",
    "principalId": "USER_OBJECT_ID",
    "roleDefinitionId": "ROLE_DEF_ID",
    "directoryScopeId": "/",
    "justification": "Incident IR-2026-0042 response",
    "scheduleInfo": {
      "startDateTime": "2026-01-15T10:00:00Z",
      "expiration": {"type": "AfterDuration", "duration": "PT4H"}
    }
  }'

# List PIM activation history (audit log)
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?\
\$filter=activityDisplayName eq 'Add member to role completed (PIM activation)'" \
  | jq '.value[] | {activityDateTime, initiatedBy, targetResources}'
```

## AWS STS

```bash
# Assume role with MFA and session policy
aws sts assume-role \
  --role-arn arn:aws:iam::ACCOUNT:role/JIT-Admin \
  --role-session-name "jit-$(whoami)-$(date +%s)" \
  --duration-seconds 3600 \
  --serial-number arn:aws:iam::ACCOUNT:mfa/username \
  --token-code MFA_CODE

# Get session token (for MFA-protected API access)
aws sts get-session-token \
  --duration-seconds 900 \
  --serial-number arn:aws:iam::ACCOUNT:mfa/username \
  --token-code MFA_CODE
```

## HashiCorp Vault

```bash
# Request dynamic database credentials
vault read database/creds/readonly

# Check lease TTL
vault lease lookup LEASE_ID

# Revoke credentials early
vault lease revoke LEASE_ID

# List active leases
vault list sys/leases/lookup/database/creds/readonly
```

## Key Metrics

| Metric | Target | Alert Threshold |
|--------|--------|-----------------|
| Standing admin assignments | 0 | > 2 |
| Average activation duration | < 4 hours | > 8 hours |
| Activations without justification | 0% | > 5% |
| Time to approval | < 15 min | > 60 min |
| Unused eligible assignments | < 10% | > 30% |
