<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Implementing Identity Security Monitoring

## Identity Monitoring APIs

### Microsoft Graph — Activity Reports

| Endpoint | Description |
|---|---|
| `GET /auditLogs/signIns` | Sign-in activity logs |
| `GET /auditLogs/directoryAudits` | Directory audit logs |
| `GET /auditLogs/provisioning` | Provisioning logs |
| `GET /reports/getCredentialUserRegistrationCount` | MFA registration stats |

### Splunk — Identity Monitoring Searches

| Search | Description |
|---|---|
| `index=azure_ad sourcetype=azure:aad:signin` | Entra sign-ins |
| `index=okta sourcetype=okta:log` | Okta system logs |
| `\| tstats count by src_user, action` | Auth summary |

### Agent Script

```bash
# Configure log source
node agent.js configure-source --source-type entra --config '{"tenant": "contoso"}'

# Create dashboard
node agent.js create-dashboard --name "Identity Overview" --metrics auth_failures mfa_bypass privilege_changes

# Create alert
node agent.js create-alert --name "new_admin_detected" --condition "role_grant:global_admin" --severity critical
```
