<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing SOC Shift Handoff

## SIEM Shift Summary APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Splunk ES | `GET /services/notable_update` | Retrieve open notables for shift |
| Splunk ES | `POST /services/notable_update` | Reassign notable ownership |
| Elastic | `POST /api/detection_engine/signals/status` | Bulk update alert assignees |
| Sentinel | `PUT /incidents/{id}` | Transfer incident ownership |

## Ticketing System APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| ServiceNow | `GET /api/now/table/incident?assigned_to={user}` | List analyst open tickets |
| ServiceNow | `PUT /api/now/table/incident/{sys_id}` | Reassign ticket |
| Jira | `GET /rest/api/3/search?jql=assignee={user}` | Query open issues |
| Jira | `PUT /rest/api/3/issue/{key}/assignee` | Transfer assignment |

## Communication APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| Slack | `POST /api/chat.postMessage` | Post handoff summary to channel |
| Teams | `POST /v1.0/teams/{id}/channels/{id}/messages` | Post handoff brief |

## Agent Script

```bash
# List handoff sections
node agent.js sections

# Generate handoff template
node agent.js template --outgoing "analyst-a" --incoming "analyst-b" --shift "day-2026-03-17"

# Validate handoff completeness
node agent.js validate --completed active_incidents queue_status environment
```
