<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Performing API Threat Modeling — API Reference

## agent.js CLI

```bash
node scripts/agent.js --action analyze --input openapi.yaml
node scripts/agent.js --action enumerate --input openapi.yaml
node scripts/agent.js --action threats --input endpoints.json
node scripts/agent.js --action report --input threats.json --output report.json
```

## OWASP API Top 10 Mapping

| ID | Risk | Default Severity |
|----|------|-----------------|
| API1 | Broken Object Level Authorization | critical |
| API2 | Broken Authentication | critical |
| API3 | Broken Object Property Level Authorization | high |
| API4 | Unrestricted Resource Consumption | high |
| API5 | Broken Function Level Authorization | critical |

## Endpoint JSON Schema

```json
{
  "path": "/api/users/{id}",
  "method": "GET",
  "has_auth": true,
  "parameters": 1,
  "request_body": false
}
```
