<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security Ticket Automation — API Reference

## Jira REST API

```python
import requests

JIRA_URL = "https://jira.corp.local/rest/api/3"
HEADERS = {"Authorization": "Basic <base64>", "Content-Type": "application/json"}

# Create issue
requests.post(f"{JIRA_URL}/issue", headers=HEADERS, json={
    "fields": {
        "project": {"key": "SEC"},
        "summary": "[P1] Brute force on VPN gateway",
        "issuetype": {"name": "Incident"},
        "priority": {"name": "Critical"},
        "labels": ["security", "automated"],
    }
})

# Transition issue (e.g., escalate)
requests.post(f"{JIRA_URL}/issue/SEC-123/transitions", headers=HEADERS, json={
    "transition": {"id": "31"},  # Escalate transition ID
})

# Search with JQL
requests.get(f"{JIRA_URL}/search", headers=HEADERS, params={
    "jql": 'project=SEC AND status="Open" AND priority in (Critical, High)',
})
```

## ServiceNow Incident API

```python
SNOW_URL = "https://corp.service-now.com/api/now/table/incident"

requests.post(SNOW_URL, headers={"Authorization": "Bearer <token>"}, json={
    "short_description": "Security alert: brute force detected",
    "urgency": "1",
    "impact": "2",
    "assignment_group": "SOC Tier 2",
    "category": "Security",
})
```

## PagerDuty Event API

```python
requests.post("https://events.pagerduty.com/v2/enqueue", json={
    "routing_key": "integration-key",
    "event_action": "trigger",
    "payload": {
        "summary": "SLA breach: SEC-123 unresolved after 2 hours",
        "severity": "critical",
        "source": "ticket-automation",
    },
})
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All tickets processed within SLA |
| 1 | SLA breaches detected — escalation triggered |
| 2 | Ticketing platform API failure |
