<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Implementing Incident Automation Framework

## Endpoints

| Endpoint | Method | Purpose |
|---|---|---|
| `POST /api/automation/playbooks` | POST | Register a new playbook |
| `POST /api/automation/execute` | POST | Execute a playbook against an alert |
| `GET /api/automation/playbooks` | GET | List all registered playbooks |
| `GET /api/automation/health` | GET | Check integration health status |
| `GET /api/automation/executions/{id}` | GET | Get execution audit log |

## Agent Script

```bash
node agent.js execute --playbook phishing-response \
  --alert-json '{"type":"phishing","severity":"high","hostname":"WS-042"}' --dry-run
node agent.js list-playbooks
node agent.js check-integrations
```
