<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing EDR Deployment

## EDR Platform APIs

### CrowdStrike Falcon API

| Endpoint | Method | Description |
|---|---|---|
| `/devices/queries/devices/v1` | GET | Query device IDs by filter |
| `/devices/entities/devices/v2` | GET | Get device details by ID |
| `/policy/queries/prevention/v1` | GET | List prevention policies |
| `/real-time-response/entities/sessions/v1` | POST | Initiate RTR session |

### Microsoft Defender for Endpoint API

| Endpoint | Method | Description |
|---|---|---|
| `/api/machines` | GET | List all onboarded machines |
| `/api/machines/{id}/isolate` | POST | Isolate a machine |
| `/api/machines/{id}/offboard` | POST | Offboard a machine |
| `/api/machineactions` | GET | List machine actions |

### Agent Script

```bash
# Check agent status
node agent.js check-status --service CrowdStrike

# Verify connectivity
node agent.js verify-connectivity --host ts01-b.cloudsink.net --port 443

# Inventory agents
node agent.js inventory
```
