<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing SOAR Workflows

## SOAR Platform APIs

| Platform | Endpoint | Purpose |
|---|---|---|
| XSOAR | `POST /incident` | Create incident |
| XSOAR | `POST /incident/investigate` | Run playbook on incident |
| XSOAR | `GET /playbook/{id}` | Get playbook definition |
| Phantom | `POST /rest/container` | Create container |
| Phantom | `POST /rest/playbook_run` | Execute playbook |
| Phantom | `GET /rest/action_run/{id}` | Check action status |
| Tines | `POST /api/v1/stories/{id}/trigger` | Trigger story |
| Tines | `GET /api/v1/stories/{id}/agents` | List agents |

## Common Integration APIs

| Tool | Endpoint | Action |
|---|---|---|
| VirusTotal | `GET /api/v3/ip_addresses/{ip}` | IP reputation |
| CrowdStrike | `POST /real-time-response/entities/command/v1` | RTR command |
| Palo Alto | `POST /api/?type=config&action=set` | Block IP |
| ServiceNow | `POST /api/now/table/incident` | Create ticket |

## Workflow Status Codes

| Status | Description |
|---|---|
| `pending` | Awaiting trigger |
| `running` | Workflow executing |
| `waiting_approval` | Human gate pending |
| `completed` | All steps finished |
| `failed` | Error during execution |

## Agent Script

```bash
# List workflow templates
node agent.js list

# Get specific workflow
node agent.js get phishing_triage

# List integrations
node agent.js integrations

# Build custom workflow
node agent.js build --name "Custom Containment" --trigger edr_alert \
  --steps isolate_host block_hash create_ticket --platform xsoar
```
