<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Cloud Detection Rules

## Agent Tools

| Tool | Description |
|---|---|
| Author Rule | `author_rule(provider, service, event_name, severity)` — Author a cloud detection rule. |
| Query Logs | `query_logs(provider, query, time_range)` — Query cloud audit logs for rule testing. |
| Assess Coverage | `assess_coverage(provider, rules_dir)` — Assess detection coverage for a cloud provider. |

## CLI Usage

```bash
# Author rule
node agent.js author --provider aws --service iam --event-name CreateUser --severity high
```

```bash
# Query logs
node agent.js query --provider aws --query "eventName=CreateUser" --time-range 24h
```

```bash
# Assess coverage
node agent.js coverage --provider aws --rules-dir rules/aws/
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
