<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Token Theft and Replay Detection — API Reference

## Azure AD Sign-in Logs (KQL)

```kql
// Multi-IP token usage
SigninLogs
| where TimeGenerated > ago(24h) and ResultType == 0
| summarize IPs=make_set(IPAddress), Count=count()
    by UniqueTokenIdentifier, UserPrincipalName
| where array_length(IPs) > 1

// Anomalous token risk detections
SigninLogs
| where TimeGenerated > ago(24h)
| where RiskEventTypes_v2 has "anomalousToken"
| project TimeGenerated, UserPrincipalName, IPAddress,
    RiskLevelDuringSignIn, DeviceDetail, Location

// Non-compliant device access after compliant sign-in
SigninLogs
| where TimeGenerated > ago(24h) and ResultType == 0
| where DeviceDetail.isCompliant == false
| join kind=inner (
    SigninLogs | where DeviceDetail.isCompliant == true
    | distinct UserPrincipalName
) on UserPrincipalName
```

## Microsoft Graph — Session Management

```bash
# Revoke all user sign-in sessions
curl -s -X POST -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/users/USER_ID/revokeSignInSessions"

# Get user risk state
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers/USER_ID" | jq .

# Confirm user compromised
curl -s -X POST -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers/confirmCompromised" \
  -d '{"userIds": ["USER_ID"]}'
```

## Okta Session Management

```bash
# List active sessions for user
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/users/USER_ID/sessions" | jq .

# Clear all user sessions
curl -s -X DELETE -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/users/USER_ID/sessions"
```

## Key Detection Signals

| Signal | Source | Confidence |
|--------|--------|------------|
| Multi-IP token usage | Sign-in logs | High |
| anomalousToken risk | Identity Protection | High |
| Non-compliant device | Conditional Access | Medium |
| Impossible travel + token reuse | Correlation | Critical |
| New inbox rule after risky sign-in | Audit logs | High |
