<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Building Incident Knowledge Graphs

## Endpoints

| Endpoint | Method | Purpose |
|---|---|---|
| `POST /api/graph/ingest` | POST | Ingest incident into knowledge graph |
| `GET /api/graph/patterns/{actor}` | GET | Query attack patterns |
| `GET /api/graph/exposed/{ttp}` | GET | Find exposed assets |
| `GET /api/graph/stats` | GET | Get graph statistics |

## Agent Script

```bash
node agent.js ingest --incident-id INC-2026-0200 \
  --ttps '["T1566.001","T1059.001"]' --assets '["web-srv-01"]'
node agent.js query-patterns --actor APT29
node agent.js find-exposed --ttp T1190
```
