<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Detection Content CI/CD

## Agent Tools

| Tool | Description |
|---|---|
| Validate Pipeline | `validate_pipeline(rules_dir)` — Run validation pipeline on detection rules. |
| Deploy Rules | `deploy_rules(rules_dir, target)` — Deploy validated rules to target SIEM. |
| Rollback | `rollback(deployment_id)` — Rollback a detection rule deployment. |

## CLI Usage

```bash
# Validate pipeline
node agent.js validate --rules-dir rules/
```

```bash
# Deploy rules
node agent.js deploy --rules-dir rules/ --target production
```

```bash
# Rollback
node agent.js rollback --deployment-id abc12345
```

## Output Format

All commands return JSON with the following structure:

```json
{
  "action": "<command_name>",
  "...": "command-specific fields"
}
```

## Error Handling

- Invalid input returns `{"error": "description"}` with non-zero exit code
- JSON parsing errors are caught and reported with context
- Missing required arguments trigger argparse help display
