<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Identity Threat Intelligence

## Commands

| Command | Description |
|---|---|
| `HIBP-API /breachedaccount` | Check email against HIBP |
| `SpyCloud-API /breach/data` | Query SpyCloud for credentials |
| `Get-MgRiskyUser` | List risky Azure AD users |
| `Get-MgRiskyServicePrincipal` | Check service principal risk |
| `TIP-Search` | Search TIP for identity IOCs |
| `STIX-Feed-Ingest` | Ingest STIX identity indicators |
| `Dark-Web-Monitor-API` | Query dark web monitoring |

## Agent Script

```bash
# node agent.js check --email <value>
# node agent.js feed-status
# node agent.js correlate --domain <value>
```
