<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Incident Documentation Standards

## Endpoints

| Endpoint | Method | Purpose |
|---|---|---|
| `GET /api/incidents/{id}/record` | GET | Get record |
| `PUT /api/incidents/{id}/record` | PUT | Update record |
| `GET /api/incidents/{id}/completeness` | GET | Score |
| `POST /api/evidence` | POST | Create evidence record |
| `GET /api/evidence/{id}/custody` | GET | Chain of custody |

## Agent Script

```bash
node agent.js validate --severity S1 --record-json '{"severity":"S1","category":"CAT-3","summary":"Ransomware"}'
node agent.js template --severity S2
node agent.js evidence --evidence-id EVD-001 --type memory_dump --description "RAM from WEB01" --location "s3://evidence/" --sha256 "a1b2c3" --collector "analyst@co.com"
```
