<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Deception Technology

## Deception Object Types

| Type | Deployment | Monitoring |
|---|---|---|
| Honey account | Active Directory | EID 4624/4625/4769 |
| Canarytoken | File/URL/DNS | Callback to token server |
| Breadcrumb | Endpoint credential stores | Use of planted credential |
| Decoy service | Docker container | Any network connection |
| Honey SPN | AD attribute | EID 4769 (Kerberoasting) |
| Canary document | File share | Document open callback |

## Canarytokens API

| Endpoint | Method | Description |
|---|---|---|
| `/generate` | POST | Create new canarytoken |
| `/manage` | GET | List active tokens |
| `/history` | GET | View token trigger history |

## Active Directory Deception PowerShell

| Command | Description |
|---|---|
| `New-ADUser` | Create honey account |
| `Set-ADUser -ServicePrincipalNames` | Add honey SPN |
| `New-ADGroup` | Create honey group |
| `cmdkey /add` | Plant RDP breadcrumb |

## Agent Script

```bash
# Generate honey service account
node agent.js honey-account --name sqlbackup --type service

# Generate breadcrumbs
node agent.js breadcrumbs --target-ip 10.99.0.50 --honey-user svc_sqlbackup

# Generate canarytoken
node agent.js canarytoken --type doc_msword --memo "IT-Share canary doc"

# Audit deception inventory
node agent.js audit inventory.json
```
