<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Zero Trust Architecture — API Reference

## Azure Conditional Access CLI

```bash
# List conditional access policies
az ad conditionalaccesspolicy list

# Create MFA policy
az ad conditionalaccesspolicy create --display-name "Require MFA" \
  --state enabled \
  --conditions '{"users":{"includeUsers":["All"]}}' \
  --grant-controls '{"builtInControls":["mfa"]}'

# Create device compliance policy
az ad conditionalaccesspolicy create --display-name "Compliant Devices" \
  --state enabled \
  --grant-controls '{"builtInControls":["compliantDevice"]}'
```

## Cloudflare Access CLI

```bash
# Create access application
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{id}/access/apps" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"name":"App","domain":"app.example.com","type":"self_hosted"}'

# Create access policy
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{id}/access/apps/{app_id}/policies" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"decision":"allow","include":[{"group":{"id":"group-id"}}]}'

# List access applications
curl "https://api.cloudflare.com/client/v4/accounts/{id}/access/apps" \
  -H "Authorization: Bearer $TOKEN"
```

## agent.js CLI

```bash
# Assess zero trust maturity
node scripts/agent.js --action assess --pillars identity,devices,network

# Generate policy framework
node scripts/agent.js --action policies --output zt-policies.json

# Design architecture
node scripts/agent.js --action design --pillars identity,devices,network,applications,data

# Validate configuration
node scripts/agent.js --action validate --config zt-policies.json
```

## NIST SP 800-207 Key Tenets

| Tenet | Description |
|-------|-------------|
| 1 | All data sources and computing services are resources |
| 2 | All communication is secured regardless of network location |
| 3 | Access to individual enterprise resources is granted per-session |
| 4 | Access is determined by dynamic policy |
| 5 | Enterprise monitors and measures integrity/security posture of all assets |
| 6 | All resource authentication and authorization are dynamic and strictly enforced |
| 7 | Enterprise collects info about current state of assets and uses it to improve security |
