<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Threat Modeling in CI — API Reference

## pytm CLI

```bash
# Generate DFD diagram
python model.py --dfd

# Generate sequence diagram
python model.py --seq

# Generate HTML report
python model.py --report report.html

# Generate all outputs
python model.py --dfd --seq --report report.html

# List threats
python model.py --list
```

## Threagile CLI

```bash
# Run analysis
threagile analyze --model threagile-model.yaml

# Generate report
threagile analyze --model threagile-model.yaml --output report/

# Validate model
threagile validate --model threagile-model.yaml

# Generate data flow diagram
threagile analyze --model threagile-model.yaml --generate-data-flow-diagram
```

## STRIDE Categories

| Category | Question |
|----------|----------|
| Spoofing | Can an attacker pretend to be someone else? |
| Tampering | Can data be modified in transit or at rest? |
| Repudiation | Can actions be denied without evidence? |
| Information Disclosure | Can unauthorized parties access data? |
| Denial of Service | Can the system be made unavailable? |
| Elevation of Privilege | Can a user gain unauthorized access? |

## DREAD Scoring

| Factor | Scale | Description |
|--------|-------|-------------|
| Damage | 1-10 | How bad is the impact? |
| Reproducibility | 1-10 | How easy to reproduce? |
| Exploitability | 1-10 | How easy to exploit? |
| Affected Users | 1-10 | How many users affected? |
| Discoverability | 1-10 | How easy to find? |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No unmitigated high-risk threats |
| 1 | Unmitigated threats found |
| 2 | Model validation error |
