<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Attack Path Validation

## BloodHound CE API

| Endpoint | Method | Description |
|---|---|---|
| `/api/v2/graphs/cypher` | POST | Execute Cypher query |
| `/api/v2/asset-groups` | GET | List asset groups |
| `/api/v2/attack-paths` | GET | List attack paths |
| `/api/v2/file-upload` | POST | Upload SharpHound data |

### Cypher Query Examples

```cypher
-- Shortest path to Domain Admins
MATCH p=shortestPath((u:User {name:'USER@DOMAIN'})-[*1..]->(g:Group {name:'DOMAIN ADMINS@DOMAIN'})) RETURN p

-- Kerberoastable accounts with admin paths
MATCH (u:User {hasspn:true}) MATCH p=shortestPath((u)-[*1..]->(g:Group {name:'DOMAIN ADMINS@DOMAIN'})) RETURN u.name, length(p)

-- Unconstrained delegation
MATCH (c:Computer {unconstraineddelegation:true}) RETURN c.name
```

## bloodhound-python

| Command | Description |
|---|---|
| `bloodhound-python -d <domain> -c All --zip` | Full collection |
| `bloodhound-python -d <domain> -c DCOnly` | DC-only (stealthier) |

## Agent Script

```bash
# Collect AD data
node agent.js collect-ad --domain CORP.LOCAL --method bloodhound-python

# Find attack paths
node agent.js find-paths --bloodhound-url http://localhost:8080 \
  --start "USER@CORP.LOCAL" --target "DOMAIN ADMINS@CORP.LOCAL" --output paths.json

# Validate path
node agent.js validate-path --path paths.json --output validation.json

# Check detection coverage
node agent.js path-coverage --results validation.json \
  --siem-url https://splunk:8089 --output coverage.json
```
