<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Identity Provider Compromise

## Azure AD / Entra ID Audit APIs

### Microsoft Graph Security

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/v1.0/auditLogs/directoryAudits` | GET | Directory audit events |
| `/v1.0/auditLogs/signIns` | GET | Sign-in log events |
| `/v1.0/auditLogs/provisioning` | GET | Provisioning events |
| `/v1.0/security/alerts_v2` | GET | Security alerts |
| `/v1.0/identityProtection/riskyUsers` | GET | Risky user detections |

### Key Audit Categories

| Category | Events |
|----------|--------|
| ApplicationManagement | App registration, consent grants |
| UserManagement | User creation, role assignment |
| PolicyManagement | Conditional Access changes |
| DirectoryManagement | Domain, federation trust changes |
| RoleManagement | Privileged role assignments |

## Okta System Log

### Event Types

| Event | Description |
|-------|-------------|
| `user.session.start` | User authentication |
| `application.lifecycle.create` | New app integration |
| `policy.lifecycle.update` | Authentication policy change |
| `system.org.rate_limit.violation` | Brute force indicator |
| `user.account.privilege.grant` | Admin role assignment |

### Okta API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/v1/logs` | GET | System log events |
| `/api/v1/threats/configuration` | GET | Threat insight config |
| `/api/v1/sessions` | GET | Active sessions |

## ADFS Monitoring

### Critical Event IDs

| Event ID | Log | Description |
|----------|-----|-------------|
| 1200 | ADFS/Admin | Token issued |
| 1202 | ADFS/Admin | Fresh credential validation |
| 307 | ADFS/Admin | Federation trust configured |
| 510 | ADFS/Admin | Token signing certificate |
| 412 | Security | Configuration change |

## Token Inspection Tools

| Tool | Purpose | Command |
|------|---------|---------|
| jwt.io | Decode JWT tokens | Web-based decoder |
| jwt-cli | CLI JWT inspection | `jwt decode <token>` |
| SAMLTool | SAML assertion decoder | `saml-decode <assertion>` |
| TokenTacticsV2 | Token manipulation testing | `Invoke-RefreshToMSGraphToken` |
