<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Endpoint Patch Management

## Patch Management APIs

### WSUS PowerShell Cmdlets

| Cmdlet | Description |
|---|---|
| `Get-WsusUpdate` | Query updates in WSUS |
| `Approve-WsusUpdate` | Approve update for deployment |
| `Get-WsusComputer` | List WSUS-managed computers |
| `Get-WsusServer` | Get WSUS server configuration |

### Windows Update Agent

| Command | Description |
|---|---|
| `usoclient StartScan` | Trigger update scan |
| `usoclient StartInstall` | Install approved updates |
| `Get-HotFix` | List installed updates |
| `wusa /uninstall /kb:<KB>` | Uninstall specific update |

### Linux Package Managers

| Command | Description |
|---|---|
| `apt list --upgradable` | List available updates (Debian/Ubuntu) |
| `dnf updateinfo list security` | List security updates (RHEL/Fedora) |
| `dnf update --security` | Install security updates only |
| `apt-get changelog <pkg>` | View CVEs fixed in update |

### Agent Script

```bash
# Check installed hotfixes
node agent.js check-hotfixes --count 20

# Check Linux security updates
node agent.js check-updates

# Check CISA KEV compliance
node agent.js check-kev --kev-file kev.json
```
