<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Identity Security Playbooks

## Commands

| Command | Description |
|---|---|
| `New-SOARPlaybook` | Create SOAR playbook |
| `Invoke-SOARPlaybook` | Trigger playbook for incident |
| `Get-PlaybookRun` | Get playbook run status |
| `Disable-AzureADUser` | Disable user via Azure AD |
| `Revoke-AzureADUserSession` | Revoke all sessions |
| `New-ServiceNowIncident` | Create incident ticket |
| `Get-PlaybookMetrics` | Retrieve performance metrics |

## Agent Script

```bash
# node agent.js create --scenario <value>
# node agent.js test --playbook-id <value>
# node agent.js metrics
```
