---
title: "Upload Structured Threat Information Expression (STIX) objects to the workspace"
method: POST
path: "/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload"
---

# Upload Structured Threat Information Expression (STIX) objects to the workspace

`POST /workspaces/{workspaceId}/threat-intelligence-stix-objects:upload`

Upload an array of Structured Threat Information Expression (STIX) objects to the workspace specified

## Path parameters

- `workspaceId` string, uuid, required

## Query parameters

- `api-version` string, required

## Request body

- UploadStixObjectsRequest — Schema for request body.
  - `sourcesystem` string — Source of the STIX objects to be uploaded. Source system name cannot be Microsoft Sentinel. Maximum length is 256 characters.
  - `stixobjects` JsonPropertyBag[] — The stixobjects param is an array of STIX objects. STIX objects need to be in STIX format. We only support STIX 2.0 and 2.1 format.

## Response `200`

The API returns 200 when at least one STIX object is successfully validated and published.

- UploadStixObjectsResponse — Response object containing more details about the operation.
  - `errors` StixObjectsValidationError[] — Details of the error. Contains a list of STIX objects validation errors
    - `recordIndex` integer — Index of the STIX objects in stixobjects array from request.
    - `validationErrorMessages` string[] — List of validation errors for a single STIX object.

## Other responses

- `default` — Upload STIX Objects API service error response.

## Changes

- **2026-07-13** (2022-12-01-preview) `4594e07673ea` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/azure/apis/securityinsights-threatintelligence/changes/workspaces/:workspaceId/threat-intelligence-stix-objects:upload/post.md)

---

[API](https://skmtc.dev/azure/apis/securityinsights-threatintelligence.md) · [All operations](https://skmtc.dev/azure/apis/securityinsights-threatintelligence/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/azure/securityinsights-threatintelligence/revisions/4594e07673ea/schema)