Get object manifests

Collection id — one of the twelve listed by GET /taxii/api-root/collections

Max STIX objects in the bundle, identity included (so the indicator cap is limit - 1). Omitted → 50, then clamped to the caller's plan ceiling: 1001 for Pro, none at all for Enterprise — any page size is honoured and the byte/time budgets decide where the page ends, with a next token for the rest. 0 or negative yields a 1-object bundle (identity only). Digits past i64 saturate; non-numeric input is rejected by the query parser.

RFC 3339 lower bound on the date the indicator was added to the collection (TAXII date_added; for documents written before that date was recorded, the source's firstSeen, else lastSeen). Indicators with none of these are excluded when either bound is set. For full-collection ingestion, omit both added_after and added_before to return the most complete dataset; pagination via next works identically with or without date filters. An unparseable value is ignored, not rejected. On the first page of a walk it also opens the revocation stream (see the operation description).

RFC 3339 upper bound; same exclusion rule as added_after.

Opaque pagination token from the previous page (next field or X-TAXII-Next header). Bound to the organization that issued it (org-reported-*): presenting it elsewhere is a 400. A token issued for another collection is a 400; any other token continues its walk, each page filtering on the added_after it carries itself (repeat it on every page to keep it). One exception, for the OASIS taxii2-client library (User-Agent: taxii2-client/…) on a TAXII 2.1 request, whose users (the OpenCTI connector) do not repeat their filters: a token continues only its own collection's walk under its own added_after; a page that omits added_after filters on the walk's, and a token for another collection or sent with another added_after starts a new walk (a token for another collection lends its added_after to a request that sends none).

Minimum OpenCTI risk score (0-100, inclusive) an indicator must have to be included. Applied post-scan, same as the date filters, so a page may return fewer than limit objects while more: true. Out of range → 400.

Maximum OpenCTI risk score (0-100, inclusive). With min_score it selects a band (min_score=60&max_score=69); same post-scan semantics. Out of range, or below min_score → 400.

TAXII 2.1 requests only (§3.4.1); a legacy request ignores every match[...]. Comma-separated types: indicator, identity (observed-data on a -observables twin). A well-formed type this server does not serve matches nothing: an empty page, not an error. A malformed value (empty, or not a STIX type name) is a 400, as for every match[...] field (§3.4).

TAXII 2.1 requests only. Comma-separated STIX ids (<type>--<UUID>, else 400). The walk still reads the whole collection to find them, page by page: Get Objects with match[id] costs a full walk.

TAXII 2.1 requests only. first, last, all (one version of each object is held, so all three select it) or a modified timestamp; anything else is a 400.

TAXII 2.1 requests only. <major>.<minor>, else 400. Every object is 2.1; 2.0 alone matches nothing.