---
title: "Get object manifests"
method: GET
path: "/taxii/api-root/collections/{collectionId}/manifest"
tags: ["taxii"]
---

# Get object manifests

`GET /taxii/api-root/collections/{collectionId}/manifest`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/taxii/api-root/collections/{collectionId}/manifest`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

One manifest record per object the same Get Objects request would return
(§5.3): same `limit`, `added_after`, `next`, `match[...]`, score filters
and walk. Always served as `application/taxii+json;version=2.1`, whatever
the `Accept`. A record is `{"id", "date_added", "version", "media_type"}`:
`date_added` at microsecond precision, `version` the object's `modified`,
`media_type` `application/stix+json;version=2.1`. The resource is
`{"more": bool, "next"?: string, "objects"?: [record…]}`; `next` pages it
like Get Objects. Records are in `date_added` order within the page
(§3.3), revocations included, and the date headers follow them. Each
document is still read to apply the filters: a manifest saves bandwidth,
not server work.

Plan gate and routing aliases: see `GET /taxii`.

## Path parameters

- `collectionId` string, required

## Query parameters

- `limit` integer
- `added_after` string
- `added_before` string
- `next` string
- `min_score` integer
- `max_score` integer
- `match[type]` string
- `match[id]` string
- `match[version]` string
- `match[spec_version]` string

## Response `200`

`{"more": bool, "next"?: string, "objects"?: [{"id", "date_added", "version", "media_type"}]}`

- object

## Other responses

- `400`: As on Get Objects
- `403`: Plan below Pro — `error_code: "UPGRADE_REQUIRED"`
- `404`: Unknown collection id
- `429`: Feed trial only, as on Get Objects: `FEED_TRIAL_DAILY_LIMIT`. A manifest page counts as a page, its records never toward the day's indicators

## Changes

- **2026-10-19** `37f7f3f76849`: 1 info
  - added the non-success response with the status `429`
- **2026-10-03** `876eab76f736`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/taxii/api-root/collections/:collectionId/manifest/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)