---
title: "Get an object"
method: GET
path: "/taxii/api-root/collections/{collectionId}/objects/{objectId}"
tags: ["taxii"]
---

# Get an object

`GET /taxii/api-root/collections/{collectionId}/objects/{objectId}`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/taxii/api-root/collections/{collectionId}/objects/{objectId}`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

§5.6. The isMalicious identity object
(`identity--b67e0a86-3f48-5d6d-9b3b-7f4bc1e0a7c4`) is served in an
envelope. An indicator, or a twin's observed-data, cannot be looked up by
id on this server — its id is derived (UUIDv5) and the collections are not
indexed by id — so an `indicator--…` or `observed-data--…` id is answered
404, with a description that says so; read them from Get Objects or Get
Object Manifests. Any other id is a 404.

Plan gate and routing aliases: see `GET /taxii`.

## Path parameters

- `collectionId` string, required
- `objectId` string, required

## Response `200`

`{"more": false, "objects": [identity]}`

- object

## Other responses

- `403`: Plan below Pro — `error_code: "UPGRADE_REQUIRED"`
- `404`: Unknown collection; an indicator id (lookup by id is not available, as the description says); any other id but the identity's

## Changes

- **2026-10-03** `876eab76f736`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/taxii/api-root/collections/:collectionId/objects/:objectId/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)