---
title: "Get collection objects (STIX bundle)"
method: GET
path: "/taxii/api-root/collections/{collectionId}/objects"
tags: ["taxii"]
---

# Get collection objects (STIX bundle)

`GET /taxii/api-root/collections/{collectionId}/objects`

One page of the collection as a STIX 2.1 bundle. `objects[0]` is always
the isMalicious `identity` object; the rest are `indicator` objects
(`pattern_type: "stix"`, patterns such as `[domain-name:value = '…']`,
`[ipv4-addr:value = '…']`, `[url:value = '…']`,
`[file:hashes.'SHA-256' = '…']`, with `confidence`, `labels`,
`indicator_types`, `x_opencti_score`, `x_opencti_main_observable_type`,
and optional `valid_until` / `x_opencti_first_seen` /
`x_opencti_last_seen` / `external_references`). Indicator ids are
deterministic (UUIDv5 of the pattern), so re-emissions update rather
than duplicate.

**Revocations.** When the first page of a walk carries `added_after`, a
catalogue collection (not `org-reported-*`) also serves `revoked: true`
indicators for the entities false-positive cleanup removed at or after
that time (30-day retention), newest first. They take up to half of each
page while indicators remain and continue on every following page through
`next` until exhausted; indicators and revocations together never exceed
`limit`. A walk delivers at most 100,000 revocations: the newest since
`added_after`. A client whose `added_after` is older than that many
tombstones receives the newest 100,000, the walk then continues with
indicators only, and moving `added_after` forward on later walks delivers
the rest. A walk started without `added_after` receives none: a client
syncing from scratch holds nothing to retire. To receive retirements on a
full-collection loop, pass `added_after` = the start of the previous walk.

**Pagination.** `more: true` with a `next` token (also in `X-TAXII-Next`)
means another page exists; pass it back as `?next=`. A page is bounded by
a byte budget (4 MiB; 8 MiB on Enterprise), a wall-time budget and a
keys-examined budget, so it may hold fewer than `limit` objects while
`more: true` — keep walking until `more: false`. These budgets are what
keeps a page under the advertised `max_content_length`; they are not a
cap on how much a client can retrieve. A page may stop anywhere and the
next one resumes where it stopped: an indicator present for the whole
walk is never skipped. It may be served twice (when the store changed
under the walk), which the deterministic ids make harmless. A token
issued before a restart of the data store restarts the walk from the
beginning.

**Media type.** The 200 is `application/stix+json;version=2.1` (STIX
envelope), unlike the other TAXII operations; errors stay
`application/taxii+json;version=2.1`.

**Quota.** Never decrements the monthly request quota. Objects delivered
are counted separately (identity excluded) for usage reporting.

Plan gate and routing aliases: see `GET /taxii`.

## Path parameters

- `collectionId` string, required

## Query parameters

- `limit` integer
- `added_after` string
- `added_before` string
- `next` string
- `min_score` integer
- `max_score` integer

## Response `200`

STIX bundle: `{"type": "bundle", "id": "bundle--<uuid>", "objects": [identity, indicator…], "more": bool, "next"?: string}` — `next` is present only when `more` is true

## Other responses

- `400` — One of: `min_score` or `max_score` outside 0–100, or `max_score` below `min_score`; invalid or expired `next` token; `next` token issued for another collection; `next` token issued for another organization (`org-reported-*`). A non-numeric `limit` is rejected earlier by the query parser with a plain-text body
- `401` — Missing or invalid credential (auth layer), or — on `org-reported-*` collections — a credential with no organization: `{"error": "Organization required"}`. Neither is TAXII-formatted
- `403` — Plan below Pro — `error_code: "UPGRADE_REQUIRED"`
- `404` — Unknown collection id
- `500` — Storage read failed, or the bundle could not be serialized
- `503` — Store briefly unavailable (Redis loading or reconnecting) or fetch concurrency saturated — back off for `Retry-After` and retry
- `504` — Fetch exceeded the 15 s time limit — retry, or reduce `limit`

## Changes

- **2026-09-20** `035c175364a9` — 1 info
  - added the new optional `query` request parameter `max_score`
- **2026-09-02** `b834b2860af7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/taxii/api-root/collections/:collectionId/objects/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/fe46a64acc79?raw)