TAXII discovery

TAXII 2.1 discovery document. default and api_roots[0] are the same absolute API-root URL, built from the request's X-Forwarded-Proto / X-Forwarded-Host (or Host) and the prefix the request came in on.

Routing aliases. Every TAXII path is also served with a trailing slash (/taxii/, /taxii/api-root/, …/objects/) and under the /taxii2 prefix (/taxii2, /taxii2/api-root/collections/{collectionId}/objects, …), which is the form the product docs use. Same handlers, same behaviour; only the /taxii form is listed in this document.

Plan gate. Every TAXII operation opens with the same check: a key on a plan below Pro is answered 403 with error_code: "UPGRADE_REQUIRED" (TAXII error format) before anything else happens. A 401 comes from the authentication layer instead and uses the ordinary {"error", "message"} body, not the TAXII one.

Quota. Feed endpoints never decrement the monthly request quota, and a refused request (403) is not charged either.

Content-Type: application/taxii+json;version=2.1.