Get collection objects (STIX bundle)
One page of the collection as a STIX 2.1 bundle. objects[0] is always the isMalicious identity object; the rest are indicator objects (pattern_type: "stix", patterns such as [domain-name:value = '…'], [ipv4-addr:value = '…'], [url:value = '…'], [file:hashes.'SHA-256' = '…'], with confidence, labels, indicator_types, x_opencti_score, x_opencti_main_observable_type, and optional valid_until / x_opencti_first_seen / x_opencti_last_seen / external_references). Indicator ids are deterministic (UUIDv5 of the pattern), so re-emissions update rather than duplicate.
Revocations. When the first page of a walk carries added_after, a catalogue collection (not org-reported-*) also serves revoked: true indicators for the entities false-positive cleanup removed at or after that time (30-day retention), newest first. They take up to half of each page while indicators remain and continue on every following page through next until exhausted; indicators and revocations together never exceed limit. A walk delivers at most 100,000 revocations: the newest since added_after. A client whose added_after is older than that many tombstones receives the newest 100,000, the walk then continues with indicators only, and moving added_after forward on later walks delivers the rest. A walk started without added_after receives none: a client syncing from scratch holds nothing to retire. To receive retirements on a full-collection loop, pass added_after = the start of the previous walk.
Pagination. more: true with a next token (also in X-TAXII-Next) means another page exists; pass it back as ?next=. A page is bounded by a byte budget (4 MiB; 8 MiB on Enterprise), a wall-time budget and a keys-examined budget, so it may hold fewer than limit objects while more: true — keep walking until more: false. These budgets are what keeps a page under the advertised max_content_length; they are not a cap on how much a client can retrieve. A page may stop anywhere and the next one resumes where it stopped: an indicator present for the whole walk is never skipped. It may be served twice (when the store changed under the walk), which the deterministic ids make harmless. A token issued before a restart of the data store restarts the walk from the beginning.
Media type. The 200 is application/stix+json;version=2.1 (STIX envelope), unlike the other TAXII operations; errors stay application/taxii+json;version=2.1.
Quota. Never decrements the monthly request quota. Objects delivered are counted separately (identity excluded) for usage reporting.
Plan gate and routing aliases: see GET /taxii.
Path parameters
Collection id — one of the twelve listed by GET /taxii/api-root/collections. org-reported-* requires a key attached to an organization
Query parameters
Max STIX objects in the bundle, identity included (so the indicator cap is limit - 1). Omitted → 50, then clamped to the caller's plan ceiling: 1001 for Pro, none at all for Enterprise — any page size is honoured and the byte/time budgets decide where the page ends, with a next token for the rest. 0 or negative yields a 1-object bundle (identity only). Digits past i64 saturate; non-numeric input is rejected by the query parser.
RFC 3339 lower bound on the indicator date. Indicators without a parseable firstSeen/lastSeen are excluded when either bound is set. For full-collection ingestion, omit both added_after and added_before to return the most complete dataset; pagination via next works identically with or without date filters. An unparseable value is ignored, not rejected. On the first page of a walk it also opens the revocation stream (see the operation description).
RFC 3339 upper bound; same exclusion rule as added_after.
Opaque pagination token from the previous page (next field or X-TAXII-Next header). Bound to the collection — and, for org-reported-*, to the organization — that issued it; presenting it elsewhere is a 400.
Minimum OpenCTI risk score (0-100, inclusive) an indicator must have to be included. Applied post-scan, same as the date filters, so a page may return fewer than limit objects while more: true. Out of range → 400.
Maximum OpenCTI risk score (0-100, inclusive). With min_score it selects a band (min_score=60&max_score=69); same post-scan semantics. Out of range, or below min_score → 400.
Response
STIX bundle: {"type": "bundle", "id": "bundle--<uuid>", "objects": [identity, indicator…], "more": bool, "next"?: string} — next is present only when more is true