---
title: "List TAXII collections"
method: GET
path: "/taxii/api-root/collections"
tags: ["taxii"]
---

# List TAXII collections

`GET /taxii/api-root/collections`

The twelve collections, from a static table: `malicious-domains`,
`malicious-ips`, `malicious-urls`, `malicious-file-hashes`,
`malicious-subdomains`, `malware-iocs`, `c2-indicators`,
`ransomware-iocs`, `phishing-indicators`, plus the three
organization-scoped ones — `org-reported-ips`, `org-reported-domains`,
`org-reported-file-hashes` — which serve the caller's own reported
indicators. Every collection is `can_read: true`, `can_write: false`,
`media_types: ["application/stix+json;version=2.1"]`.

Plan gate, quota rule and routing aliases: see `GET /taxii`.

## Response `200`

`{"collections": [{"id", "title", "description", "can_read": true, "can_write": false, "media_types": ["application/stix+json;version=2.1"]}]}` — twelve entries

## Other responses

- `401` — Unauthorized - Missing or invalid credential. Emitted by the auth layer, so **not** TAXII-formatted
- `403` — Plan below Pro — `error_code: "UPGRADE_REQUIRED"`

## Changes

- **2026-09-02** `b834b2860af7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/taxii/api-root/collections/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/0fa256b179f3?raw)