Get a TAXII collection
One entry of GET /taxii/api-root/collections, same shape.
Plan gate, quota rule and routing aliases: see GET /taxii.
Path parameters
Collection id — one of the twelve listed by GET /taxii/api-root/collections
Response
{"id", "title", "description", "can_read": true, "can_write": false, "media_types": ["application/stix+json;version=2.1"]}. On malicious-domains, malicious-ips, malicious-subdomains and c2-indicators, three custom properties from the corpus walk (every 12 h): x_ismalicious_score_histogram (indicator counts per ten-point score band, "0-9" … "90-100" — the same score min_score/max_score filter on, so "60-69" is what min_score=60&max_score=69 would page through), x_ismalicious_total and x_ismalicious_computed_at (RFC 3339). Absent until the first walk after deploy, and on URL/hash collections, which the walk does not cover