---
title: "Get a TAXII collection"
method: GET
path: "/taxii/api-root/collections/{collectionId}"
tags: ["taxii"]
---

# Get a TAXII collection

`GET /taxii/api-root/collections/{collectionId}`

One entry of `GET /taxii/api-root/collections`, same shape.

Plan gate, quota rule and routing aliases: see `GET /taxii`.

## Path parameters

- `collectionId` string, required

## Response `200`

`{"id", "title", "description", "can_read": true, "can_write": false, "media_types": ["application/stix+json;version=2.1"]}`. On `malicious-domains`, `malicious-ips`, `malicious-subdomains` and `c2-indicators`, three custom properties from the corpus walk (every 12 h): `x_ismalicious_score_histogram` (indicator counts per ten-point score band, `"0-9"` … `"90-100"` — the same score `min_score`/`max_score` filter on, so `"60-69"` is what `min_score=60&max_score=69` would page through), `x_ismalicious_total` and `x_ismalicious_computed_at` (RFC 3339). Absent until the first walk after deploy, and on URL/hash collections, which the walk does not cover

## Other responses

- `401` — Unauthorized - Missing or invalid credential. Emitted by the auth layer, so **not** TAXII-formatted
- `403` — Plan below Pro — `error_code: "UPGRADE_REQUIRED"`
- `404` — Unknown collection id

## Changes

- **2026-09-02** `b834b2860af7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/taxii/api-root/collections/:collectionId/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/58a5aec0e63b?raw)