Get collection objects (STIX bundle)
One page of the collection as a STIX 2.1 bundle. objects[0] is always the isMalicious identity object; the rest are indicator objects (pattern_type: "stix", patterns such as [domain-name:value = '…'], [ipv4-addr:value = '…'], [url:value = '…'], [file:hashes.'SHA-256' = '…'], with confidence, labels, indicator_types, x_opencti_score, x_opencti_main_observable_type, and optional valid_until / x_opencti_first_seen / x_opencti_last_seen / external_references). Indicator ids are deterministic (UUIDv5 of the pattern), so re-emissions update rather than duplicate. The first page of a catalogue collection (not org-reported-*) also appends up to 2000 revoked: true indicators for entities removed by false-positive cleanup in the last 30 days, so consumers retire them.
Pagination. more: true with a next token (also in X-TAXII-Next) means another page exists; pass it back as ?next=. A page is bounded by a byte budget (4 MiB; 8 MiB on Enterprise), a wall-time budget and a keys-examined budget, so it may hold fewer than limit objects while more: true — keep walking until more: false. These budgets are what keeps a page under the advertised max_content_length; they are not a cap on how much a client can retrieve.
Media type. The 200 is application/stix+json;version=2.1 (STIX envelope), unlike the other TAXII operations; errors stay application/taxii+json;version=2.1.
Quota. Never decrements the monthly request quota. Objects delivered are counted separately (identity excluded) for usage reporting.
Plan gate and routing aliases: see GET /taxii.
Path parameters
Collection id — one of the twelve listed by GET /taxii/api-root/collections. org-reported-* requires a key attached to an organization
Query parameters
Max STIX objects in the bundle, identity included (so the indicator cap is limit - 1). Omitted → 50, then clamped to the caller's plan ceiling: 1001 for Pro, none at all for Enterprise — any page size is honoured and the byte/time budgets decide where the page ends, with a next token for the rest. 0 or negative yields a 1-object bundle (identity only). Digits past i64 saturate; non-numeric input is rejected by the query parser.
RFC 3339 lower bound on the indicator date. Indicators without a parseable firstSeen/lastSeen are excluded when either bound is set. For full-collection ingestion, omit both added_after and added_before to return the most complete dataset; pagination via next works identically with or without date filters. An unparseable value is ignored, not rejected.
RFC 3339 upper bound; same exclusion rule as added_after.
Opaque pagination token from the previous page (next field or X-TAXII-Next header). Bound to the collection — and, for org-reported-*, to the organization — that issued it; presenting it elsewhere is a 400.
Minimum OpenCTI risk score (0-100, inclusive) an indicator must have to be included. Applied post-scan, same as the date filters, so a page may return fewer than limit objects while more: true. Out of range → 400.
Maximum OpenCTI risk score (0-100, inclusive). With min_score it selects a band (min_score=60&max_score=69); same post-scan semantics. Out of range, or below min_score → 400.
Response
STIX bundle: {"type": "bundle", "id": "bundle--<uuid>", "objects": [identity, indicator…], "more": bool, "next"?: string} — next is present only when more is true