---
title: "Get a TAXII collection"
method: GET
path: "/taxii/api-root/collections/{collectionId}"
tags: ["taxii"]
---

# Get a TAXII collection

`GET /taxii/api-root/collections/{collectionId}`

One entry of `GET /taxii/api-root/collections`, same shape.

Plan gate, quota rule and routing aliases: see `GET /taxii`.

## Path parameters

- `collectionId` string, required

## Response `200`

`{"id", "title", "description", "can_read": true, "can_write": false, "media_types": ["application/stix+json;version=2.1"]}`

## Other responses

- `401` — Unauthorized - Missing or invalid credential. Emitted by the auth layer, so **not** TAXII-formatted
- `403` — Plan below Pro — `error_code: "UPGRADE_REQUIRED"`
- `404` — Unknown collection id

## Changes

- **2026-09-02** `b834b2860af7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/taxii/api-root/collections/:collectionId/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/76ed7a38ded1?raw)