---
title: "TAXII discovery"
method: GET
path: "/taxii"
tags: ["taxii"]
---

# TAXII discovery

`GET /taxii`

TAXII 2.1 discovery document. `default` and `api_roots[0]` are the same
absolute API-root URL, built from the request's `X-Forwarded-Proto` /
`X-Forwarded-Host` (or `Host`) and the prefix the request came in on.

**Routing aliases.** Every TAXII path is also served with a trailing slash
(`/taxii/`, `/taxii/api-root/`, `…/objects/`) and under the `/taxii2`
prefix (`/taxii2`, `/taxii2/api-root/collections/{collectionId}/objects`,
…), which is the form the product docs use. Same handlers, same
behaviour; only the `/taxii` form is listed in this document.

**Plan gate.** Every TAXII operation opens with the same check: a key on
a plan below Pro is answered 403 with `error_code: "UPGRADE_REQUIRED"`
(TAXII error format) before anything else happens. A 401 comes from the
authentication layer instead and uses the ordinary `{"error", "message"}`
body, not the TAXII one.

**Quota.** Feed endpoints never decrement the monthly request quota, and a
refused request (403) is not charged either.

`Content-Type: application/taxii+json;version=2.1`.

## Response `200`

Discovery document: `{"title", "description", "contact", "default": <api-root URL>, "api_roots": [<api-root URL>]}`

## Other responses

- `401` — Unauthorized - Missing or invalid credential. Emitted by the auth layer, so **not** TAXII-formatted
- `403` — Plan below Pro — `error_code: "UPGRADE_REQUIRED"`

## Changes

- **2026-09-02** `b834b2860af7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/taxii/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/76ed7a38ded1?raw)