> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socdefenders.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GET /api/taxii2/collections/{id}/objects — STIX objects

> Retrieve paginated STIX 2.1 objects from a named TAXII collection. Supports added_after for delta polling and limit for page size. Requires Pro subscription.

This endpoint returns paginated STIX 2.1 objects from a named collection. Use it to bulk-ingest indicators into your SIEM or TIP, or to poll incrementally for new objects using the `added_after` parameter. Each page is returned as a STIX bundle, and pagination is driven by response headers rather than a cursor in the response body.

## Endpoint

**Method:** `GET https://www.socdefenders.ai/api/taxii2/api/collections/{id}/objects/`

**Authentication:** Required — pass your API key in the `Authorization` header as a Bearer token.

**Tier:** Pro.

## Path parameters

<ParamField path="id" type="string" required>
  Collection ID obtained from `GET /api/taxii2/api/collections/`. For example, `all-iocs`, `ip-addresses`, `file-hashes`, or `cves`.
</ParamField>

## Query parameters

<ParamField query="added_after" type="string">
  ISO 8601 timestamp. Returns only STIX objects added to the collection after this time. Use the value of the `X-TAXII-Date-Added-Last` response header from your previous request to poll incrementally.
</ParamField>

<ParamField query="limit" type="integer">
  Maximum number of STIX objects to return per page. The server may return fewer than the requested limit.
</ParamField>

<ParamField query="next" type="string">
  Pagination token. Use the value from the `X-TAXII-Date-Added-Last` response header as the `added_after` value on your next request to continue paginating through results.
</ParamField>

## Example request

```bash theme={null}
curl -H "Authorization: Bearer sk_live_YOUR_KEY" \
  "https://www.socdefenders.ai/api/taxii2/api/collections/all-iocs/objects/?added_after=2024-01-01T00:00:00Z&limit=100"
```

## Example response

```json theme={null}
{
  "type": "bundle",
  "id": "bundle--...",
  "spec_version": "2.1",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--...",
      "created": "2024-01-15T10:00:00Z",
      "modified": "2024-01-15T10:00:00Z",
      "name": "Malicious IP 192.0.2.1",
      "pattern": "[ipv4-addr:value = '192.0.2.1']",
      "pattern_type": "stix",
      "valid_from": "2024-01-15T10:00:00Z",
      "indicator_types": ["malicious-activity"]
    }
  ],
  "more": true,
  "next": "cursor_xyz789"
}
```

## Response fields

<ResponseField name="type" type="string">
  Always `bundle` — the STIX 2.1 bundle type.
</ResponseField>

<ResponseField name="id" type="string">
  Unique STIX bundle identifier in the format `bundle--<uuid>`.
</ResponseField>

<ResponseField name="spec_version" type="string">
  STIX specification version. Always `2.1`.
</ResponseField>

<ResponseField name="objects" type="object[]">
  Array of STIX 2.1 indicator objects contained in this page.

  <Expandable title="properties">
    <ResponseField name="objects[].type" type="string">
      STIX object type, typically `indicator`.
    </ResponseField>

    <ResponseField name="objects[].spec_version" type="string">
      STIX spec version for this object, always `2.1`.
    </ResponseField>

    <ResponseField name="objects[].id" type="string">
      Unique STIX object identifier in the format `indicator--<uuid>`.
    </ResponseField>

    <ResponseField name="objects[].created" type="string">
      ISO 8601 timestamp of when the STIX object was created.
    </ResponseField>

    <ResponseField name="objects[].modified" type="string">
      ISO 8601 timestamp of when the STIX object was last modified.
    </ResponseField>

    <ResponseField name="objects[].name" type="string">
      Human-readable name for the indicator, for example `Malicious IP 192.0.2.1`.
    </ResponseField>

    <ResponseField name="objects[].pattern" type="string">
      STIX pattern expression describing the indicator, for example `[ipv4-addr:value = '192.0.2.1']`.
    </ResponseField>

    <ResponseField name="objects[].pattern_type" type="string">
      Pattern language used. Always `stix`.
    </ResponseField>

    <ResponseField name="objects[].valid_from" type="string">
      ISO 8601 timestamp from which the indicator is considered valid.
    </ResponseField>

    <ResponseField name="objects[].indicator_types" type="string[]">
      Array of STIX indicator type labels, for example `["malicious-activity"]`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="more" type="boolean">
  `true` if additional pages of objects are available. Use the response headers to paginate.
</ResponseField>

<ResponseField name="next" type="string">
  Pagination token for the next page. Present only when `more` is `true`.
</ResponseField>

## Response headers

| Header                     | Description                                                                                                                               |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `X-TAXII-Date-Added-First` | ISO 8601 timestamp of the earliest object added in this page.                                                                             |
| `X-TAXII-Date-Added-Last`  | ISO 8601 timestamp of the latest object added in this page. Pass this as `added_after` on your next request to avoid re-fetching objects. |

## Delta polling

<Tip>
  Store the value of the `X-TAXII-Date-Added-Last` response header after each successful poll and pass it as `added_after` on your next request. This ensures you only receive objects that were added after your previous poll, preventing duplicate processing and reducing unnecessary data transfer.
</Tip>

```bash theme={null}
# Initial poll
curl -v -H "Authorization: Bearer sk_live_YOUR_KEY" \
  "https://www.socdefenders.ai/api/taxii2/api/collections/all-iocs/objects/?limit=100" \
  2>&1 | grep -E "(X-TAXII-Date-Added|^{)"

# Subsequent poll using the stored X-TAXII-Date-Added-Last value
curl -H "Authorization: Bearer sk_live_YOUR_KEY" \
  "https://www.socdefenders.ai/api/taxii2/api/collections/all-iocs/objects/?added_after=2024-01-15T10:00:00Z&limit=100"
```