---
sourceDocument: Xanadu API Reference
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/api-reference

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# TISC TAXII Server API

# TISC TAXII Server API {#ariaid-title1}

* Release version: Xanadu
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 19 minutes to read

Provides Trusted Automated Exchange of Intelligence Information (TAXII) server endpoints for sharing threat intelligence data in Threat Intelligence Security Center (TISC) from one ServiceNow instance to another.
This API requires the Threat Intelligence Security Center application, which is available on the ServiceNow Store.

For additional information about TISC, see [Threat Intelligence Security Center](https://www.servicenow.com/docs/access?context=tisc-landing-page&version=xanadu&pubname=xanadu-security-management&ft:locale=en-US).

This API runs in the `sn_sec_tisc` namespace. The calling user must have the sn_sec_tisc.taxii_server_api_user role.

The current version of this API is `v1`.

## TISC TAXII Server - GET /sn_sec_tisc/taxii_server/taxii2 {#ariaid-title2}

Discovery endpoint for the TAXII server. Provides metadata about available API roots, services offered by the TISC TAXII server, and how to interact with it.

### URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/taxii2

Default URL: /api/sn_sec_tisc/taxii_server/taxii2

### Supported request parameters

{#taxii_serv-GET-taxii2__entry__2}{#taxii_serv-GET-taxii2__version-not_optional-RESTAPI}

| Name | Description |
|-|-|
| api_version | Optional. Version of the endpoint to access. For example, <kbd class="ph userinput">v1</kbd> or <kbd class="ph userinput">v2</kbd>. Only specify this value to use an endpoint version other than the latest. Data type: String |
[Table 1. Path parameters]

{#taxii_serv-GET-taxii2__entry__6}

| Name | Description |
|-|-|
| None |   |
[Table 2. Query parameters]

{#taxii_serv-GET-taxii2__entry__10}

| Name | Description |
|-|-|
| None |   |
[Table 3. Request body parameters]

### Headers {#taxii_serv-GET-taxii2__section_acm_vks_jfc}

The following request and response headers apply to this HTTP
action only, or apply to this action in a distinct way. For a list of general headers used
in the REST API, see [Supported REST API headers](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-taxii2__table_bcm_vks_jfc__entry__2}

| Header | Description |
|-|-|
| Accept | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 4. Request headers]

{#taxii_serv-GET-taxii2__table_bcm_vks_jfc} {#taxii_serv-GET-taxii2__table_ccm_vks_jfc__entry__2}

| Header | Description |
|-|-|
| Content-Type | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 5. Response headers]

{#taxii_serv-GET-taxii2__table_ccm_vks_jfc}

### Status codes

The following status codes apply to this HTTP action. For a
list of possible status codes used in the REST API, see [REST API HTTP response
codes](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-taxii2__entry__22}{#taxii_serv-GET-taxii2__entry-200-status-code}{#taxii_serv-GET-taxii2__entry-400-status-code}{#taxii_serv-GET-taxii2__entry-401-status-code}{#taxii_serv-GET-taxii2__entry-500-status-code}

| Status code | Description |
|-|-|
| 200 | Successful. The request was successfully processed. |
| 400 | Bad Request. A bad request type or malformed request was detected. |
| 401 | Unauthorized. The user credentials are incorrect or have not been passed. |
| 500 | Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error. |
[Table 6. Status codes]

### Response body parameters (JSON)

{#taxii_serv-GET-taxii2__entry__32}

| Name | Description |
|-|-|
| api_roots | List of API roots available in the server. Note: The only API root currently supported by Threat Intelligence Security Center is `api/sn_sec_tisc/taxii_server/api_root`. Data type: Array |
| contact | Contact information related to the TAXII server. Data type: String |
| default | Default API root that a TAXII client can use. Data type: String |
| description | Description of the TAXII server. Data type: String |
| title | Title of the TAXII server. Data type: String |
[ ]

### cURL request

This example returns metadata about available API roots.

    curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/taxii2" \ 
    --request GET \ 
    --header "Accept:application/taxii+json;version=2.1" \ 
    --user 'username':'password'

Response body.

    { 
        "title": "ServiceNow TAXII Server", 
        "description": "Discovery endpoint for sharing cyber threat intelligence via TAXII", 
        "contact": "TAXII Server Contact", 
        "default": "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root", 
        "api_roots": [ 
            "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root" 
        ] 
    }

## TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root} {#ariaid-title3}

Provides information about an API root.
Note:  
The only API root currently supported by Threat Intelligence Security Center is `api/sn_sec_tisc/taxii_server/api_root`.

### URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}

### Supported request parameters

{#taxii_serv-GET-apiroot__entry__2}{#taxii_serv-GET-apiroot__version-not_optional-RESTAPI}

| Name | Description |
|-|-|
| api_version | Optional. Version of the endpoint to access. For example, <kbd class="ph userinput">v1</kbd> or <kbd class="ph userinput">v2</kbd>. Only specify this value to use an endpoint version other than the latest. Data type: String |
| api_root | The API root to retrieve information about. Note: The only value currently supported is `api_root`. |
[Table 7. Path parameters]

{#taxii_serv-GET-apiroot__entry__8}

| Name | Description |
|-|-|
| None |   |
[Table 8. Query parameters]

{#taxii_serv-GET-apiroot__entry__12}

| Name | Description |
|-|-|
| None |   |
[Table 9. Request body parameters]

### Headers {#taxii_serv-GET-apiroot__section_hgb_vks_jfc}

The following request and response headers apply to this HTTP
action only, or apply to this action in a distinct way. For a list of general headers used
in the REST API, see [Supported REST API headers](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-apiroot__table_igb_vks_jfc__entry__2}

| Header | Description |
|-|-|
| Accept | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 10. Request headers]

{#taxii_serv-GET-apiroot__table_igb_vks_jfc} {#taxii_serv-GET-apiroot__table_jgb_vks_jfc__entry__2}

| Header | Description |
|-|-|
| Content-Type | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 11. Response headers]

{#taxii_serv-GET-apiroot__table_jgb_vks_jfc}

### Status codes {#taxii_serv-GET-apiroot__section_u2d_pls_jfc}

The following status codes apply to this HTTP action. For a
list of possible status codes used in the REST API, see [REST API HTTP response
codes](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-apiroot__table_v2d_pls_jfc__entry__2}{#taxii_serv-GET-apiroot__entry-200-status-code}{#taxii_serv-GET-apiroot__entry-400-status-code}{#taxii_serv-GET-apiroot__entry-401-status-code}{#taxii_serv-GET-apiroot__entry-500-status-code}

| Status code | Description |
|-|-|
| 200 | Successful. The request was successfully processed. |
| 400 | Bad Request. A bad request type or malformed request was detected. |
| 401 | Unauthorized. The user credentials are incorrect or have not been passed. |
| 500 | Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error. |
[Table 12. Status codes]

{#taxii_serv-GET-apiroot__table_v2d_pls_jfc}

### Response body parameters (JSON)

{#taxii_serv-GET-apiroot__entry__34}

| Name | Description |
|-|-|
| description | Description of the API root. Data type: String |
| max_content_length | Maximum size of a request body that can be supported by the TAXII server. Data type: Number Unit: Octets (8-bit bytes) |
| title | Title of the API root. Data type: String |
| versions | List of TAXII versions that the API root is compatible with. Note: The only version currently supported is TAXII 2.1, so this array contains only the value `application/taxii+json;version=2.1`. Data type: Array |
[ ]

### cURL request

This example returns information about an API root.

    curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root" \ 
    --request GET \ 
    --header "Accept:application/taxii+json;version=2.1" \ 
    --user 'username':'password'

Response body.

    { 
        "title": "ServiceNow TAXII Server", 
        "description": "API root endpoint for sharing cyber threat intelligence via TAXII", 
        "versions": [ 
            "application/taxii+json;version=2.1" 
        ], 
        "max_content_length": 1024 
    }

## TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections {#ariaid-title4}

Returns data about all available TAXII collections at the specified API root.
A TAXII collection is a logical grouping of threat intelligence data that enables the exchange of information between a TAXII client and a TAXII server.

### URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections

### Supported request parameters

{#taxii_serv-GET-collections__entry__2}{#taxii_serv-GET-collections__version-not_optional-RESTAPI}

| Name | Description |
|-|-|
| api_version | Optional. Version of the endpoint to access. For example, <kbd class="ph userinput">v1</kbd> or <kbd class="ph userinput">v2</kbd>. Only specify this value to use an endpoint version other than the latest. Data type: String |
| api_root | The API root to retrieve information about. Note: The only value currently supported is `api_root`. |
[Table 13. Path parameters]

{#taxii_serv-GET-collections__entry__8}

| Name | Description |
|-|-|
| None |   |
[Table 14. Query parameters]

{#taxii_serv-GET-collections__entry__12}

| Name | Description |
|-|-|
| None |   |
[Table 15. Request body parameters]

### Headers {#taxii_serv-GET-collections__section_djl_tks_jfc}

The following request and response headers apply to this HTTP
action only, or apply to this action in a distinct way. For a list of general headers used
in the REST API, see [Supported REST API headers](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-collections__table_ejl_tks_jfc__entry__2}

| Header | Description |
|-|-|
| Accept | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 16. Request headers]

{#taxii_serv-GET-collections__table_ejl_tks_jfc} {#taxii_serv-GET-collections__table_fjl_tks_jfc__entry__2}

| Header | Description |
|-|-|
| Content-Type | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 17. Response headers]

{#taxii_serv-GET-collections__table_fjl_tks_jfc}

### Status codes {#taxii_serv-GET-collections__section_sgb_qls_jfc}

The following status codes apply to this HTTP action. For a
list of possible status codes used in the REST API, see [REST API HTTP response
codes](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-collections__table_tgb_qls_jfc__entry__2}{#taxii_serv-GET-collections__entry-200-status-code}{#taxii_serv-GET-collections__entry-400-status-code}{#taxii_serv-GET-collections__entry-401-status-code}{#taxii_serv-GET-collections__entry-404-status-code}{#taxii_serv-GET-collections__entry-500-status-code}

| Status code | Description |
|-|-|
| 200 | Successful. The request was successfully processed. |
| 400 | Bad Request. A bad request type or malformed request was detected. |
| 401 | Unauthorized. The user credentials are incorrect or have not been passed. |
| 404 | Not found. The requested item wasn't found. |
| 500 | Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error. |
[Table 18. Status codes]

{#taxii_serv-GET-collections__table_tgb_qls_jfc}

### Response body parameters (JSON)

{#taxii_serv-GET-collections__entry__36}

| Name | Description |
|-|-|
| collections | List of collection objects available at the requested API root. Data type: Array "collections": [ { "can_read": Boolean, "can_write": Boolean, "description": "String", "id": "String", "media_types": [Array], "title": "String" } ] |
| collections.can_read | Flag that indicates whether the calling user can read data from the collection. Valid values: * true: The user can read collection data. * false: The user can't read collection data. {#taxii_serv-GET-collections__ul_dhv_gls_hfc} Data type: Boolean |
| collections.can_write | Flag that indicates whether the calling user can write data to the collection. Valid values: * true: The user can write collection data. * false: The user can't write collection data. {#taxii_serv-GET-collections__ul_lbp_lls_hfc} Note: The TISC TAXII server doesn't support writing data to collections. Data type: Boolean |
| collections.description | Description of the collection. Data type: String |
| collections.id | Sys_id of the collection. Table: TAXII Collection \[sn_sec_tisc_taxii_server_collection\] Data type: String |
| collections.media_types | List of supported media types for objects in the collection. Note: The only version currently supported is TAXII 2.1, so this array contains only the value `application/taxii+json;version=2.1`. Data type: Array |
| collections.title | Title of the collection. Data type: String |
[ ]

### cURL request

This example returns data about all available TAXII collections at the specified API root.

    curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections" \ 
    --request GET \ 
    --header "Accept:application/taxii+json;version=2.1" \ 
    --user 'username':'password'

Response body.

    { 
        "collections": [ 
            { 
                "id": "308accee37cd22107253a2d734924baf", 
                "title": " Collection-1", 
                "can_read": true, 
                "can_write": false, 
                "media_types": [ 
                    "application/taxii+json;version=2.1" 
                ] 
            }, 
            { 
                "id": "308accee37cd22107253a2d734926ghy", 
                "title": " Collection-2", 
                "can_read": true, 
                "can_write": false, 
                "media_types": [ 
                    "application/taxii+json;version=2.1" 
                ] 
            } 
        ] 
    }

## TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id} {#ariaid-title5}

Returns data about a specified collection.

### URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}

### Supported request parameters

{#taxii_serv-GET-collections-id__entry__2}{#taxii_serv-GET-collections-id__version-not_optional-RESTAPI}

| Name | Description |
|-|-|
| api_version | Optional. Version of the endpoint to access. For example, <kbd class="ph userinput">v1</kbd> or <kbd class="ph userinput">v2</kbd>. Only specify this value to use an endpoint version other than the latest. Data type: String |
| api_root | The API root to retrieve information about. Note: The only value currently supported is `api_root`. |
| id | Sys_id of the collection. Table: TAXII Collection \[sn_sec_tisc_taxii_server_collection\] |
[Table 19. Path parameters]

{#taxii_serv-GET-collections-id__entry__10}

| Name | Description |
|-|-|
| None |   |
[Table 20. Query parameters]

{#taxii_serv-GET-collections-id__entry__14}

| Name | Description |
|-|-|
| None |   |
[Table 21. Request body parameters]

### Headers {#taxii_serv-GET-collections-id__section_rlk_sks_jfc}

The following request and response headers apply to this HTTP
action only, or apply to this action in a distinct way. For a list of general headers used
in the REST API, see [Supported REST API headers](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-collections-id__table_slk_sks_jfc__entry__2}

| Header | Description |
|-|-|
| Accept | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 22. Request headers]

{#taxii_serv-GET-collections-id__table_slk_sks_jfc} {#taxii_serv-GET-collections-id__table_tlk_sks_jfc__entry__2}

| Header | Description |
|-|-|
| Content-Type | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 23. Response headers]

{#taxii_serv-GET-collections-id__table_tlk_sks_jfc}

### Status codes {#taxii_serv-GET-collections-id__section_sgb_qls_jfc}

The following status codes apply to this HTTP action. For a
list of possible status codes used in the REST API, see [REST API HTTP response
codes](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-collections-id__table_tgb_qls_jfc__entry__2}{#taxii_serv-GET-collections-id__entry-200-status-code}{#taxii_serv-GET-collections-id__entry-400-status-code}{#taxii_serv-GET-collections-id__entry-401-status-code}{#taxii_serv-GET-collections-id__entry-404-status-code}{#taxii_serv-GET-collections-id__entry-500-status-code}

| Status code | Description |
|-|-|
| 200 | Successful. The request was successfully processed. |
| 400 | Bad Request. A bad request type or malformed request was detected. |
| 401 | Unauthorized. The user credentials are incorrect or have not been passed. |
| 404 | Not found. The requested item wasn't found. |
| 500 | Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error. |
[Table 24. Status codes]

{#taxii_serv-GET-collections-id__table_tgb_qls_jfc}

### Response body parameters (JSON)

{#taxii_serv-GET-collections-id__table_ezw_lzy_hfc__entry__2}

| Name | Description |
|-|-|
| can_read | Flag that indicates whether the calling user can read data from the collection. Valid values: * true: The user can read collection data. * false: The user can't read collection data. {#taxii_serv-GET-collections-id__ul_dhv_gls_hfc} Data type: Boolean |
| can_write | Flag that indicates whether the calling user can write data to the collection. Valid values: * true: The user can write collection data. * false: The user can't write collection data. {#taxii_serv-GET-collections-id__ul_lbp_lls_hfc} Note: The TISC TAXII server doesn't support writing data to collections. Data type: Boolean |
| description | Description of the collection. Data type: String |
| id | Sys_id of the collection. Table: TAXII Collection \[sn_sec_tisc_taxii_server_collection\] Data type: String |
| media_types | List of supported media types for objects in the collection. Note: The only version currently supported is TAXII 2.1, so this array contains only the value `application/taxii+json;version=2.1`. Data type: Array |
| title | Title of the collection. Data type: String |
[ ]

{#taxii_serv-GET-collections-id__table_ezw_lzy_hfc}  

### cURL request

This example returns data about a specified collection.

    curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf" \ 
    --request GET \ 
    --header "Accept:application/taxii+json;version=2.1" \ 
    --user 'username':'password'

Response body.

    { 
        "id": "308accee37cd22107253a2d734924baf", 
        "title": " Collection-1", 
        "can_read": true, 
        "can_write": false, 
        "media_types": [ 
            "application/taxii+json;version=2.1" 
        ] 
    }

## TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects {#ariaid-title6}

Returns objects from a specified collection.

### URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects

### Supported request parameters

{#taxii_serv-GET-cols-objects__entry__2}{#taxii_serv-GET-cols-objects__version-not_optional-RESTAPI}

| Name | Description |
|-|-|
| api_version | Optional. Version of the endpoint to access. For example, <kbd class="ph userinput">v1</kbd> or <kbd class="ph userinput">v2</kbd>. Only specify this value to use an endpoint version other than the latest. Data type: String |
| api_root | The API root to retrieve information about. Note: The only value currently supported is `api_root`. |
| id | Sys_id of the collection. Table: TAXII Collection \[sn_sec_tisc_taxii_server_collection\] |
[Table 25. Path parameters]

{#taxii_serv-GET-cols-objects__entry__10}

| Name | Description |
|-|-|
| added_after | Returns only objects added after the specified time. The timestamp must be in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`. Data type: String |
| limit | Maximum number of records to return. For requests that exceed this number of records, use the next parameter to paginate record retrieval. Data type: Number Default: 100 records per page Maximum: 1000 |
| match\[id\] | Unique identifiers of the objects to return, formatted as a string of comma separated values. Object ids can be retrieved using the GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects endpoint. They are located in the objects.id parameter in the response body. Data type: String |
| match\[spec_version\] | Specification versions of objects to return, formatted as a string of comma separated values. Note: The only value currently supported is `2.1`. Data type: String |
| match\[type\] | Types of objects to return, formatted as a string of comma separated values. Data type: String |
| match\[version\] | Versions of objects to return, formatted as a string of comma separated values. Data type: String |
| next | Starting page index at which to begin retrieving records. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks. Data type: Number Default: 0 |
[Table 26. Query parameters]

{#taxii_serv-GET-cols-objects__entry__26}

| Name | Description |
|-|-|
| None |   |
[Table 27. Request body parameters]

### Headers {#taxii_serv-GET-cols-objects__section_f21_sks_jfc}

The following request and response headers apply to this HTTP
action only, or apply to this action in a distinct way. For a list of general headers used
in the REST API, see [Supported REST API headers](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-cols-objects__table_g21_sks_jfc__entry__2}

| Header | Description |
|-|-|
| Accept | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 28. Request headers]

{#taxii_serv-GET-cols-objects__table_g21_sks_jfc} {#taxii_serv-GET-cols-objects__table_h21_sks_jfc__entry__2}

| Header | Description |
|-|-|
| Content-Type | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 29. Response headers]

{#taxii_serv-GET-cols-objects__table_h21_sks_jfc}

### Status codes {#taxii_serv-GET-cols-objects__section_sgb_qls_jfc}

The following status codes apply to this HTTP action. For a
list of possible status codes used in the REST API, see [REST API HTTP response
codes](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-cols-objects__table_tgb_qls_jfc__entry__2}{#taxii_serv-GET-cols-objects__entry-200-status-code}{#taxii_serv-GET-cols-objects__entry-400-status-code}{#taxii_serv-GET-cols-objects__entry-401-status-code}{#taxii_serv-GET-cols-objects__entry-404-status-code}{#taxii_serv-GET-cols-objects__entry-500-status-code}

| Status code | Description |
|-|-|
| 200 | Successful. The request was successfully processed. |
| 400 | Bad Request. A bad request type or malformed request was detected. |
| 401 | Unauthorized. The user credentials are incorrect or have not been passed. |
| 404 | Not found. The requested item wasn't found. |
| 500 | Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error. |
[Table 30. Status codes]

{#taxii_serv-GET-cols-objects__table_tgb_qls_jfc}

### Response body parameters (JSON)

{#taxii_serv-GET-cols-objects__entry__50}

| Name | Description |
|-|-|
| more | Flag that indicates whether the response has a next page. Valid values: * true: There is a next page. * false: There isn't a next page. {#taxii_serv-GET-cols-objects__ul_myh_3wq_jfc} Data type: Boolean |
| next | Index of the next page of the response. Data type: String |
| objects | Array of objects in the collection. Objects are returned in [standard STIX format](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html). The properties included in each object vary based on the object type. Data type: Array |
[ ]

### cURL request

This example returns all objects in the specified collection.

    curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects" \ 
    --request GET \ 
    --header "Accept:application/taxii+json;version=2.1" \ 
    --user 'username':'password'

Response body containing one URL object.


    {
      "more": false,
      "objects": [
        {
          "id": "url--624ca0a8-ffd1-5210-8253-ffffffffffbe",
          "type": "url",
          "defanged": false,
          "value": "http://testurl.com",
          "object_marking_refs": [
            "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
          ],
          "extensions": {
            "extension-definition--ef28a0ac-ff11-4210-8253-ffffffffffbd": {
              "x_is_false_positive": false,
              "x_domain": "testurl.com",
              "x_status": "Active",
              "x_source_count": 2,
              "x_threat_score": 50,
              "extension_type": "property-extension"
            }
          }
        },
        {
          "id": "indicator--657bef11-2b7c-4a50-8758-f8014391bff3",
          "type": "indicator",
          "spec_version": "2.1",
          "created": "2025-10-24T14:09:23.000Z",
          "modified": "2025-11-20T12:14:24.000Z",
          "revoked": false,
          "confidence": 75,
          "object_marking_refs": [
            "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
          ],
          "pattern": "url:value = 'http://testurl.com'",
          "pattern_type": "stix",
          "name": "Test Indicator",
          "pattern_version": "2.1",
          "valid_from": "2025-10-24T14:09:19.000Z",
          "extensions": {
            "extension-definition--4f5ba226-ff95-4210-8238-ffffffffff1d": {
              "x_status": "Active",
              "x_source_count": 1,
              "x_used_for_detection": false,
              "x_threat_level": "High",
              "x_threat_severity": "High",
              "x_ioc_classification": "Potential Threat",
              "extension_type": "property-extension"
            }
          }
        },
        {
          "name": "Test Campaign",
          "id": "campaign--a02ce391-2b7c-4a50-8758-f8014391bf45",
          "type": "campaign",
          "spec_version": "2.1",
          "created": "2025-10-24T14:12:19.000Z",
          "modified": "2025-11-20T12:14:39.000Z",
          "revoked": false,
          "confidence": 75,
          "object_marking_refs": [
            "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
          ],
          "aliases": [
            "Test Campaign"
          ],
          "extensions": {
            "extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1d": {
              "x_source_count": 1,
              "x_threat_level": "High",
              "x_threat_severity": "High",
              "x_status": "Active",
              "extension_type": "property-extension"
            }
          }
        }
      ]
    }

## TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id} {#ariaid-title7}

Returns a specified object from a collection.

### URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects/{object_id}

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}

### Supported request parameters

{#taxii_serv-GET-cols-objects-id__entry__2}{#taxii_serv-GET-cols-objects-id__version-not_optional-RESTAPI}{#taxii_serv-GET-cols-objects-id__obj-id-retr}

| Name | Description |
|-|-|
| api_version | Optional. Version of the endpoint to access. For example, <kbd class="ph userinput">v1</kbd> or <kbd class="ph userinput">v2</kbd>. Only specify this value to use an endpoint version other than the latest. Data type: String |
| api_root | The API root to retrieve information about. Note: The only value currently supported is `api_root`. |
| id | Sys_id of the collection. Table: TAXII Collection \[sn_sec_tisc_taxii_server_collection\] |
| object_id | Unique identifier of the object. Object ids can be retrieved using the GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects endpoint. They are located in the objects.id parameter in the response body. |
[Table 31. Path parameters]

{#taxii_serv-GET-cols-objects-id__entry__12}

| Name | Description |
|-|-|
| added_after | Returns only objects added after the specified time. The timestamp must be in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`. Data type: String |
| limit | Maximum number of records to return. For requests that exceed this number of records, use the next parameter to paginate record retrieval. Data type: Number Default: 100 records per page Maximum: 1000 |
| match\[spec_version\] | Specification versions of objects to return, formatted as a string of comma separated values. Note: The only value currently supported is `2.1`. Data type: String |
| match\[version\] | Versions of objects to return, formatted as a string of comma separated values. Data type: String |
| next | Starting page index at which to begin retrieving records. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks. Data type: Number Default: 0 |
[Table 32. Query parameters]

{#taxii_serv-GET-cols-objects-id__entry__24}

| Name | Description |
|-|-|
| None |   |
[Table 33. Request body parameters]

### Headers {#taxii_serv-GET-cols-objects-id__section_ntk_rks_jfc}

The following request and response headers apply to this HTTP
action only, or apply to this action in a distinct way. For a list of general headers used
in the REST API, see [Supported REST API headers](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-cols-objects-id__table_otk_rks_jfc__entry__2}

| Header | Description |
|-|-|
| Accept | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 34. Request headers]

{#taxii_serv-GET-cols-objects-id__table_otk_rks_jfc} {#taxii_serv-GET-cols-objects-id__table_ptk_rks_jfc__entry__2}

| Header | Description |
|-|-|
| Content-Type | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 35. Response headers]

{#taxii_serv-GET-cols-objects-id__table_ptk_rks_jfc}

### Status codes {#taxii_serv-GET-cols-objects-id__section_sgb_qls_jfc}

The following status codes apply to this HTTP action. For a
list of possible status codes used in the REST API, see [REST API HTTP response
codes](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-cols-objects-id__table_tgb_qls_jfc__entry__2}{#taxii_serv-GET-cols-objects-id__entry-200-status-code}{#taxii_serv-GET-cols-objects-id__entry-400-status-code}{#taxii_serv-GET-cols-objects-id__entry-401-status-code}{#taxii_serv-GET-cols-objects-id__entry-404-status-code}{#taxii_serv-GET-cols-objects-id__entry-500-status-code}

| Status code | Description |
|-|-|
| 200 | Successful. The request was successfully processed. |
| 400 | Bad Request. A bad request type or malformed request was detected. |
| 401 | Unauthorized. The user credentials are incorrect or have not been passed. |
| 404 | Not found. The requested item wasn't found. |
| 500 | Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error. |
[Table 36. Status codes]

{#taxii_serv-GET-cols-objects-id__table_tgb_qls_jfc}

### Response body parameters (JSON)

{#taxii_serv-GET-cols-objects-id__entry__48}

| Name | Description |
|-|-|
| objects | The requested object returned in [standard STIX format](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html). The properties included in the object vary based on the object type. Data type: Array |
[ ]

### cURL request

This example returns a specified URL object.

    curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects/url--624ca0a8-ffd1-5210-8253-ffffffffffbe" \ 
    --request GET \ 
    --header "Accept:application/taxii+json;version=2.1" \ 
    --user 'username':'password' 

Response body.

    { 
        "objects": [ 
            { 
                "id": "url--624ca0a8-ffd1-5210-8253-ffffffffffbe", 
                "type": "url", 
                "defanged": false, 
                "value": "http://testurl.com ", 
                "object_marking_refs": [ 
                    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" 
                ], 
                "extensions": { 
                    "extension-definition--ef28a0ac-ff11-4210-8253-ffffffffffbd": { 
                        "x_is_false_positive": false, 
                        "x_domain": "testurl.com", 
                        "x_status": "Active", 
                        "x_source_count": 2, 
                        "x_threat_score": 50, 
                        "extension_type": "property-extension" 
                    } 
                } 
            } 
        ] 
    }

## TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}/versions {#ariaid-title8}

Returns all versions of a specified object from a collection.

### URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects/{object_id}/versions

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}/versions

### Supported request parameters

{#taxii_serv-GET-cols-objects-vs__entry__2}{#taxii_serv-GET-cols-objects-vs__version-not_optional-RESTAPI}{#taxii_serv-GET-cols-objects-vs__obj-id-retr}

| Name | Description |
|-|-|
| api_version | Optional. Version of the endpoint to access. For example, <kbd class="ph userinput">v1</kbd> or <kbd class="ph userinput">v2</kbd>. Only specify this value to use an endpoint version other than the latest. Data type: String |
| api_root | The API root to retrieve information about. Note: The only value currently supported is `api_root`. |
| id | Sys_id of the collection. Table: TAXII Collection \[sn_sec_tisc_taxii_server_collection\] |
| object_id | Unique identifier of the object. Object ids can be retrieved using the GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects endpoint. They are located in the objects.id parameter in the response body. |
[Table 37. Path parameters]

{#taxii_serv-GET-cols-objects-vs__table_r1r_wjw_g3c__entry__2}

| Name | Description |
|-|-|
| added_after | Returns only objects added after the specified time. The timestamp must be in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`. Data type: String |
| limit | Maximum number of records to return. For requests that exceed this number of records, use the next parameter to paginate record retrieval. Data type: Number Default: 100 records per page Maximum: 1000 |
| match\[spec_version\] | Specification versions of objects to return, formatted as a string of comma separated values. Note: The only value currently supported is `2.1`. Data type: String |
| next | Starting page index at which to begin retrieving records. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks. Data type: Number Default: 0 |
[Table 38. Query parameters]

{#taxii_serv-GET-cols-objects-vs__table_r1r_wjw_g3c} {#taxii_serv-GET-cols-objects-vs__entry__22}

| Name | Description |
|-|-|
| None |   |
[Table 39. Request body parameters]

### Headers {#taxii_serv-GET-cols-objects-vs__section_rqb_rks_jfc}

The following request and response headers apply to this HTTP
action only, or apply to this action in a distinct way. For a list of general headers used
in the REST API, see [Supported REST API headers](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-cols-objects-vs__table_sqb_rks_jfc__entry__2}

| Header | Description |
|-|-|
| Accept | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 40. Request headers]

{#taxii_serv-GET-cols-objects-vs__table_sqb_rks_jfc} {#taxii_serv-GET-cols-objects-vs__table_tqb_rks_jfc__entry__2}

| Header | Description |
|-|-|
| Content-Type | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 41. Response headers]

{#taxii_serv-GET-cols-objects-vs__table_tqb_rks_jfc}

### Status codes {#taxii_serv-GET-cols-objects-vs__section_sgb_qls_jfc}

The following status codes apply to this HTTP action. For a
list of possible status codes used in the REST API, see [REST API HTTP response
codes](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-cols-objects-vs__table_tgb_qls_jfc__entry__2}{#taxii_serv-GET-cols-objects-vs__entry-200-status-code}{#taxii_serv-GET-cols-objects-vs__entry-400-status-code}{#taxii_serv-GET-cols-objects-vs__entry-401-status-code}{#taxii_serv-GET-cols-objects-vs__entry-404-status-code}{#taxii_serv-GET-cols-objects-vs__entry-500-status-code}

| Status code | Description |
|-|-|
| 200 | Successful. The request was successfully processed. |
| 400 | Bad Request. A bad request type or malformed request was detected. |
| 401 | Unauthorized. The user credentials are incorrect or have not been passed. |
| 404 | Not found. The requested item wasn't found. |
| 500 | Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error. |
[Table 42. Status codes]

{#taxii_serv-GET-cols-objects-vs__table_tgb_qls_jfc}

### Response body parameters (JSON)

{#taxii_serv-GET-cols-objects-vs__entry__46}

| Name | Description |
|-|-|
| versions | List of versions of the object. Data type: Array |
[ ]

### cURL request

This example returns all versions of a specified object from a collection.

    curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects/url--624ca0a8-ffd1-5210-8253-ffffffffffbe/versions" \ 
    --request GET \ 
    --header "Accept:application/taxii+json;version=2.1" \ 
    --user 'username':'password'

Response body.

    {
      "versions": [
        "2025-11-20T12:16:38.000000Z",
        "2025-11-20T12:18:51.000000Z"
      ]

## TISC TAXII Server - GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/manifest {#ariaid-title9}

Provides a summary of the objects in a collection.
This endpoint enables clients to quickly understand what data is available without retrieving the full objects.

### URL format

Versioned URL: /api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/manifest

Default URL: /api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/manifest

### Supported request parameters

{#taxii_serv-GET-cols-manifest__entry__2}{#taxii_serv-GET-cols-manifest__version-not_optional-RESTAPI}

| Name | Description |
|-|-|
| api_version | Optional. Version of the endpoint to access. For example, <kbd class="ph userinput">v1</kbd> or <kbd class="ph userinput">v2</kbd>. Only specify this value to use an endpoint version other than the latest. Data type: String |
| api_root | The API root to retrieve information about. Note: The only value currently supported is `api_root`. |
| id | Sys_id of the collection. Table: TAXII Collection \[sn_sec_tisc_taxii_server_collection\] |
[Table 43. Path parameters]

{#taxii_serv-GET-cols-manifest__entry__10}

| Name | Description |
|-|-|
| added_after | Returns only objects added after the specified time. The timestamp must be in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`. Data type: String |
| limit | Maximum number of records to return. For requests that exceed this number of records, use the next parameter to paginate record retrieval. Data type: Number Default: 100 records per page Maximum: 1000 |
| match\[id\] | Unique identifiers of the objects to return, formatted as a string of comma separated values. Object ids can be retrieved using the GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects endpoint. They are located in the objects.id parameter in the response body. Data type: String |
| match\[spec_version\] | Specification versions of objects to return, formatted as a string of comma separated values. Note: The only value currently supported is `2.1`. Data type: String |
| match\[type\] | Types of objects to return, formatted as a string of comma separated values. Data type: String |
| match\[version\] | Versions of objects to return, formatted as a string of comma separated values. Data type: String |
| next | Starting page index at which to begin retrieving records. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks. Data type: Number Default: 0 |
[Table 44. Query parameters]

{#taxii_serv-GET-cols-manifest__entry__26}

| Name | Description |
|-|-|
| None |   |
[Table 45. Request body parameters]

### Headers

The following request and response headers apply to this HTTP
action only, or apply to this action in a distinct way. For a list of general headers used
in the REST API, see [Supported REST API headers](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-cols-manifest__entry__30}

| Header | Description |
|-|-|
| Accept | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 46. Request headers]

{#taxii_serv-GET-cols-manifest__entry__34}

| Header | Description |
|-|-|
| Content-Type | Data format of the response body. Only supports application/taxii+json;version=2.1. |
[Table 47. Response headers]

### Status codes {#taxii_serv-GET-cols-manifest__section_sgb_qls_jfc}

The following status codes apply to this HTTP action. For a
list of possible status codes used in the REST API, see [REST API HTTP response
codes](https://servicenow-prod.fluidtopics.net/2vuQj3~2s_niNXyXhrbRZA "REST (REpresentational State Transfer) is a simple stateless architecture that provides standards between computer systems on the web, making it easier for them to communicate with each other.").
{#taxii_serv-GET-cols-manifest__table_tgb_qls_jfc__entry__2}{#taxii_serv-GET-cols-manifest__entry-200-status-code}{#taxii_serv-GET-cols-manifest__entry-400-status-code}{#taxii_serv-GET-cols-manifest__entry-401-status-code}{#taxii_serv-GET-cols-manifest__entry-404-status-code}{#taxii_serv-GET-cols-manifest__entry-500-status-code}

| Status code | Description |
|-|-|
| 200 | Successful. The request was successfully processed. |
| 400 | Bad Request. A bad request type or malformed request was detected. |
| 401 | Unauthorized. The user credentials are incorrect or have not been passed. |
| 404 | Not found. The requested item wasn't found. |
| 500 | Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error. |
[Table 48. Status codes]

{#taxii_serv-GET-cols-manifest__table_tgb_qls_jfc}

### Response body parameters (JSON)

{#taxii_serv-GET-cols-manifest__entry__50}

| Name | Description |
|-|-|
| more | Flag that indicates whether the response has a next page. Valid values: * true: There is a next page. * false: There isn't a next page. {#taxii_serv-GET-cols-manifest__ul_myh_3wq_jfc} Data type: Boolean |
| next | Index of the next page of the response. Data type: String |
| objects | Array of manifests for each object in the collection. A manifest provides a brief overview of an object. Data type: Array "objects": [ { "date_added": "String", "id": "String", "media_types": "String", "version": "String" } ] |
| objects.date_added | Date the object was added to the collection in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`. Data type: String |
| objects.id | Unique identifier of the object. Object ids can be retrieved using the GET /sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects endpoint. They are located in the objects.id parameter in the response body. Data type: String |
| objects.media_types | Media type of the object. Note: The only currently supported type is TAXII 2.1, so this value is always `application/taxii+json;version=2.1`. Data type: String |
| objects.version | Version of the object. Data type: String |
[ ]

### cURL request

This example returns manifests for all objects in a collection.

    curl "https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/manifest" \ 
    --request GET \ 
    --header "Accept:application/taxii+json;version=2.1" \ 
    --user 'username':'password'

Response body containing a manifest for one object.


    {
      "more": false,
      "objects": [
        {
          "version": "2025-11-20T12:16:38.000000Z",
          "media_types": "application/taxii+json;version=2.1",
          "id": "indicator--657bef11-2b7c-4a50-8758-f8014391bff3",
          "date_added": "2025-11-20T04:16:38.000000Z"
        },
        {
          "version": "2025-11-20T12:16:38.000000Z",
          "media_types": "application/taxii+json;version=2.1",
          "id": "campaign--a02ce391-2b7c-4a50-8758-f8014391bf45",
          "date_added": "2025-11-20T04:16:38.000000Z"
        },
        {
          "version": "2025-11-20T12:18:51.000000Z",
          "media_types": "application/taxii+json;version=2.1",
          "id": "url--624ca0a8-ffd1-5210-8253-ffffffffffbe",
          "date_added": "2025-11-20T04:18:51.000000Z"
        }
      ]
    }