> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Collections

> List available TAXII 2.1 collections on the Reyhford server.

Returns the TAXII collections available to your API key.

## Primary collection

| ID                     | Description                                                          |
| ---------------------- | -------------------------------------------------------------------- |
| `reyhford-global-feed` | Global ICS/OT indicators enriched from the Reyhford honeypot network |

## Authentication

Requires a valid API key:

```
Authorization: Bearer <api-key>
```

## Next step

Poll STIX objects from a collection using [Get Objects](/api-reference/taxii/objects).


## OpenAPI

````yaml GET /taxii2/collections/
openapi: 3.1.0
info:
  title: Reyhford Threat Intelligence API
  version: 1.0.0
  description: >
    Global ICS/OT threat intelligence feed via TAXII 2.1.

    Real-time indicators from distributed honeypot network across SEA and
    beyond.


    REST paths (/v1/indicators/*) are generated from buf/proto via
    google.api.http annotations.

    TAXII paths (/taxii2/*) are maintained here — taxii-server maps internal
    ThreatIndicator

    to STIX 2.1 at runtime (Anti-Corruption Layer).
  contact:
    email: api@reyhford.com
  license:
    name: Proprietary
    identifier: LicenseRef-proprietary
servers:
  - url: https://api.reyhford.com
    description: Production
  - url: https://api-dev.reyhford.com
    description: Development
security:
  - BearerAuth: []
tags:
  - name: TAXII
    description: TAXII 2.1 standard endpoints (taxii-server Anti-Corruption Layer)
  - name: Health
    description: Service health
  - name: Indicators
    description: Threat indicator search and retrieval (generated from buf/proto)
  - name: QueryService
    description: gRPC QueryService REST mapping
paths:
  /taxii2/collections/:
    get:
      tags:
        - TAXII
      summary: List Collections
      operationId: listCollections
      responses:
        '200':
          description: List of TAXII collections
          content:
            application/taxii+json;version=2.1:
              schema:
                $ref: '#/components/schemas/CollectionList'
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  schemas:
    CollectionList:
      type: object
      properties:
        collections:
          type: array
          items:
            $ref: '#/components/schemas/Collection'
    Collection:
      type: object
      properties:
        id:
          type: string
          format: uuid
        title:
          type: string
          example: Reyhford Global Feed
        description:
          type: string
        can_read:
          type: boolean
        can_write:
          type: boolean
        media_types:
          type: array
          items:
            type: string
    Error:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
  responses:
    Unauthorized:
      description: Authentication required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: WorkOS JWT or machine API key (Bearer token)

````