> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# TAXII Discovery

> Discover Reyhford TAXII 2.1 server capabilities and API roots.

Returns TAXII 2.1 discovery information. This endpoint is **public** and does not require authentication.

Use discovery to confirm server version support and locate API roots before polling collections.

## Typical workflow

1. Call discovery (this endpoint)
2. [List collections](/api-reference/taxii/collections)
3. [Poll objects](/api-reference/taxii/objects) from `reyhford-global-feed`

## Response format

Content-Type: `application/taxii+json;version=2.1`


## OpenAPI

````yaml GET /taxii2/
openapi: 3.1.0
info:
  title: Reyhford Threat Intelligence API
  version: 1.0.0
  description: >
    Global ICS/OT threat intelligence feed via TAXII 2.1.

    Real-time indicators from distributed honeypot network across SEA and
    beyond.


    REST paths (/v1/indicators/*) are generated from buf/proto via
    google.api.http annotations.

    TAXII paths (/taxii2/*) are maintained here — taxii-server maps internal
    ThreatIndicator

    to STIX 2.1 at runtime (Anti-Corruption Layer).
  contact:
    email: api@reyhford.com
  license:
    name: Proprietary
    identifier: LicenseRef-proprietary
servers:
  - url: https://api.reyhford.com
    description: Production
  - url: https://api-dev.reyhford.com
    description: Development
security:
  - BearerAuth: []
tags:
  - name: TAXII
    description: TAXII 2.1 standard endpoints (taxii-server Anti-Corruption Layer)
  - name: Health
    description: Service health
  - name: Indicators
    description: Threat indicator search and retrieval (generated from buf/proto)
  - name: QueryService
    description: gRPC QueryService REST mapping
paths:
  /taxii2/:
    get:
      tags:
        - TAXII
      summary: TAXII Discovery
      description: Returns server discovery information per TAXII 2.1 spec
      operationId: taxiiDiscovery
      responses:
        '200':
          description: TAXII discovery object
          content:
            application/taxii+json;version=2.1:
              schema:
                $ref: '#/components/schemas/TaxiiDiscovery'
        '503':
          description: Service unavailable
      security: []
components:
  schemas:
    TaxiiDiscovery:
      type: object
      properties:
        title:
          type: string
          example: Reyhford Threat Intelligence
        description:
          type: string
        versions:
          type: array
          items:
            type: string
          example:
            - '2.1'
        max_content_length:
          type: integer
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: WorkOS JWT or machine API key (Bearer token)

````