> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Objects

> Retrieve STIX 2.1 indicator bundles from a TAXII collection.

Returns a STIX 2.1 bundle of threat indicators from the specified collection.

## Incremental polling

Use `added_after` to fetch only indicators added since your last poll:

```
GET /taxii2/collections/reyhford-global-feed/objects/?added_after=2026-07-11T00:00:00Z&limit=100
```

Pagination uses the `next` cursor returned in the bundle.

## Response headers

| Header                     | Description                              |
| -------------------------- | ---------------------------------------- |
| `X-TAXII-Date-Added-First` | Timestamp of earliest object in the page |
| `X-TAXII-Date-Added-Last`  | Timestamp of latest object in the page   |

## STIX extensions

Reyhford indicators may include custom STIX extensions such as `x-reyhford-reputation` with ClickHouse-derived IP reputation context.

## Collection ID

Use `reyhford-global-feed` for the global enriched feed.


## OpenAPI

````yaml GET /taxii2/collections/{collectionId}/objects/
openapi: 3.1.0
info:
  title: Reyhford Threat Intelligence API
  version: 1.0.0
  description: >
    Global ICS/OT threat intelligence feed via TAXII 2.1.

    Real-time indicators from distributed honeypot network across SEA and
    beyond.


    REST paths (/v1/indicators/*) are generated from buf/proto via
    google.api.http annotations.

    TAXII paths (/taxii2/*) are maintained here — taxii-server maps internal
    ThreatIndicator

    to STIX 2.1 at runtime (Anti-Corruption Layer).
  contact:
    email: api@reyhford.com
  license:
    name: Proprietary
    identifier: LicenseRef-proprietary
servers:
  - url: https://api.reyhford.com
    description: Production
  - url: https://api-dev.reyhford.com
    description: Development
security:
  - BearerAuth: []
tags:
  - name: TAXII
    description: TAXII 2.1 standard endpoints (taxii-server Anti-Corruption Layer)
  - name: Health
    description: Service health
  - name: Indicators
    description: Threat indicator search and retrieval (generated from buf/proto)
  - name: QueryService
    description: gRPC QueryService REST mapping
paths:
  /taxii2/collections/{collectionId}/objects/:
    get:
      tags:
        - TAXII
      summary: Get Objects
      description: Retrieve STIX 2.1 objects from a collection
      operationId: getObjects
      parameters:
        - name: collectionId
          in: path
          required: true
          schema:
            type: string
          example: reyhford-global-feed
        - name: added_after
          in: query
          schema:
            type: string
            format: date-time
          description: Return only objects added after this timestamp
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 100
        - name: next
          in: query
          schema:
            type: string
          description: Pagination cursor
      responses:
        '200':
          description: STIX Bundle
          headers:
            X-TAXII-Date-Added-First:
              schema:
                type: string
                format: date-time
            X-TAXII-Date-Added-Last:
              schema:
                type: string
                format: date-time
          content:
            application/taxii+json;version=2.1:
              schema:
                $ref: '#/components/schemas/StixBundle'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  schemas:
    StixBundle:
      type: object
      properties:
        type:
          type: string
          enum:
            - bundle
        id:
          type: string
        spec_version:
          type: string
          enum:
            - '2.1'
        objects:
          type: array
          items:
            $ref: '#/components/schemas/StixIndicator'
        more:
          type: boolean
        next:
          type: string
          description: Pagination cursor
    StixIndicator:
      type: object
      description: >-
        STIX 2.1 indicator object — serialized by taxii-server from internal
        ThreatIndicator
      properties:
        type:
          type: string
          enum:
            - indicator
        spec_version:
          type: string
          enum:
            - '2.1'
        id:
          type: string
          format: uuid
        created:
          type: string
          format: date-time
        modified:
          type: string
          format: date-time
        name:
          type: string
        pattern:
          type: string
          example: '[ipv4-addr:value = ''1.2.3.4'']'
        pattern_type:
          type: string
          enum:
            - stix
        valid_from:
          type: string
          format: date-time
        confidence:
          type: integer
          minimum: 0
          maximum: 100
        labels:
          type: array
          items:
            type: string
    Error:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
  responses:
    Unauthorized:
      description: Authentication required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: WorkOS JWT or machine API key (Bearer token)

````