> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# TAXII 2.1

> Trusted Automated Exchange of Intelligence Information — how to poll Reyhford feeds.

**TAXII 2.1** is the OASIS protocol for exchanging STIX over HTTPS. Clients discover API roots, list collections, and poll objects — the same workflow CERTs and MSSPs already use for commercial TI.

## How it works (Reyhford)

1. **Discovery** — `GET /taxii2/` (public)
2. **Collections** — `GET /taxii2/collections/` (API key)
3. **Objects** — `GET /taxii2/collections/{id}/objects/` (API key, supports `added_after`, `limit`)

Base URL: `https://reyhford.com/api` (see [Quickstart](/quickstart)).

## Why TAXII matters for National CERTs

TAXII is the interoperability layer between vendors. Reyhford’s ICS honeypot feed plugs into the same automation that already ingests commercial and ISAO feeds — no custom agent required.

## Personal sensor collections

Customer-enrolled sensors can expose a **sensor-scoped** TAXII collection (org-owned) so operators see attacks hitting their own sensor without receiving only the pooled feed. See [authentication](/authentication) and portal sensor setup.

Next: [Indicators of Compromise](/fundamentals/iocs), [Confidence scoring](/fundamentals/confidence-scoring).