> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Pull your first STIX indicators from the Reyhford TAXII 2.1 feed in minutes.

Get live ICS/OT threat indicators from Reyhford in under five minutes.

## Prerequisites

* A Reyhford API key (machine/TAXII) from [app.reyhford.com](https://app.reyhford.com)
* `curl` or any TAXII 2.1 client

<Note>
  TAXII discovery is public. Collections and objects require a valid API key in the `Authorization` header.
</Note>

## Step 1 — Discover the server

```bash theme={null}
curl -s https://api.reyhford.com/taxii2/ \
  -H "Accept: application/taxii+json;version=2.1" | jq
```

Expected response includes `title`, `versions` (`2.1`), and API roots.

## Step 2 — List collections

```bash theme={null}
export REYHFORD_API_KEY="your-api-key"

curl -s https://api.reyhford.com/taxii2/collections/ \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Accept: application/taxii+json;version=2.1" | jq
```

The primary collection is `reyhford-global-feed`.

## Step 3 — Poll for STIX objects

```bash theme={null}
curl -s "https://api.reyhford.com/taxii2/collections/reyhford-global-feed/objects/?limit=10" \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Accept: application/taxii+json;version=2.1" | jq
```

Use the `added_after` query parameter for incremental polling:

```bash theme={null}
curl -s "https://api.reyhford.com/taxii2/collections/reyhford-global-feed/objects/?added_after=2026-07-01T00:00:00Z&limit=100" \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Accept: application/taxii+json;version=2.1"
```

## Step 4 — Search via REST (optional)

For programmatic filtering, use the Indicators REST API:

```bash theme={null}
curl -s -X POST https://api.reyhford.com/v1/indicators/search \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": {
      "min_confidence": 70,
      "protocols": ["PROTOCOL_MODBUS"]
    },
    "page_size": 10
  }' | jq
```

## Next steps

<CardGroup cols={2}>
  <Card title="Authentication" icon="key" href="/authentication">
    API keys, WorkOS JWT, and TAXII bearer tokens.
  </Card>

  <Card title="Splunk integration" icon="book" href="/guides/splunk-integration">
    Ingest the TAXII feed into Splunk ES.
  </Card>
</CardGroup>