{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":556,"path":"api-reference/rest-apis/taxii-server-api.md","title":"TISC TAXII Server API","bundle":null,"doc_type":null,"release":"australia","body":"\n# TISC TAXII Server API\n\nProvides Trusted Automated Exchange of Intelligence Information \\(TAXII\\) server endpoints for sharing threat intelligence data in Threat Intelligence Security Center \\(TISC\\).\n\nThis API requires the Threat Intelligence Security Center application, which is available on the ServiceNow Store.\n\nFor additional information about TISC, see [Threat Intelligence Security Center](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/security-management/tisc-landing-page.md).\n\nThis API runs in the `sn_sec_tisc` namespace. The calling user must have the sn\\_sec\\_tisc.taxii\\_server\\_api\\_user role.\n\nThe current version of this API is `v2`. The following capabilities are supported in each version.\n\n- **v1**\n\n Supports sharing threat intelligence data from one ServiceNow instance to another.\n\n- **v2**\n - Adds support for sharing threat intelligence data from a ServiceNow instance to an external system.\n - Supports trailing slashes.\n\n**Parent Topic:**[REST API reference](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-apis/api-rest.md)\n\n## TISC TAXII Server - GET /sn\\_sec\\_tisc/taxii\\_server/taxii2\n\nDiscovery endpoint for the TAXII server. Provides metadata about available API roots, services offered by the TISC TAXII server, and how to interact with it.\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/taxii_server/taxii2`\n\nDefault URL: `/api/sn_sec_tisc/taxii_server/taxii2`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n|Name|Description|\n|----|-----------|\n|None| |\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Header|Description|\n|------|-----------|\n|Accept|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Status code|Description|\n|-----------|-----------|\n|200|Successful. The request was successfully processed.|\n|400|Bad Request. A bad request type or malformed request was detected.|\n|401|Unauthorized. The user credentials are incorrect or have not been passed.|\n|500|Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.|\n\n### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_roots\n\n\n\nList of API roots available in the server.**Note:** The only API root currently supported by Threat Intelligence Security Center is `api/sn_sec_tisc/taxii_server/api_root`.\n\nData type: Array\n\n
\n\ncontact\n\n\n\nContact information related to the TAXII server. Data type: String\n\n
\n\ndefault\n\n\n\nDefault API root that a TAXII client can use.Data type: String\n\n
\n\ndescription\n\n\n\nDescription of the TAXII server. Data type: String\n\n
\n\ntitle\n\n\n\nTitle of the TAXII server.Data type: String\n\n
### cURL request\n\nThis example returns metadata about available API roots.\n\n```\ncurl \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/taxii2\" \\ \n--request GET \\ \n--header \"Accept:application/taxii+json;version=2.1\" \\ \n--user 'username':'password'\n```\n\nResponse body.\n\n```\n{ \n \"title\": \"ServiceNow TAXII Server\", \n \"description\": \"Discovery endpoint for sharing cyber threat intelligence via TAXII\", \n \"contact\": \"TAXII Server Contact\", \n \"default\": \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root\", \n \"api_roots\": [ \n \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root\" \n ] \n}\n```\n\n## TISC TAXII Server - GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}\n\nProvides information about an API root.\n\n**Note:** The only API root currently supported by Threat Intelligence Security Center is `api/sn_sec_tisc/taxii_server/api_root`.\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/taxii_server/{api_root}`\n\nDefault URL: `/api/sn_sec_tisc/taxii_server/{api_root}`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
\n\napi\\_root\n\n\n\nThe API root to retrieve information about.**Note:** The only value currently supported is `api_root`.\n\nData type: String\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n|Name|Description|\n|----|-----------|\n|None| |\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Header|Description|\n|------|-----------|\n|Accept|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Status code|Description|\n|-----------|-----------|\n|200|Successful. The request was successfully processed.|\n|400|Bad Request. A bad request type or malformed request was detected.|\n|401|Unauthorized. The user credentials are incorrect or have not been passed.|\n|500|Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.|\n\n### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\ndescription\n\n\n\nDescription of the API root.Data type: String\n\n
\n\nmax\\_content\\_length\n\n\n\nMaximum size of a request body that can be supported by the TAXII server.Data type: Number\n\nUnit: Octets \\(8-bit bytes\\)\n\n
\n\ntitle\n\n\n\nTitle of the API root.Data type: String\n\n
\n\nversions\n\n\n\nList of TAXII versions that the API root is compatible with. **Note:** The only version currently supported is TAXII 2.1, so this array contains only the value `application/taxii+json;version=2.1`.\n\nData type: Array\n\n
### cURL request\n\nThis example returns information about an API root.\n\n```\ncurl \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root\" \\ \n--request GET \\ \n--header \"Accept:application/taxii+json;version=2.1\" \\ \n--user 'username':'password'\n```\n\nResponse body.\n\n```\n{ \n \"title\": \"ServiceNow TAXII Server\", \n \"description\": \"API root endpoint for sharing cyber threat intelligence via TAXII\", \n \"versions\": [ \n \"application/taxii+json;version=2.1\" \n ], \n \"max_content_length\": 1024 \n}\n```\n\n## TISC TAXII Server - GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections\n\nReturns data about all available TAXII collections at the specified API root.\n\nA TAXII collection is a logical grouping of threat intelligence data that enables the exchange of information between a TAXII client and a TAXII server.\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections`\n\nDefault URL: `/api/sn_sec_tisc/taxii_server/{api_root}/collections`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
\n\napi\\_root\n\n\n\nThe API root to retrieve information about.**Note:** The only value currently supported is `api_root`.\n\nData type: String\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n|Name|Description|\n|----|-----------|\n|None| |\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Header|Description|\n|------|-----------|\n|Accept|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Status code|Description|\n|-----------|-----------|\n|200|Successful. The request was successfully processed.|\n|400|Bad Request. A bad request type or malformed request was detected.|\n|401|Unauthorized. The user credentials are incorrect or have not been passed.|\n|404|Not found. The requested item wasn't found.|\n|500|Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.|\n\n### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\ncollections\n\n\n\nList of collection objects available at the requested API root.Data type: Array\n\n```\n\"collections\": [\n { \n \"can_read\": Boolean, \n \"can_write\": Boolean,\n \"description\": \"String\", \n \"id\": \"String\", \n \"media_types\": [Array], \n \"title\": \"String\" \n } \n]\n```\n\n
\n\ncollections.can\\_read\n\n\n\nFlag that indicates whether the calling user can read data from the collection.Valid values:\n\n- true: The user can read collection data.\n- false: The user can't read collection data.\n\nData type: Boolean\n\n
\n\ncollections.can\\_write\n\n\n\nFlag that indicates whether the calling user can write data to the collection.Valid values:\n\n- true: The user can write collection data.\n- false: The user can't write collection data.\n\n**Note:** The TISC TAXII server doesn't support writing data to collections.\n\nData type: Boolean\n\n
\n\ncollections.description\n\n\n\nDescription of the collection.Data type: String\n\n
\n\ncollections.id\n\n\n\nSys\\_id of the collection.Table: TAXII Collection \\[sn\\_sec\\_tisc\\_taxii\\_server\\_collection\\]\n\nData type: String\n\n
\n\ncollections.media\\_types\n\n\n\nList of supported media types for objects in the collection.**Note:** The only version currently supported is TAXII 2.1, so this array contains only the value `application/taxii+json;version=2.1`.\n\nData type: Array\n\n
\n\ncollections.title\n\n\n\nTitle of the collection.Data type: String\n\n
### cURL request\n\nThis example returns data about all available TAXII collections at the specified API root.\n\n```\ncurl \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections\" \\ \n--request GET \\ \n--header \"Accept:application/taxii+json;version=2.1\" \\ \n--user 'username':'password'\n```\n\nResponse body.\n\n```\n{ \n \"collections\": [ \n { \n \"id\": \"308accee37cd22107253a2d734924baf\", \n \"title\": \" Collection-1\", \n \"can_read\": true, \n \"can_write\": false, \n \"media_types\": [ \n \"application/taxii+json;version=2.1\" \n ] \n }, \n { \n \"id\": \"308accee37cd22107253a2d734926ghy\", \n \"title\": \" Collection-2\", \n \"can_read\": true, \n \"can_write\": false, \n \"media_types\": [ \n \"application/taxii+json;version=2.1\" \n ] \n } \n ] \n}\n```\n\n## TISC TAXII Server - GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}\n\nReturns data about a specified collection.\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}`\n\nDefault URL: `/api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
\n\napi\\_root\n\n\n\nThe API root to retrieve information about.**Note:** The only value currently supported is `api_root`.\n\nData type: String\n\n
\n\nid\n\n\n\nSys\\_id of the collection.Table: TAXII Collection \\[sn\\_sec\\_tisc\\_taxii\\_server\\_collection\\]\n\nData type: String\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n|Name|Description|\n|----|-----------|\n|None| |\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Header|Description|\n|------|-----------|\n|Accept|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Status code|Description|\n|-----------|-----------|\n|200|Successful. The request was successfully processed.|\n|400|Bad Request. A bad request type or malformed request was detected.|\n|401|Unauthorized. The user credentials are incorrect or have not been passed.|\n|404|Not found. The requested item wasn't found.|\n|500|Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.|\n\n### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\ncan\\_read\n\n\n\nFlag that indicates whether the calling user can read data from the collection.Valid values:\n\n- true: The user can read collection data.\n- false: The user can't read collection data.\n\nData type: Boolean\n\n
\n\ncan\\_write\n\n\n\nFlag that indicates whether the calling user can write data to the collection.Valid values:\n\n- true: The user can write collection data.\n- false: The user can't write collection data.\n\n**Note:** The TISC TAXII server doesn't support writing data to collections.\n\nData type: Boolean\n\n
\n\ndescription\n\n\n\nDescription of the collection.Data type: String\n\n
\n\nid\n\n\n\nSys\\_id of the collection.Table: TAXII Collection \\[sn\\_sec\\_tisc\\_taxii\\_server\\_collection\\]\n\nData type: String\n\n
\n\nmedia\\_types\n\n\n\nList of supported media types for objects in the collection.**Note:** The only version currently supported is TAXII 2.1, so this array contains only the value `application/taxii+json;version=2.1`.\n\nData type: Array\n\n
\n\ntitle\n\n\n\nTitle of the collection.Data type: String\n\n
### cURL request\n\nThis example returns data about a specified collection.\n\n```\ncurl \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf\" \\ \n--request GET \\ \n--header \"Accept:application/taxii+json;version=2.1\" \\ \n--user 'username':'password'\n```\n\nResponse body.\n\n```\n{ \n \"id\": \"308accee37cd22107253a2d734924baf\", \n \"title\": \" Collection-1\", \n \"can_read\": true, \n \"can_write\": false, \n \"media_types\": [ \n \"application/taxii+json;version=2.1\" \n ] \n}\n```\n\n## TISC TAXII Server - GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/objects\n\nReturns objects from a specified collection.\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects`\n\nDefault URL: `/api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
\n\napi\\_root\n\n\n\nThe API root to retrieve information about.**Note:** The only value currently supported is `api_root`.\n\nData type: String\n\n
\n\nid\n\n\n\nSys\\_id of the collection.Table: TAXII Collection \\[sn\\_sec\\_tisc\\_taxii\\_server\\_collection\\]\n\nData type: String\n\n
\n
\n\nName\n\n\n\nDescription\n\n
\n\nadded\\_after\n\n\n\nReturns only objects added after the specified time. The timestamp must be in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`.Data type: String\n\n
\n\nlimit\n\n\n\nMaximum number of records to return. For requests that exceed this number of records, use the **next** parameter to paginate record retrieval.Data type: Number\n\nDefault: 100 records per page\n\nMaximum: 1000\n\n
\n\nmatch\\[id\\]\n\n\n\nUnique identifiers of the objects to return, formatted as a string of comma separated values.Object ids can be retrieved using the GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/objects endpoint. They are located in the **objects.id** parameter in the response body.\n\nData type: String\n\n
\n\nmatch\\[spec\\_version\\]\n\n\n\nSpecification versions of objects to return, formatted as a string of comma separated values.**Note:** The only value currently supported is `2.1`.\n\nData type: String\n\n
\n\nmatch\\[type\\]\n\n\n\nTypes of objects to return, formatted as a string of comma separated values.Data type: String\n\n
\n\nmatch\\[version\\]\n\n\n\nVersions of objects to return, formatted as a string of comma separated values.Data type: String\n\n
\n\nnext\n\n\n\nStarting page index at which to begin retrieving records. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks.Data type: Number\n\nDefault: 0\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Header|Description|\n|------|-----------|\n|Accept|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Status code|Description|\n|-----------|-----------|\n|200|Successful. The request was successfully processed.|\n|400|Bad Request. A bad request type or malformed request was detected.|\n|401|Unauthorized. The user credentials are incorrect or have not been passed.|\n|404|Not found. The requested item wasn't found.|\n|500|Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.|\n\n### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\nmore\n\n\n\nFlag that indicates whether the response has a next page.Valid values:\n\n- true: There is a next page.\n- false: There isn't a next page.\n\nData type: Boolean\n\n
\n\nnext\n\n\n\nIndex of the next page of the response.Data type: String\n\n
\n\nobjects\n\n\n\nArray of objects in the collection. Objects are returned in [standard STIX format](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html). The properties included in each object vary based on the object type.Data type: Array\n\n
### cURL request\n\nThis example returns all objects in the specified collection.\n\n```\ncurl \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects\" \\ \n--request GET \\ \n--header \"Accept:application/taxii+json;version=2.1\" \\ \n--user 'username':'password'\n```\n\nResponse body containing one URL object.\n\n```\n\n{\n \"more\": false,\n \"objects\": [\n {\n \"id\": \"url--624ca0a8-ffd1-5210-8253-ffffffffffbe\",\n \"type\": \"url\",\n \"defanged\": false,\n \"value\": \"http://testurl.com\",\n \"object_marking_refs\": [\n \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n ],\n \"extensions\": {\n \"extension-definition--ef28a0ac-ff11-4210-8253-ffffffffffbd\": {\n \"x_is_false_positive\": false,\n \"x_domain\": \"testurl.com\",\n \"x_status\": \"Active\",\n \"x_source_count\": 2,\n \"x_threat_score\": 50,\n \"extension_type\": \"property-extension\"\n }\n }\n },\n {\n \"id\": \"indicator--657bef11-2b7c-4a50-8758-f8014391bff3\",\n \"type\": \"indicator\",\n \"spec_version\": \"2.1\",\n \"created\": \"2025-10-24T14:09:23.000Z\",\n \"modified\": \"2025-11-20T12:14:24.000Z\",\n \"revoked\": false,\n \"confidence\": 75,\n \"object_marking_refs\": [\n \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n ],\n \"pattern\": \"url:value = 'http://testurl.com'\",\n \"pattern_type\": \"stix\",\n \"name\": \"Test Indicator\",\n \"pattern_version\": \"2.1\",\n \"valid_from\": \"2025-10-24T14:09:19.000Z\",\n \"extensions\": {\n \"extension-definition--4f5ba226-ff95-4210-8238-ffffffffff1d\": {\n \"x_status\": \"Active\",\n \"x_source_count\": 1,\n \"x_used_for_detection\": false,\n \"x_threat_level\": \"High\",\n \"x_threat_severity\": \"High\",\n \"x_ioc_classification\": \"Potential Threat\",\n \"extension_type\": \"property-extension\"\n }\n }\n },\n {\n \"name\": \"Test Campaign\",\n \"id\": \"campaign--a02ce391-2b7c-4a50-8758-f8014391bf45\",\n \"type\": \"campaign\",\n \"spec_version\": \"2.1\",\n \"created\": \"2025-10-24T14:12:19.000Z\",\n \"modified\": \"2025-11-20T12:14:39.000Z\",\n \"revoked\": false,\n \"confidence\": 75,\n \"object_marking_refs\": [\n \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n ],\n \"aliases\": [\n \"Test Campaign\"\n ],\n \"extensions\": {\n \"extension-definition--8b5ba226-ff95-4210-8238-ffffffffff1d\": {\n \"x_source_count\": 1,\n \"x_threat_level\": \"High\",\n \"x_threat_severity\": \"High\",\n \"x_status\": \"Active\",\n \"extension_type\": \"property-extension\"\n }\n }\n }\n ]\n}\n```\n\n## TISC TAXII Server - GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/objects/\\{object\\_id\\}\n\nReturns a specified object from a collection.\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects/{object_id}`\n\nDefault URL: `/api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
\n\napi\\_root\n\n\n\nThe API root to retrieve information about.**Note:** The only value currently supported is `api_root`.\n\nData type: String\n\n
\n\nid\n\n\n\nSys\\_id of the collection.Table: TAXII Collection \\[sn\\_sec\\_tisc\\_taxii\\_server\\_collection\\]\n\nData type: String\n\n
\n\nobject\\_id\n\n\n\nUnique identifier of the object.Object ids can be retrieved using the GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/objects endpoint. They are located in the **objects.id** parameter in the response body.\n\nData type: String\n\n
\n
\n\nName\n\n\n\nDescription\n\n
\n\nadded\\_after\n\n\n\nReturns only objects added after the specified time. The timestamp must be in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`.Data type: String\n\n
\n\nlimit\n\n\n\nMaximum number of records to return. For requests that exceed this number of records, use the **next** parameter to paginate record retrieval.Data type: Number\n\nDefault: 100 records per page\n\nMaximum: 1000\n\n
\n\nmatch\\[spec\\_version\\]\n\n\n\nSpecification versions of objects to return, formatted as a string of comma separated values.**Note:** The only value currently supported is `2.1`.\n\nData type: String\n\n
\n\nmatch\\[version\\]\n\n\n\nVersions of objects to return, formatted as a string of comma separated values.Data type: String\n\n
\n\nnext\n\n\n\nStarting page index at which to begin retrieving records. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks.Data type: Number\n\nDefault: 0\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Header|Description|\n|------|-----------|\n|Accept|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Status code|Description|\n|-----------|-----------|\n|200|Successful. The request was successfully processed.|\n|400|Bad Request. A bad request type or malformed request was detected.|\n|401|Unauthorized. The user credentials are incorrect or have not been passed.|\n|404|Not found. The requested item wasn't found.|\n|500|Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.|\n\n### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\nobjects\n\n\n\nThe requested object returned in [standard STIX format](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html). The properties included in the object vary based on the object type.Data type: Array\n\n
### cURL request\n\nThis example returns a specified URL object.\n\n```\ncurl \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects/url--624ca0a8-ffd1-5210-8253-ffffffffffbe\" \\ \n--request GET \\ \n--header \"Accept:application/taxii+json;version=2.1\" \\ \n--user 'username':'password' \n```\n\nResponse body.\n\n```\n{ \n \"objects\": [ \n { \n \"id\": \"url--624ca0a8-ffd1-5210-8253-ffffffffffbe\", \n \"type\": \"url\", \n \"defanged\": false, \n \"value\": \"http://testurl.com \", \n \"object_marking_refs\": [ \n \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\" \n ], \n \"extensions\": { \n \"extension-definition--ef28a0ac-ff11-4210-8253-ffffffffffbd\": { \n \"x_is_false_positive\": false, \n \"x_domain\": \"testurl.com\", \n \"x_status\": \"Active\", \n \"x_source_count\": 2, \n \"x_threat_score\": 50, \n \"extension_type\": \"property-extension\" \n } \n } \n } \n ] \n}\n```\n\n## TISC TAXII Server - GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/objects/\\{object\\_id\\}/versions\n\nReturns all versions of a specified object from a collection.\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/objects/{object_id}/versions`\n\nDefault URL: `/api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/objects/{object_id}/versions`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
\n\napi\\_root\n\n\n\nThe API root to retrieve information about.**Note:** The only value currently supported is `api_root`.\n\nData type: String\n\n
\n\nid\n\n\n\nSys\\_id of the collection.Table: TAXII Collection \\[sn\\_sec\\_tisc\\_taxii\\_server\\_collection\\]\n\nData type: String\n\n
\n\nobject\\_id\n\n\n\nUnique identifier of the object.Object ids can be retrieved using the GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/objects endpoint. They are located in the **objects.id** parameter in the response body.\n\nData type: String\n\n
\n
\n\nName\n\n\n\nDescription\n\n
\n\nadded\\_after\n\n\n\nReturns only objects added after the specified time. The timestamp must be in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`.Data type: String\n\n
\n\nlimit\n\n\n\nMaximum number of records to return. For requests that exceed this number of records, use the **next** parameter to paginate record retrieval.Data type: Number\n\nDefault: 100 records per page\n\nMaximum: 1000\n\n
\n\nmatch\\[spec\\_version\\]\n\n\n\nSpecification versions of objects to return, formatted as a string of comma separated values.**Note:** The only value currently supported is `2.1`.\n\nData type: String\n\n
\n\nnext\n\n\n\nStarting page index at which to begin retrieving records. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks.Data type: Number\n\nDefault: 0\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Header|Description|\n|------|-----------|\n|Accept|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Status code|Description|\n|-----------|-----------|\n|200|Successful. The request was successfully processed.|\n|400|Bad Request. A bad request type or malformed request was detected.|\n|401|Unauthorized. The user credentials are incorrect or have not been passed.|\n|404|Not found. The requested item wasn't found.|\n|500|Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.|\n\n### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\nversions\n\n\n\nList of versions of the object.Data type: Array\n\n
### cURL request\n\nThis example returns all versions of a specified object from a collection.\n\n```\ncurl \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/objects/url--624ca0a8-ffd1-5210-8253-ffffffffffbe/versions\" \\ \n--request GET \\ \n--header \"Accept:application/taxii+json;version=2.1\" \\ \n--user 'username':'password'\n```\n\nResponse body.\n\n```\n{\n \"versions\": [\n \"2025-11-20T12:16:38.000000Z\",\n \"2025-11-20T12:18:51.000000Z\"\n ]\n```\n\n## TISC TAXII Server - GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/manifest\n\nProvides a summary of the objects in a collection.\n\nThis endpoint enables clients to quickly understand what data is available without retrieving the full objects.\n\n### URL format\n\nVersioned URL: `/api/sn_sec_tisc/{api_version}/taxii_server/{api_root}/collections/{id}/manifest`\n\nDefault URL: `/api/sn_sec_tisc/taxii_server/{api_root}/collections/{id}/manifest`\n\n### Supported request parameters\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\napi\\_version\n\n\n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n
\n\napi\\_root\n\n\n\nThe API root to retrieve information about.**Note:** The only value currently supported is `api_root`.\n\nData type: String\n\n
\n\nid\n\n\n\nSys\\_id of the collection.Table: TAXII Collection \\[sn\\_sec\\_tisc\\_taxii\\_server\\_collection\\]\n\nData type: String\n\n
\n
\n\nName\n\n\n\nDescription\n\n
\n\nadded\\_after\n\n\n\nReturns only objects added after the specified time. The timestamp must be in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`.Data type: String\n\n
\n\nlimit\n\n\n\nMaximum number of records to return. For requests that exceed this number of records, use the **next** parameter to paginate record retrieval.Data type: Number\n\nDefault: 100 records per page\n\nMaximum: 1000\n\n
\n\nmatch\\[id\\]\n\n\n\nUnique identifiers of the objects to return, formatted as a string of comma separated values.Object ids can be retrieved using the GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/objects endpoint. They are located in the **objects.id** parameter in the response body.\n\nData type: String\n\n
\n\nmatch\\[spec\\_version\\]\n\n\n\nSpecification versions of objects to return, formatted as a string of comma separated values.**Note:** The only value currently supported is `2.1`.\n\nData type: String\n\n
\n\nmatch\\[type\\]\n\n\n\nTypes of objects to return, formatted as a string of comma separated values.Data type: String\n\n
\n\nmatch\\[version\\]\n\n\n\nVersions of objects to return, formatted as a string of comma separated values.Data type: String\n\n
\n\nnext\n\n\n\nStarting page index at which to begin retrieving records. Use this value to paginate record retrieval. This functionality enables the retrieval of all records, regardless of the number of records, in small manageable chunks.Data type: Number\n\nDefault: 0\n\n
|Name|Description|\n|----|-----------|\n|None| |\n\n### Headers\n\nThe following request and response headers apply to this HTTP action only, or apply to this action in a distinct way. For a list of general headers used in the REST API, see [Supported REST API headers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Header|Description|\n|------|-----------|\n|Accept|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n|Header|Description|\n|------|-----------|\n|Content-Type|Data format of the response body. Only supports **application/taxii+json;version=2.1**.|\n\n### Status codes\n\nThe following status codes apply to this HTTP action. For a list of possible status codes used in the REST API, see [REST API HTTP response codes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/api-reference/rest-api-explorer/c_RESTAPI.md).\n\n|Status code|Description|\n|-----------|-----------|\n|200|Successful. The request was successfully processed.|\n|400|Bad Request. A bad request type or malformed request was detected.|\n|401|Unauthorized. The user credentials are incorrect or have not been passed.|\n|404|Not found. The requested item wasn't found.|\n|500|Internal server error. An unexpected error occurred while processing the request. The response contains additional information about the error.|\n\n### Response body parameters \\(JSON\\)\n\n\n
\n\nName\n\n\n\nDescription\n\n
\n\nmore\n\n\n\nFlag that indicates whether the response has a next page.Valid values:\n\n- true: There is a next page.\n- false: There isn't a next page.\n\nData type: Boolean\n\n
\n\nnext\n\n\n\nIndex of the next page of the response.Data type: String\n\n
\n\nobjects\n\n\n\nArray of manifests for each object in the collection. A manifest provides a brief overview of an object.Data type: Array\n\n```\n\"objects\": [ \n { \n \"date_added\": \"String\",\n \"id\": \"String\",\n \"media_types\": \"String\",\n \"version\": \"String\"\n }\n]\n```\n\n
\n\nobjects.date\\_added\n\n\n\nDate the object was added to the collection in ISO 8601 format, such as `2025-10-27T16:36:20.000Z`.Data type: String\n\n
\n\nobjects.id\n\n\n\nUnique identifier of the object.Object ids can be retrieved using the GET /sn\\_sec\\_tisc/taxii\\_server/\\{api\\_root\\}/collections/\\{id\\}/objects endpoint. They are located in the **objects.id** parameter in the response body.\n\nData type: String\n\n
\n\nobjects.media\\_types\n\n\n\nMedia type of the object.**Note:** The only currently supported type is TAXII 2.1, so this value is always `application/taxii+json;version=2.1`.\n\nData type: String\n\n
\n\nobjects.version\n\n\n\nVersion of the object.Data type: String\n\n
### cURL request\n\nThis example returns manifests for all objects in a collection.\n\n```\ncurl \"https://instance.servicenow.com/api/sn_sec_tisc/taxii_server/api_root/collections/308accee37cd22107253a2d734924baf/manifest\" \\ \n--request GET \\ \n--header \"Accept:application/taxii+json;version=2.1\" \\ \n--user 'username':'password'\n```\n\nResponse body containing a manifest for one object.\n\n```\n\n{\n \"more\": false,\n \"objects\": [\n {\n \"version\": \"2025-11-20T12:16:38.000000Z\",\n \"media_types\": \"application/taxii+json;version=2.1\",\n \"id\": \"indicator--657bef11-2b7c-4a50-8758-f8014391bff3\",\n \"date_added\": \"2025-11-20T04:16:38.000000Z\"\n },\n {\n \"version\": \"2025-11-20T12:16:38.000000Z\",\n \"media_types\": \"application/taxii+json;version=2.1\",\n \"id\": \"campaign--a02ce391-2b7c-4a50-8758-f8014391bf45\",\n \"date_added\": \"2025-11-20T04:16:38.000000Z\"\n },\n {\n \"version\": \"2025-11-20T12:18:51.000000Z\",\n \"media_types\": \"application/taxii+json;version=2.1\",\n \"id\": \"url--624ca0a8-ffd1-5210-8253-ffffffffffbe\",\n \"date_added\": \"2025-11-20T04:18:51.000000Z\"\n }\n ]\n}\n```\n\n"}}