> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# v2026-08-02 - TAXII 2.1 Server

> OneFirewall threat intelligence is now available over a standards-based TAXII 2.1 server

OneFirewall now exposes its threat intelligence through a **TAXII 2.1 server**, alongside the existing REST API and STIX 2.0 lookup endpoint. Any TAXII 2.1-compatible client — MISP, OpenCTI, Anomali, or your own ingestion pipeline — can now discover, pull, and (new) **push** OneFirewall indicators using the standard TAXII discovery/collections model, instead of building a custom integration against the REST feeds.

***

<img src="https://mintcdn.com/onefirewall/v1WWv9awKx6Buk8T/images/taxii2-logo.svg?fit=max&auto=format&n=v1WWv9awKx6Buk8T&q=85&s=9390469a7dcc6ddff39c9fc12ee63cca" alt="TAXII 2.1 logo" style={{ height: '80px' }} width="288" height="126" data-path="images/taxii2-logo.svg" />

## Pull: Discover and Sync Indicators

* **Discovery** — `GET /taxii2/` returns the server title, description, and the available API Root.
* **API Root** — `GET /taxii2/onefirewall/` exposes server-wide information and the supported TAXII version.
* **Collections** — `GET /taxii2/onefirewall/collections/` lists three collections, each a live, consensus-scored view over OneFirewall's shared threat data:
  * `ip-indicators` — malicious IPv4 addresses
  * `domain-indicators` — malicious domains
  * `url-indicators` — malicious URLs
* **Objects** — `GET .../collections/{collection-id}/objects/` returns STIX 2.1 Indicator objects, with standard `added_after`, `limit`, and `next` pagination for efficient incremental sync.
* **Manifest** — `GET .../collections/{collection-id}/manifest/` returns lightweight `id`/`date_added`/`version` metadata without full object content, for clients that want to check what's changed before fetching.
* **Single object lookup** — `GET .../collections/{collection-id}/objects/{object-id}/` fetches one indicator by its STIX id.

Each Indicator is generated live from OneFirewall's own consensus scoring — IPv4 scores reflect real-time decay by age, exactly as they do in the REST feeds. Every indicator's STIX id is deterministic (derived from the indicator value itself), so repeated syncs are stable and safe to de-duplicate against.

## New: Push Indicators via TAXII

Collections are now **writable**. `POST .../collections/{collection-id}/objects/` accepts a standard TAXII envelope of up to 50 STIX 2.1 Indicator objects per call and submits them through the same validation and scoring pipeline as the REST API — so a TAXII push behaves identically to a normal OneFirewall submission, just over the standard TAXII wire format.

The server responds with a TAXII Status resource reporting per-object success or failure, so a client submitting a mixed batch can see exactly which indicators were accepted:

```json theme={null}
{
  "id": "status--d5af6a72-9103-45df-88e3-53dd0b94b8e4",
  "status": "complete",
  "total_count": 2,
  "success_count": 1,
  "failure_count": 1,
  "successes": [{ "id": "indicator--f4ca1ddb-965a-54ff-85d9-a94da8e306fb" }],
  "failures": [{ "id": "indicator--bad", "message": "IP format is not valid" }]
}
```

A TAXII submission always contributes to the shared consensus score — it never forces an explicit block/allow decision on your own firewall, and never auto-forwards to the OneFirewall Alliance network. Those remain deliberate, explicit actions via the REST API.

## Authentication & Access

The TAXII server uses the same credentials as the rest of the OneFirewall API — no separate signup or key required:

```http theme={null}
GET /taxii2/onefirewall/collections/ HTTP/1.1
Host: app.onefirewall.com
Authorization: Bearer YOUR_TOKEN_HERE
Accept: application/taxii+json;version=2.1
```

* **Bearer JWT** (or HTTP Basic, for service accounts) — identical to REST API auth.
* Requires your organization's plan to include **Threat Intel** access, same as the existing STIX lookup endpoint.
* Reading objects/manifests is metered against your normal OneFirewall token balance; discovery and the collection listing are free.

## Why It Matters

* **Two-way interoperability** — plug OneFirewall into any TAXII 2.1-native platform for both pulling the shared feed and pushing your own findings back into it, without a custom REST integration.
* **Standardized pagination and filtering** — `added_after`/`next` work exactly as your other TAXII feeds already expect.
* **One identity, every protocol** — the same organization, token, and access scope now work across the REST API, the STIX lookup endpoint, and TAXII.