TAXII Server

Introduction

TAXII (Trusted Automated eXchange of Intelligence Information) is a protocol used to exchange cyber threat intelligence over HTTP. TAXII 2.1 is the latest version of this protocol.

Structured Threat Information Expression (STIX) is a language and serialization format used to exchange cyber threat intelligence (CTI). We use STIX version 2.1.

Base URL

BforeAI's TAXII server is available at https://vm-opentaxii-prd.bfore.ai

PreCrime Intelligence collection id: 365fed99-08fa-fdcd-a1b3-fb247eb41d01

Discovery

get

Returns information about the TAXII server, including the API roots available

Authorizations

BasicAuth

AuthorizationstringRequired

Basic Authentication using Base64 encoded username:password. In the request Headers, the Authorization header passes the API a Base64 encoded string representing your username and password values, appended to the text Basic.

Responses

200

Server discovery information

application/taxii+json;version=2.1

401

Authentication failed or missing credentials

application/taxii+json;version=2.1

500

Internal server error

application/taxii+json;version=2.1

get

/taxii2/

HTTPcURLJavaScriptPython

GET /taxii2/ HTTP/1.1
Host: vm-opentaxii-prd.bfore.ai
Authorization: Basic username:password
Accept: */*

{
  "api_roots": [
    "https://vm-opentaxii-prd.bfore.ai/apibfore/"
  ],
  "default": "https://vm-opentaxii-prd.bfore.ai/apibfore/",
  "description": "This TAXII Server contains a listing of URL",
  "title": "Bfore AI Taxii Server"
}

Headers

A valid Accept header is required. The client must specify a media type supported by the TAXII 2.1 server. These include the following:

Media Type	Description
application/taxii+json;version=2.1	TAXII version 2.1 in JSON

Authentication

Our TAXII implementation currently supports Basic Authentication. We plan to add Bearer Tokens with API Keys authentication in the near future.

In the request headers, the Authorization header passes the API a Base64 encoded string representing your username and password values, appended to the text Basic as follows:

Basic <Base64 encoded username:password>

Getting your credentials

Credentials for TAXII server are generated upon request, please get in touch with us in order to manage the access to our TAXII server.

Error Handling

If an error occurs, the server will return a HTTP status code in the 400 or 500 range, along with a JSON object containing more information about the error.

Filtering

TAXII Clients can request specific content from the TAXII Server by specifying a set of filters included in the request to the server. If no URL query parameter is specified then the TAXII Server returns all content for that endpoint.

• added_after, A single timestamp that filters objects to only include those objects added after the specified timestamp. The value of this parameter is a timestamp. The added_after parameter is not in any way related to dates or times in a STIX object or any other CTI object. Example: ?added_after=2022-01-01

• match[<field>], The match parameter defines filtering on the specified field. The list of fields that MUST be supported is defined per endpoint. The match parameter can be specified any number of times, where each match instance specifies an additional filter to be applied to the resulting data and each MUST NOT occur more than once in a request. Said another way, all match fields are ANDed together.

Supported Fields for Match:

Field	Description
id	The STIX ID of the object(s) that are being requested. Examples: ?match[id]=indicator--3600ad1b-fff1-4c98-bcc9-4de3bc2e2ffb
type	The type of the object(s) that are being requested. Examples: ?match[type]=indicator, ?match[type]=indicator,sighting
version	The version(s) of the object(s) that are being requested from either an object or manifest endpoint. If no version parameter is provided, the server will return only the latest version for each object matching the remainder of the request. Examples: ?match[version]=all, ?match[version]=last,first, ?match[version]=first,2018-03-02T01:01:01.123Z,last, ?match[version]=2016-03-23T01:01:01.000Z,2018-03-02T01:01:

Endpoints

Get API Root Information

get

Returns information about the API root, including the collections available

Authorizations

BasicAuth

AuthorizationstringRequired

Basic Authentication using Base64 encoded username:password. In the request Headers, the Authorization header passes the API a Base64 encoded string representing your username and password values, appended to the text Basic.

Path parameters

api-rootstringRequired

The API root identifier

Example: apibfore

Responses

200

API root information

application/taxii+json;version=2.1

401

Authentication failed or missing credentials

application/taxii+json;version=2.1

404

The requested resource was not found

application/taxii+json;version=2.1

500

Internal server error

application/taxii+json;version=2.1

get

/{api-root}/

HTTPcURLJavaScriptPython

GET /{api-root}/ HTTP/1.1
Host: vm-opentaxii-prd.bfore.ai
Authorization: Basic username:password
Accept: */*

{
  "description": "A repo for URL STIX data.",
  "max_content_length": 9765625,
  "title": "Bfore.ai URL STIX 2.1 Collections",
  "versions": [
    "application/taxii+json;version=2.1"
  ]
}

Get Collections

get

Returns a list of the collections available at the API root

Authorizations

BasicAuth

AuthorizationstringRequired

Basic Authentication using Base64 encoded username:password. In the request Headers, the Authorization header passes the API a Base64 encoded string representing your username and password values, appended to the text Basic.

Path parameters

api-rootstringRequired

The API root identifier

Example: apibfore

Responses

200

List of available collections

application/taxii+json;version=2.1

401

Authentication failed or missing credentials

application/taxii+json;version=2.1

404

The requested resource was not found

application/taxii+json;version=2.1

500

Internal server error

application/taxii+json;version=2.1

get

/{api-root}/collections/

HTTPcURLJavaScriptPython

GET /{api-root}/collections/ HTTP/1.1
Host: vm-opentaxii-prd.bfore.ai
Authorization: Basic username:password
Accept: */*

{
  "collections": [
    {
      "id": "365fed99-08fa-fdcd-a1b3-fb247eb41d01",
      "can_read": true,
      "can_write": false,
      "title": "PreCrime Intelligence Online Feed",
      "description": "PreCrime Intelligence is our predictive attack intelligence solution. Powered by behavioral AI, it goes beyond reactive blocklists to provide your team with the most extensive dataset of future malicious infrastructure. The feed is updated in real time, enabling your security stack to proactively block malicious traffic before attacks are launched.",
      "media_types": [
        "application/taxii+json;version=2.1"
      ]
    }
  ]
}

Get Collection

get

Returns information about a specific collection

Authorizations

BasicAuth

AuthorizationstringRequired

Basic Authentication using Base64 encoded username:password. In the request Headers, the Authorization header passes the API a Base64 encoded string representing your username and password values, appended to the text Basic.

Path parameters

api-rootstringRequired

The API root identifier

Example: apibfore

collection-idstring · uuidRequired

The collection identifier

Example: 365fed99-08fa-fdcd-a1b3-fb247eb41d01

Responses

200

Collection information

application/taxii+json;version=2.1

401

Authentication failed or missing credentials

application/taxii+json;version=2.1

404

The requested resource was not found

application/taxii+json;version=2.1

500

Internal server error

application/taxii+json;version=2.1

get

/{api-root}/collections/{collection-id}/

HTTPcURLJavaScriptPython

GET /{api-root}/collections/{collection-id}/ HTTP/1.1
Host: vm-opentaxii-prd.bfore.ai
Authorization: Basic username:password
Accept: */*

{
  "id": "365fed99-08fa-fdcd-a1b3-fb247eb41d01",
  "can_read": true,
  "can_write": false,
  "title": "PreCrime Intelligence Online Feed",
  "description": "PreCrime Intelligence is our predictive attack intelligence solution. Powered by behavioral AI, it goes beyond reactive blocklists to provide your team with the most extensive dataset of future malicious infrastructure. The feed is updated in real time, enabling your security stack to proactively block malicious traffic before attacks are launched.",
  "media_types": [
    "application/taxii+json;version=2.1"
  ]
}

Get Objects

get

Returns a list of the STIX objects in a specific collection

Authorizations

BasicAuth

AuthorizationstringRequired

Basic Authentication using Base64 encoded username:password. In the request Headers, the Authorization header passes the API a Base64 encoded string representing your username and password values, appended to the text Basic.

Path parameters

api-rootstringRequired

The API root identifier

Example: apibfore

collection-idstring · uuidRequired

The collection identifier

Example: 365fed99-08fa-fdcd-a1b3-fb247eb41d01

Query parameters

added_afterstring · dateOptional

A timestamp that filters objects to only include those objects added after the specified timestamp. The added_after parameter is not in any way related to dates or times in a STIX object.

Example: 2022-01-01

match[id]stringOptional

The STIX ID of the object(s) that are being requested

Example: indicator--3600ad1b-fff1-4c98-bcc9-4de3bc2e2ffb

match[type]stringOptional

The type of the object(s) that are being requested

Example: indicator

match[version]stringOptional

The version(s) of the object(s) that are being requested from either an object or manifest endpoint. If no version parameter is provided, the server will return only the latest version for each object matching the remainder of the request.

Example: {"value":"all","description":"All versions"}

Responses

200

List of STIX objects

application/taxii+json;version=2.1

401

Authentication failed or missing credentials

application/taxii+json;version=2.1

404

The requested resource was not found

application/taxii+json;version=2.1

500

Internal server error

application/taxii+json;version=2.1

get

/{api-root}/collections/{collection-id}/objects/

HTTPcURLJavaScriptPython

GET /{api-root}/collections/{collection-id}/objects/ HTTP/1.1
Host: vm-opentaxii-prd.bfore.ai
Authorization: Basic username:password
Accept: */*

{
  "more": true,
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--708a6b3e-04c5-4e7c-885b-b826f520fe97",
      "created": "2026-01-29T12:17:05.300Z",
      "modified": "2026-01-29T12:17:05.300Z",
      "name": "text",
      "pattern": "[domain-name:value = 'lagn.online']",
      "pattern_type": "stix",
      "valid_from": "2026-01-29T12:17:05.300Z",
      "confidence": 1,
      "ANY_ADDITIONAL_PROPERTY": "anything"
    }
  ]
}

Get Object

get

Returns a specific STIX object

Authorizations

BasicAuth

AuthorizationstringRequired

Basic Authentication using Base64 encoded username:password. In the request Headers, the Authorization header passes the API a Base64 encoded string representing your username and password values, appended to the text Basic.

Path parameters

api-rootstringRequired

The API root identifier

Example: apibfore

collection-idstring · uuidRequired

The collection identifier

Example: 365fed99-08fa-fdcd-a1b3-fb247eb41d01

object-idstringRequired

The STIX object identifier

Example: indicator--708a6b3e-04c5-4e7c-885b-b826f520fe97

Query parameters

match[version]stringOptional

The version(s) of the object that are being requested. If no version parameter is provided, the server will return only the latest version.

Example: {"value":"all","description":"All versions"}

Responses

200

STIX object

application/taxii+json;version=2.1

401

Authentication failed or missing credentials

application/taxii+json;version=2.1

404

The requested resource was not found

application/taxii+json;version=2.1

500

Internal server error

application/taxii+json;version=2.1

get

/{api-root}/collections/{collection-id}/objects/{object-id}/

HTTPcURLJavaScriptPython

GET /{api-root}/collections/{collection-id}/objects/{object-id}/ HTTP/1.1
Host: vm-opentaxii-prd.bfore.ai
Authorization: Basic username:password
Accept: */*

{
  "more": false,
  "objects": [
    {
      "confidence": 100,
      "created": "2023-01-16T14:03:31.000Z",
      "id": "indicator--708a6b3e-04c5-4e7c-885b-b826f520fe97",
      "modified": "2025-01-30T13:29:25.000Z",
      "name": "Malicious Domain",
      "pattern": "[domain-name:value = 'lagn.online']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2023-01-16T14:03:31Z"
    }
  ]
}