<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Implementing Threat Intelligence Sharing

## TAXII 2.1 Server Endpoints

### Discovery
```bash
curl -u user:pass -H "Accept: application/taxii+json;version=2.1" \
  https://taxii-server/taxii2/
```

### List Collections
```bash
curl -u user:pass -H "Accept: application/taxii+json;version=2.1" \
  https://taxii-server/api/v21/collections/
```

### Add Objects to Collection
```bash
curl -X POST -u user:pass \
  -H "Content-Type: application/taxii+json;version=2.1" \
  https://taxii-server/api/v21/collections/COLLECTION_ID/objects/ \
  -d @stix_bundle.json
```

### Get Objects from Collection
```bash
curl -u user:pass -H "Accept: application/taxii+json;version=2.1" \
  "https://taxii-server/api/v21/collections/COLLECTION_ID/objects/?added_after=2026-01-01T00:00:00Z"
```

## MISP Sharing Group API

### Create Sharing Group
```bash
curl -X POST -H "Authorization: MISP_KEY" \
  -H "Content-Type: application/json" \
  https://misp.local/sharing_groups/add \
  -d '{"SharingGroup":{"name":"Sector ISAC","releasability":"Members only"}}'
```

### Add Organization to Group
```bash
curl -X POST -H "Authorization: MISP_KEY" \
  https://misp.local/sharing_groups/addOrg/SG_ID/ORG_ID
```

### List Sharing Groups
```bash
curl -H "Authorization: MISP_KEY" https://misp.local/sharing_groups/index
```

## TLP 2.0 STIX Marking

```python
import stix2

tlp_amber = stix2.TLP_AMBER
indicator = stix2.Indicator(
    pattern="[ipv4-addr:value = '203.0.113.50']",
    pattern_type="stix",
    valid_from="2026-03-01T00:00:00Z",
    object_marking_refs=[tlp_amber],
)
```

## Key Sharing Protocols

| Protocol | Standard | Transport |
|----------|----------|-----------|
| TAXII 2.1 | OASIS | HTTPS REST |
| MISP Sync | MISP Project | HTTPS + API Key |
| STIX 2.1 | OASIS | JSON bundles |
| CybOX | OASIS (deprecated) | XML |
