TAXII 2.1
ThreatIntellix runs a standard TAXII 2.1 server (Pro plan and above). Point any TAXII 2.1 client at it the same way you would any other feed. No ThreatIntellix-specific client library needed.
1. Get an API key
In Settings → API keys, generate a key. It authenticates as a Bearer token; copy it immediately, it's only shown once.
2. Server discovery
Discovery is public (no auth); it just points your client at the API root.
curl https://taxii.your-deployment.example/taxii2/3. List collections
Everything from the API root down requires your Bearer token.
curl https://taxii.your-deployment.example/api1/collections/ \
-H "Authorization: Bearer sk_live_..."cisa-kev is the default collection: CISA's Known Exploited Vulnerabilities catalog, mapped to STIX 2.1 vulnerability objects (KEV-specific fields like due date and required action are carried as x_kev_* custom properties). More collections are added as proprietary sources come online.
4. Pull objects
Standard TAXII 2.1 pagination: pass the next value from the response back in as a query param to page through results, and added_after (ISO 8601) to pull only what's new since your last sync.
curl "https://taxii.your-deployment.example/api1/collections/cisa-kev/objects/?limit=50" \
-H "Authorization: Bearer sk_live_..."Read-only
This server only ever publishes ThreatIntellix's own curated data; there's nothing to push into it, so POST to an objects endpoint returns 403. Any TAXII 2.1-compliant consumer (MISP, OpenCTI, a SIEM's native TAXII input) should work against the read path unmodified.