# Static TAXII 2.1 endpoint

This directory is a **read-only, static** TAXII 2.1 mirror of the
`genai_incidents` dataset, regenerated on every Pages deploy by
`scripts/export_taxii.py`.

## Endpoints

| TAXII 2.1 resource | URL |
|---|---|
| Discovery | `https://emmanuelgjr.github.io/genai_incidents/taxii2/discovery.json` |
| API Root | `https://emmanuelgjr.github.io/genai_incidents/taxii2/api/root.json` |
| Collections | `https://emmanuelgjr.github.io/genai_incidents/taxii2/api/collections.json` |
| Collection | `https://emmanuelgjr.github.io/genai_incidents/taxii2/api/collections/05bbe2e9-68d9-5f6a-9649-bec972f4addf.json` |
| Objects | `https://emmanuelgjr.github.io/genai_incidents/taxii2/api/collections/05bbe2e9-68d9-5f6a-9649-bec972f4addf/objects.json` |
| Manifest | `https://emmanuelgjr.github.io/genai_incidents/taxii2/api/collections/05bbe2e9-68d9-5f6a-9649-bec972f4addf/manifest.json` |

## Caveat: media type & pagination

GitHub Pages serves these files as `application/json`, **not** the
`application/taxii+json;version=2.1` media type a strict TAXII 2.1 client expects, and it cannot
honour `?added_after=`/pagination query strings. Tools that tolerate the generic
JSON type (or that accept a STIX bundle directly) can consume the collection
`objects.json` as-is — it is a valid STIX 2.1 envelope. For a fully
conformant live API, mirror these objects behind a real TAXII server
(e.g. Medallion) or import the STIX bundle at `data/incidents.stix.json`.

## Quick start

```bash
base="https://emmanuelgjr.github.io/genai_incidents/taxii2"
curl -s "$base/discovery.json" | jq .
curl -s "https://emmanuelgjr.github.io/genai_incidents/taxii2/api/collections/05bbe2e9-68d9-5f6a-9649-bec972f4addf/objects.json" \
  | jq '.objects | group_by(.type) | map({type: .[0].type, n: length})'
```