What happens when you GET messages

["Bret Jordan (CS)" <Bret_Jordan@symantec.com>]

All,

In the current TAXII API design we have path that looks something like this for messages on a channel.

https://foo.examples.com/taxii/some-api-base-name/channels/some-channel-name/messages

In the following examples I will use ellipses to represent a shorter version the above URL.

What I would like to know is what should happen on a "channel" when you perform

GET ../messages 

Should this return:

1) A JSON array of all of the content on the channel named "some-channel-name" (in practice this might be called Indicator, or threats, or my-risk-matrix, etc.,

2) A JSON array of TAXII message meta data so that you can turn around and do a GET for each message.  Namely something like:

[{

  "type": "message",

  "url": "../channels/some-channel-name/message/111223344",

  "size": 33221

  ...

} {

  "type": "message",

  "url": "../channels/some-channel-name/message/555223399",

  "size": 991123

  ...

}]

3) A single TAXII message of meta data. Doing this would obviously prevent some extra details or granular meta data about each message.  But it would look something like:

{

  "type": "message",

  "urls": [

    "../channels/some-channel-name/message/111223344",

    "url": "../channels/some-channel-name/message/555223399"

  ]

}

Thanks

Bret