Manifest Resource

In the manifest resource we allow a list of media types, that the object can be requested in. However, what happens when someone releases a new version of a STIX object, but that object is now in STIX 2.1 or 2.2 format. So you have the base version of the STIX object is in say 2.0. But the new version (which contains a fixed type'o) is in STIX 2.1 format. You can easily get in to this behavior if a TAXII server supports say STIX 2.1 and you pull content from it and then send it to another server that supports both 2.0 and 2.1. So the new version of the object would be in 2.1 but the older versions of the object are in 2.0. The manifest resource does not allow you any ability to specify media types per version. It is just a list of versions and a list of media types.

Further, I am also thinking that identifying the media type in the manifest is probably a mistake. Especially the idea of having it be a "list" of media types. I believe this should be dropped from TAXII 2.1 and I believe that we should add data to the API-Root that advertises the versions of STIX and TAXII that it supports.

Bret

cti-taxii message