The "meaning" of media types in STIX 2.x

[Drew Varner <drew.varner@ninefx.com>]

My understanding of what the TAXII media type means has changed.

In 2.0, I understood `application/vnd.oasis.taxii+json; version=2.0` to mean âI am dealing with STIX 2.0 Objectsâ. This was largely by inference, where a 2.0 request received a 2.0 Bundle that seemed to allow only objects with the same STIX version.

Now, when I see a media type of `application/stix+json;version=2.1` I think âIâm receiving or sending a STIX 2.1 Bundle.â It could contain STIX 2.0 and/or 2.1 Objects. The only thing I know is that the Bundle itself adheres to the STIX 2.1 standard.

Does the media type in content negotiation represent anything more than the Bundle version in use? To know what STIX versions are in use, Iâd have to inspect objects in the Bundle. I think implicitly, the media type should represent an upper-bound on underlying STIX JSON versions we send, accept or return. I donât know if thatâs the case.

- Drew