TAXII RC2 proposed changes

All,

On the working call today we discussed three potential changes to the TAXII RC2 specification:

1) Remove the ".../collections/object-search/" endpoint from this release.

The rational for this change is that it add undo complexity for our initial MVP release
Further, all of the use-cases that drove its initial inclusion can now be solved via changes / additions we have made over the past 4 months.
We can always add this back in a future release if needed.

2) What to do with the <object-id> at the ".../collections/<name>/objects/<object-id>/" endpoint?

The discussion on the call today focused on the need to define in the specification that for STIX IDs this MUST be the STIX ID.
This would allow non-STIX content to be served via some arbitrary ID created by the TAXII Server
It would prevent there being yet-another-ID for a STIX object

3) Do we want to add a "/id/" to the ".../collections/<name>/objects/<object-id>/" endpoint making it look like ".../collections/<name>/objects/id/<object-id>/".

The discussion question is will this future proof the endpoint if we needed to add additional things at the "/objects/" layer in the future?
We had very little feedback on the call.
The one view expressed is it does not seem to provide any value and in fact may break the more "RESTful" nature of the API.

If you have comments or feedback on any of these three topics, please let us know. The current plan, unless we hear otherwise, is to:

a) remove the "object-search" endpoint from RC2

b) define that the <object-id> such that for STIX objects this ID MUST be the STIX ID

c) do not add "/id/"

Thanks

Bret

cti message