MITRE ATT&CK TAXII API

Free MITRE ATT&CK TAXII 2.1 server with no key: fetch the Enterprise, Mobile and ICS knowledge bases as STIX 2.1 objects — techniques, tactics, groups, software and mitigations.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the MITRE ATT&CK TAXII API?

MITRE runs a free, key-free TAXII 2.1 server distributing the ATT&CK knowledge base as STIX 2.1 objects. Collections cover Enterprise, Mobile and ICS ATT&CK, each containing techniques, tactics, threat groups, software, campaigns, mitigations and the relationships between them.

ATT&CK is the common vocabulary for describing what attackers actually do — technique T1566 means spearphishing to everyone in the industry — and this server is the canonical machine-readable distribution. Objects are STIX 2.1, so techniques arrive as `attack-pattern`, threat groups as `intrusion-set`, tools as `malware` or `tool`, and the connections between them as separate `relationship` objects that you resolve yourself.

Get the host right. The long-standing `cti-taxii.mitre.org` server was retired at the end of 2024 and replaced by `attack-taxii.mitre.org` speaking TAXII 2.1 rather than 2.0, and a great deal of published code and documentation still points at the old address. TAXII also requires a specific media type — `Accept: application/taxii+json;version=2.1` — and omitting it gets you rejected. The collections endpoint shown here is the entry point: read a collection id, then fetch its objects. The full Enterprise collection is tens of megabytes, so most workflows pull it once and query locally, or use the equivalent bundles MITRE publishes on GitHub.

Quick facts

Base URL: https://attack-taxii.mitre.org/api/v21
Authentication: No API key or account. ATT&CK is free to use under MITRE's terms of use, which permit reuse and modification with attribution.
Rate limit: No published limit. Collections are large and update a few times a year, so download once and refresh on release rather than querying repeatedly.
Pricing: Free. ATT&CK is provided by MITRE for public benefit with attribution required.
CORS: Not enabled — call it from your server
Official docs: Read the docs

How to use the MITRE ATT&CK TAXII API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. List the available ATT&CK collections

GET https://attack-taxii.mitre.org/api/v21/collections/

curl

curl 'https://attack-taxii.mitre.org/api/v21/collections/' \
  -H 'Accept: application/taxii+json;version=2.1'

JavaScript (fetch)

const res = await fetch("https://attack-taxii.mitre.org/api/v21/collections/", {
  headers: {
    "Accept": "application/taxii+json;version=2.1",
  },
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

headers = {
    "Accept": "application/taxii+json;version=2.1",
}

res = requests.get("https://attack-taxii.mitre.org/api/v21/collections/", headers=headers, timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "collections": [
    {
      "id": "x-mitre-collection--90c00720-636b-4485-b342-8751d232bf09",
      "title": "ICS ATT&CK",
      "description": "The ATT&CK for Industrial Control Systems (ICS) knowledge base categorizes the unique set of tactics, techniques, and procedures (TTPs) used by threat actors in the ICS technology domain. ATT&CK for ICS outlines the portions of an ICS attack that are out of scope of Enterprise and reflects the various phases of an adversary’s attack life cycle and the assets and systems they are known to target.",
      "can_read": true,
      "can_write": false,
      "media_types": [
        "application/taxii+json;version=2.1",
        "application/taxii+json"
      ]
    },
    {
      "id": "x-mitre-collection--1f5f1533-f617-4ca8-9ab4-6a02367fa019",
      "title": "Enterprise ATT&CK",
      "description": "ATT&CK for Enterprise provides a knowledge base of real-world adversary behavior targeting traditional enterprise networks. ATT&CK for Enterprise covers the following platforms: Windows, macOS, Linux, PRE, Office 365, Google Workspace, IaaS, Network, and Containers.",
      "can_read": true,
      "can_write": false,
      "media_types": [
        "application/taxii+json;version=2.1",
        "application/taxii+json"
      ]
    },
    {
      "id": "x-mitre-collection--dac0d2d7-8653-445c-9bff-82f934c1e858",
      "title": "Mobile ATT&CK",
      "description": "ATT&CK for Mobile is a matrix of adversary behavior against mobile devices (smartphones and tablets running the Android or iOS/iPadOS operating systems). ATT&CK for Mobile builds

Parameters

Parameter	Type	Required	Description
`(Accept header)`	header	Required	Must be `application/taxii+json;version=2.1`. Requests without it are rejected. `application/taxii+json;version=2.1`
`(endpoint) /collections/`	path	Optional	List available collections and their ids. The trailing slash matters. `/api/v21/collections/`
`(endpoint) /collections/{id}/objects/`	path	Optional	Fetch STIX objects from a collection. `/collections/x-mitre-collection--1f5f.../objects/`
`match[type]`	query	Optional	Filter by STIX type, such as `attack-pattern` or `intrusion-set`. `attack-pattern`
`limit`	query	Optional	Page size. Large collections must be paged. `100`
`next`	query	Optional	Paging cursor returned in the previous response envelope. `eyJ...`

Response fields

collections[]array: Available knowledge bases: Enterprise, Mobile and ICS ATT&CK.
collections[].idstring: Collection identifier, an `x-mitre-collection--` STIX id used in every subsequent request.
collections[].title / descriptionstring: Name and scope of the collection.
collections[].can_read / can_writeboolean: Always read-only here — the server publishes, it does not accept submissions.
objects[]array: On the objects endpoint, STIX 2.1 objects: `attack-pattern` for techniques, `intrusion-set` for groups, `course-of-action` for mitigations, `relationship` for links between them.
external_references[]array: Where the familiar ATT&CK ids live — `T1566`, `G0016` and so on appear here, not as a top-level field.

What you can build with the MITRE ATT&CK TAXII API

Map detections and alerts to ATT&CK technique ids
Build a threat-model coverage matrix for your controls
Look up which groups use a given technique or tool
Keep a local ATT&CK mirror synchronised with each release
Enrich incident reports with standard technique names

Common errors and how to fix them

406 Not Acceptable

The TAXII media type was not sent.

Fix: Set `Accept: application/taxii+json;version=2.1` exactly. Plain `application/json` is rejected.

404 or connection failure

Code still points at cti-taxii.mitre.org.

Fix: That server was retired at the end of 2024. Use `attack-taxii.mitre.org` and the TAXII 2.1 endpoints.

Cannot find technique id T1234

ATT&CK ids are not top-level STIX fields.

Fix: Look inside `external_references` for the entry whose `source_name` is `mitre-attack`; its `external_id` is the T-number.

Enormous responses

Enterprise ATT&CK is a very large collection.

Fix: Page with `limit` and `next`, filter with `match[type]`, or download MITRE's published STIX bundles from GitHub and query them locally.

MITRE ATT&CK TAXII API — frequently asked questions

Is the MITRE ATT&CK API free?

Yes, free with no key or account. ATT&CK is published by MITRE for public benefit under terms that permit reuse and modification with attribution.

Why does my old ATT&CK TAXII code no longer work?

Because `cti-taxii.mitre.org`, which spoke TAXII 2.0, was retired at the end of 2024. The replacement is `attack-taxii.mitre.org` speaking TAXII 2.1, which needs a different Accept header and slightly different endpoints.

Where are the T-numbers in the STIX objects?

Inside `external_references`, in the entry whose `source_name` is `mitre-attack`. The `external_id` there is the technique or group id you recognise. There is no top-level field for it.

Should I use the API or the GitHub bundles?

For most purposes, the bundles. ATT&CK changes a few times a year, the Enterprise collection is tens of megabytes, and querying a local copy is faster than paging the TAXII server. Use the API when you specifically need TAXII interoperability.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Path Finder

Evaluate a dot/bracket path against your JSON and list every leaf path for discovery. Free online JSON path finder that runs 100% in your browser.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

MITRE ATT&CK TAXII is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.