---
title: "STIX 2.1 Export"
description: "STIX object mappings, Y2 extension fields, identifiers, and timestamps."
canonical: https://y2.dev/docs/ontology/reference/stix-export/
---

Ontology & Fusion

# STIX 2.1 Export

STIX object mappings, Y2 extension fields, identifiers, and timestamps.

The export represents a subject's ledger view as an OASIS STIX 2.1 bundle. The ledger remains the source record. Repeating the same export produces the same object IDs.

The endpoint rejects incomplete results when a subject exceeds its read limit. The [export guide](https://y2.dev/docs/ontology/how-to/export-and-verify) describes local export from a complete log.

## Mapping

| Ledger                               | STIX 2.1                                                                                                            |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------- |
| `person` subject                     | `identity`, `identity_class: individual`                                                                            |
| `organization` subject               | `identity`, `identity_class: organization`                                                                          |
| `system` subject                     | `identity`, `identity_class: system`                                                                                |
| Live preferred label                 | `identity.name`. An unlabeled subject is named by its ledger ID.                                                    |
| Other published names and pseudonyms | `designated_names` in the extension. No alias-only `threat-actor` is created.                                       |
| `external-id` designations           | `identity.external_references` (`sec-edgar-cik`, `lei`, `wikidata`, `mitre-attack`)                                 |
| `ticker` designations                | `identity.external_references` with `source_name: ticker` and `MIC:SYMBOL`                                          |
| `email`                              | `email-addr`                                                                                                        |
| `handle`                             | `user-account` with `account_login` and `account_type` from the namespace. No credentials or login history.         |
| `domain`, `hostname`                 | `domain-name`                                                                                                       |
| `url`                                | `url`                                                                                                               |
| `asn`                                | `autonomous-system`                                                                                                 |
| `designated-by` to an observable     | `relationship` of type `designated-by`                                                                              |
| Other claims                         | `relationship` with the predicate as its type, `confidence`, `start_time`, and `stop_time`                          |
| Unconfirmed `same-as`                | `relationship` of type `related-to`, described as a hypothesis                                                      |
| `follows`                            | `relationship` of type `follows` between two `user-account` objects                                                 |
| Cited observations                   | `external_references` on the relationship: method as `source_name`, URL, excerpt as `description`, `hashes.SHA-256` |
| Retracted claim                      | Omitted by default. With `history=true`, a relationship with `revoked: true`.                                       |

`duplicate-of` and `attributed-to` are never emitted: identity is not confirmed by the ledger.

## Extension

Every exported identity and relationship carries a property extension defined in the bundle:

```
{
  "type": "extension-definition",
  "spec_version": "2.1",
  "name": "Y2 passive entity ledger",
  "schema": "https://y2.dev/docs/ontology/reference/stix-export",
  "version": "0.1.0",
  "extension_types": ["property-extension"]
}
```

| Property            | On           | Meaning                                                                                   |
| ------------------- | ------------ | ----------------------------------------------------------------------------------------- |
| `ledger_subject_id` | identity     | The `sbj_…` ID                                                                            |
| `designated_names`  | identity     | Names other than the label                                                                |
| `ledger_claim_id`   | relationship | The head line's `clm_…` ID                                                                |
| `claim_key`         | relationship | \`predicate                                                                               |
| `predicate`         | relationship | The ledger predicate, even when the type is `related-to`                                  |
| `verification`      | relationship | The [ladder state](https://y2.dev/docs/ontology/reference/vocabulary#verification-ladder) |
| `qualifier`, `note` | relationship | When present                                                                              |

A `Y2` producer `identity` is the `created_by_ref` of the extension, identities, and relationships.

## Identifiers and timestamps

STIX IDs have the form `type--UUID`. Y2 formats SHA-256 digest inputs as version 8 UUIDs:

| Object           | Digest input                                                  |
| ---------------- | ------------------------------------------------------------- |
| Cyber observable | Object type and STIX ID-contributing properties               |
| Identity         | Object type, a one-way workspace scope, and ledger subject ID |
| Relationship     | Object type, workspace scope, and claim key                   |

Equal observables have equal IDs across exports. The workspace ID itself is not exported.

A relationship's `created` time comes from the first record for its claim key. Its `modified` time comes from the current head. An identity's `modified` time includes its opening, designation, and label records, including retractions.

STIX revocation is permanent. Reasserting a retracted claim creates a new relationship ID and `created` time. Later corrections retain that new ID. The extension preserves the original claim key.

An explicit `validAt` cursor becomes part of the identity and relationship ID scope. This separates snapshots with different valid-time contents. The ledger subject ID in the extension connects those snapshots.

A bundle ID includes the full exported content in its digest. An unchanged export produces the same bundle ID.