canonical: https://jentic.com/apis/tenable.com # Tenable APIs Tenable is a cybersecurity vendor whose APIs cover network vulnerability scanning, Active Directory exposure analysis, external attack surface discovery, and multi-account managed service provider administration. Its four APIs let agents launch and export vulnerability scans across infrastructure, read the state of Active Directory objects and detected deviances, export discovered external assets, and manage customer accounts within an MSSP portal, all over a common API key model. ## For AI agents An agent can launch vulnerability scans, export findings and asset inventories, inspect Active Directory objects and identity exposure deviances, export externally discovered assets, and administer managed customer accounts across Tenable's security surface. It ties infrastructure scanning, identity posture, external attack surface, and multi-tenant account management into a single credentialed workflow. ## Scope Use for: Vulnerability scanning, Active Directory identity exposure analysis, external attack surface asset discovery, and MSSP multi-account administration across Tenable's security products Not supported: - endpoint detection response - SIEM correlation - application code analysis - payment processing - customer messaging ## APIs | API | Category | Endpoints | Description | | --- | --- | --- | --- | | Identity Exposure | identity-auth | 131 | Programmatically get about singleton., return the last state of every ad-object at the provided timestampby default, th. | | Tenable Vulnerability Management API (Nessus) | security | 93 | Launch vulnerability scans, export scan results, manage asset inventories, and track remediation progress across network infrastructure through Tenable's Vulnerability Management platform. | | Attack Surface Management | developer-tools | 74 | Programmatically download export, export assets in xlsx format. | | MSSP Portal | e-commerce | 34 | Programmatically create evaluation account v1, create evaluation account v2. | ## Which API to use | Need | API | Why | | --- | --- | --- | | Find and export externally exposed internet-facing assets | attack-surface-management | Attack Surface Management discovers external assets and exports asset and source lists in XLSX, CSV, and JSON formats. | | Scan discovered infrastructure for vulnerabilities and export findings | nessus-api | The Vulnerability Management (Nessus) API launches scans against hosts and exports severity-scored findings and asset inventories in chunks. | | Assess Active Directory identity exposure and object-level deviances | identity-exposure | Identity Exposure reads the state of AD objects over time and the deviances detected for a security profile. | | Administer multiple customer instances as a managed service provider | mssp | The MSSP Portal API lists and manages child accounts, account groups, domains, and evaluation accounts across tenants. | ## Cross-API use cases ### Discover an exposed asset then scan it for vulnerabilities An agent exports externally discovered assets from Attack Surface Management, then launches a vulnerability scan against those hosts with the Nessus API and exports the severity-scored findings. Example prompt: Export the asset list via POST /assets/export/json on Attack Surface Management, then launch a scan against those hosts via POST /scans on the Nessus API and export critical findings ### Correlate infrastructure vulnerabilities with identity exposure An agent exports critical vulnerability findings from the Nessus API and reads the state of related Active Directory objects and their deviances from Identity Exposure to judge combined risk. Example prompt: Export critical findings via POST /vulns/export on the Nessus API, then read affected AD objects and deviances via GET /api/ad-objects on Identity Exposure ### Roll out security scanning across managed customer accounts An MSSP agent lists managed child accounts from the MSSP Portal, then launches vulnerability scans per account with the Nessus API and exports the results for each tenant. Example prompt: List child accounts via GET /mssp/accounts on the MSSP Portal, then for each account launch a scan via POST /scans on the Nessus API and export the results ## Why Jentic - **Setup:** Instead of wiring four Tenable APIs by hand, each with its own host and API key header format, you install Jentic One once and your agent finds and adds the Tenable APIs it needs from the Jentic directory. You store each API key once and the agent calls the operations. - **Permission scoping:** Your own rules in your Jentic One instance decide which Tenable operations the agent may call. You can pin an agent to read-only scan exports or a single managed account, so higher-risk operations like launching new scans or creating evaluation accounts are excluded unless you add them. - **Credential handling:** Each Tenable credential, whether a single API key or an access-key-plus-secret-key pair, is stored encrypted by your own self-hosted Jentic One instance and injected at execution time. Raw keys never enter the agent's prompt, logs, or context. - **Discovery method:** Agents search the Jentic directory by intent, such as 'export exposed assets' or 'scan hosts for vulnerabilities', and Jentic returns the matching Tenable operation with its input schema so the agent calls the right endpoint across the four APIs without browsing reference docs. ## Related vendors - **Rapid7** — Competing vulnerability management platform with similar scanning and asset tracking, an alternative when an organization uses InsightVM or Nexpose. - **CrowdStrike** — Endpoint threat detection and response that complements Tenable's vulnerability assessment for a fuller security picture. - **Snyk** — Application dependency and container vulnerability scanning that complements Tenable's network and infrastructure focus. - **Okta** — Identity provider that pairs with Tenable's Active Directory exposure analysis for identity security workflows. ## FAQ ### What can an agent do across Tenable's APIs? An agent can discover externally exposed assets, launch and export vulnerability scans against infrastructure, read Active Directory identity exposure and detected deviances, and administer multiple managed customer accounts. Together these cover external attack surface, infrastructure risk, identity posture, and multi-tenant account management. ### Do these Tenable APIs share one credential? No. Every Tenable API uses API key authentication, but the header and key format differ by product. The Vulnerability Management and MSSP Portal APIs use an access-key-plus-secret-key pair, while Identity Exposure and Attack Surface Management use single-header keys, so you configure the right credential per API. ### Which Tenable API should an agent use for external assets versus infrastructure scanning? Use Attack Surface Management to discover and export internet-facing assets that belong to an organization, and use the Vulnerability Management (Nessus) API to scan known hosts and export severity-scored findings. A common pattern is discovering assets first, then scanning them. ### How do the APIs fit together in a security workflow? An agent can chain them: export exposed assets from Attack Surface Management, scan those hosts with the Nessus API, and correlate the findings with Active Directory deviances from Identity Exposure. Managed service providers can run these steps across many accounts via the MSSP Portal. ### Is Active Directory analysis part of the same portfolio? Yes. Identity Exposure focuses on Active Directory security, returning the state of AD objects over time and the deviances detected for a given security profile, which complements the infrastructure and external asset views the other APIs provide. ### Which Tenable API is generated by Jentic rather than published by Tenable? The Vulnerability Management (Nessus) API spec is Jentic-generated, kept validated and agent-ready because Tenable does not publish an OpenAPI specification for that platform. Identity Exposure, Attack Surface Management, and the MSSP Portal are vendor-official specs.