canonical: https://jentic.com/apis/tenable.com/identity-exposure

# Tenable Identity Exposure

API to interact with Identity Exposure. The API exposes 131 endpoints secured with apiKey authentication.

## For AI agents

Programmatically get about singleton., return the last state of every ad-object at the provided timestampby default, th. Covers 131 operations with apiKey authentication.

## Scope

Does not handle payments, communications, or crm - use for identity and authentication only.

## Capabilities

- Get about singleton.
- Return the last state of every ad-object at the provided timestampBy default, th
- Retrieve an AD object by id that have deviances for a specific profile and check
- Query and filter Identity Exposure records by parameters
- Monitor Identity Exposure operational status and events

## Use cases

### Identity and Authentication Operations

Use the Identity Exposure to perform identity auth operations programmatically. The API provides 131 endpoints covering core functionality including get about singleton., return the last state of every ad-object at the provided timestampby default, th, get ad-object instance by id..

Example prompt: Call GET /api/about to get about singleton.

### Automated About Management

Automate about operations by combining multiple Identity Exposure endpoints. Agents can return the last state of every ad-object at the provided timestampby default, th and then get ad-object instance by id. in a single workflow.

Example prompt: Call GET /api/ad-objects to return the last state of every ad-object at the provided timestampby default, th, then verify the result

### AI Agent Integration via Jentic

AI agents discover and call Identity Exposure endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle apiKey tokens manually.

Example prompt: Search Jentic for 'get about singleton.', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /api/about | Get about singleton. |
| GET | /api/ad-objects | Return the last state of every ad-object at the provided timestampBy default, th |
| GET | /api/directories/{directoryId}/ad-objects/{id} | Get ad-object instance by id. |
| GET | /api/infrastructures/{infrastructureId}/directories/{directoryId}/ad-objects/{id} | Get ad-object instance by id. |
| GET | /api/profiles/{profileId}/checkers/{checkerId}/ad-objects/{id} | Retrieve an AD object by id that have deviances for a specific profile and check |
| GET | /api/infrastructures/{infrastructureId}/directories/{directoryId}/events/{eventId}/ad-objects/{id} | Get one ad-object by event and by id |
| GET | /api/infrastructures/{infrastructureId}/directories/{directoryId}/events/{eventId}/ad-objects/{id}/changes | Get one ad-object changes between a given event and the event which precedes it |
| POST | /api/profiles/{profileId}/checkers/{checkerId}/ad-objects/search | Search all AD objects having deviances by profile by checker |

## Key resources

- **About** — Provide general information on Eridanis
- **AD object** — Representation of an Active Directory Object
- **Alert** — New deviances alert
- **API key** — Token to programmatically access Eridanis
- **Application setting** — Tenable.ad global configuration

## Why Jentic

- **Setup:** Wiring Tenable Identity Exposure by hand means learning its x-api-key header auth, pointing at your own customer.tenable.ad host, and handling directory and infrastructure calls yourself. Through Jentic you install once, import Identity Exposure from the API Directory, store the API key once, and your agent calls it.
- **Permission scoping:** Identity Exposure puts the directory id in the URL path (/api/directories/{directoryId}/ad-objects/{id}), so a rule can pin your agent to one directory: it can read AD objects and events for that directory and nothing else. You choose the operations it may call, so anything beyond read access is not included unless you add it.
- **Credential handling:** Your Identity Exposure API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list AD objects' or 'read directory events', and Jentic returns the matching Identity Exposure operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0** — Alternative identity auth API
- **Okta** — Alternative identity auth API

## FAQ

### What authentication does the Identity Exposure use?

The Identity Exposure uses an API key passed in the `x-api-key` header. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I get about singleton. with the Identity Exposure?

Yes. Use the GET /api/about endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the Identity Exposure?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I get about singleton. through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'get about singleton.'. Jentic returns the matching Identity Exposure operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the Identity Exposure have?

The Identity Exposure exposes 131 endpoints covering about, ad object, alert operations.

### Can I limit what my agent is allowed to do with the Identity Exposure API?

Yes. Because you run Jentic One yourself, your own rules decide which Identity Exposure operations and credentials the agent may use. Since the API carries the directory id in the URL path (for example /api/directories/{directoryId}/ad-objects/{id}), you can pin the agent to a single directory and grant only read access to its AD objects and events, such as GET /api/ad-objects. Any operation you do not add stays off limits, so the agent cannot reach beyond the reads you allowed.