Tenable Vulnerability Management API (Nessus)

Name: Tenable Vulnerability Management API (Nessus) API
Brand: Tenable Vulnerability Management API (Nessus)
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityVulnerability ManagementapiKey93 EndpointsREST

For Agents

Connect the Tenable Vulnerability Management API (Nessus) to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Tenable Vulnerability Management API (Nessus), or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Tenable Vulnerability Management API (Nessus) API.

Launch and schedule vulnerability scans with configurable scan templates, targets, and credentials

Export vulnerability findings in bulk with filtering by severity, plugin family, and asset group

Track asset inventory with tagging, network segmentation, and vulnerability history

Query the plugin database for specific CVEs, CWEs, and vulnerability signatures

GET STARTED

Start building with Tenable Vulnerability Management API (Nessus) API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Tenable Vulnerability Management API (Nessus), keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Tenable Vulnerability Management API (Nessus), keeping it validated and agent-ready. Configure and execute vulnerability scans, export findings, manage assets, and track remediation progress across 93 endpoints covering scan lifecycle management, plugin-based detection, agent management, and workbench analytics. The API provides programmatic access to Tenable's vulnerability database with severity-scored findings, CVSS ratings, and asset-level risk prioritization for infrastructure spanning on-premise servers, cloud instances, and containerized workloads.

Use Cases

Patterns agents use Tenable Vulnerability Management API (Nessus) API for, with concrete tasks.

★ AI Agent Vulnerability Assessment

An AI agent uses the Tenable API through Jentic to orchestrate vulnerability assessments, launching scans against target networks, monitoring scan progress, and exporting findings with severity scores and remediation guidance. The agent identifies critical vulnerabilities by CVSS score, cross-references affected assets, and generates prioritized remediation lists — all without manually configuring API key headers or discovering scan template IDs.

Launch a scan via POST /scans with a basic network scan template targeting a CIDR range, monitor status via GET /scans/{scanId}, then export results via POST /scans/{scanId}/export filtered to critical and high severity

Continuous Vulnerability Monitoring

Schedule recurring vulnerability scans across production infrastructure and track remediation progress over time. The API manages scan schedules, monitors completion status, and provides historical vulnerability data per asset. Security teams use the exports API to feed findings into ticketing systems, while workbench analytics reveal trends in vulnerability density and mean-time-to-remediation across organizational units.

Create a scheduled scan via POST /scans with a weekly recurrence rule, then query GET /scans/{scanId}/history to compare vulnerability counts across the last 4 scan runs

Asset-Based Risk Prioritization

Build a risk-prioritized view of infrastructure by querying the asset inventory with vulnerability enrichment. The API provides per-asset vulnerability counts by severity, tracks which assets have the highest exposure, and enables bulk export of asset data for integration with CMDB systems. Tag-based grouping allows teams to segment risk reporting by business unit, environment, or criticality tier.

Export the full asset inventory via POST /assets/export, check export status via GET /assets/export/{exportUuid}/status, then download chunks via GET /assets/export/{exportUuid}/chunks/{chunkId}

Bulk Vulnerability Data Export

Export large vulnerability datasets for offline analysis, compliance reporting, or SIEM ingestion. The chunked export API handles datasets with millions of findings by splitting results into downloadable chunks with status tracking. Exports can be filtered by date range, severity, plugin family, and asset tags to produce targeted datasets for specific compliance frameworks or audit requirements.

Initiate a vulnerability export via POST /vulns/export with severity filter for 'critical', poll status via GET /vulns/export/{exportUuid}/status until complete, then download each chunk

Key Endpoints

93 endpoints — jentic publishes the only available openapi specification for tenable vulnerability management api (nessus), keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/scans

Create and configure a new vulnerability scan

GET

/scans/{scanId}

Retrieve scan details and current status

POST

/scans/{scanId}/export

Export scan results in specified format

POST

/assets/export

Initiate bulk asset inventory export

GET

/assets/export/{exportUuid}/status

Check asset export job status

GET

/assets/export/{exportUuid}/chunks/{chunkId}

Download a chunk of exported asset data

GET

/plugins

List available vulnerability detection plugins

GET

/workbenches/assets

Query asset workbench with vulnerability summaries

POST

/scans

Create and configure a new vulnerability scan

GET

/scans/{scanId}

Retrieve scan details and current status

POST

/scans/{scanId}/export

Export scan results in specified format

POST

/assets/export

Initiate bulk asset inventory export

GET

/assets/export/{exportUuid}/status

Check asset export job status

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Tenable API keys (access key + secret key) are stored encrypted in the Jentic vault (MAXsystem). Agents receive pre-formatted X-ApiKeys headers — raw key values never enter the agent's context window.

Intent-based discovery

Agents search by intent (e.g., 'scan hosts for vulnerabilities') and Jentic returns matching Tenable operations with their input schemas, so the agent can call the right endpoint without navigating Tenable's API documentation or knowing scan template UUIDs.

Time to first call

Direct Tenable integration: 2-4 days for API key management, scan template discovery, and async export handling. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Snyk API

Application dependency vulnerability scanning that complements Tenable's infrastructure scanning

Choose Snyk when the task involves software dependency and container image vulnerabilities rather than network-level infrastructure scanning

Complementary

CrowdStrike Falcon API

Endpoint threat detection that complements Tenable's vulnerability assessment

Choose CrowdStrike when you need real-time threat detection and incident response rather than periodic vulnerability scanning and asset assessment

Alternative

Rapid7 API

Competing vulnerability management platform with similar scanning and asset tracking capabilities

Choose Rapid7 when the organization uses InsightVM/Nexpose rather than Tenable for vulnerability management

FAQs

Specific to using Tenable Vulnerability Management API (Nessus) API through Jentic.

Why is there no official OpenAPI spec for Tenable Vulnerability Management API?

Tenable does not publish an OpenAPI specification for their Vulnerability Management platform. Jentic generates and maintains this spec so that AI agents and developers can call Tenable's API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Tenable Vulnerability Management API use?

The Tenable API uses API key authentication with two headers: X-ApiKeys containing both an accessKey and secretKey in the format 'accessKey={access_key};secretKey={secret_key}'. Through Jentic, both keys are stored encrypted in the MAXsystem vault and agents receive properly formatted auth headers without raw keys entering context.

Can I launch a vulnerability scan programmatically with the Tenable API?

Yes. Use POST /scans to create a scan with a template UUID, target list (IPs, hostnames, or CIDR ranges), and optional credentials. Then launch it via POST /scans/{scanId}/launch. Monitor progress with GET /scans/{scanId} until status shows 'completed', then export results via POST /scans/{scanId}/export.

What are the rate limits for the Tenable Vulnerability Management API?

Tenable enforces rate limits based on your license tier. Standard accounts allow approximately 500 requests per minute for most endpoints. Export operations have separate concurrency limits (typically 2-3 concurrent exports). The API returns 429 status codes with Retry-After headers when limits are exceeded.

How do I export vulnerability findings in bulk through Jentic?

Search Jentic for 'export vulnerability scan results', which returns the POST /assets/export and related chunk download operations. Initiate an export with severity filters, poll the status endpoint until complete, then download each chunk sequentially. Install with pip install jentic and sign up at https://app.jentic.com/sign-up.

Can I manage Nessus agents through the API?

Yes. The agent management endpoints let you list agents, create agent groups, assign agents to groups, and configure scan policies for agent-based scanning. Agent groups are useful for scanning hosts in network segments that lack direct connectivity from the scanner, such as DMZ or air-gapped environments.

Does the API support querying by specific CVE?

Yes. Use the GET /plugins endpoint to search for plugins by CVE ID, which returns the detection plugin details. The workbench endpoints also support filtering scan results by plugin ID or CVE to find all affected assets for a specific vulnerability across your infrastructure.