Tenable Assets API
The Assets API from Tenable — 8 operation(s) for assets.
OpenAPI Specification
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Assets API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Assets
x-displayName: Assets
paths:
/assets:
get:
summary: List assets
description: 'Lists up to 5,000 assets.
**Note:** You can use the [POST /assets/v2/export](ref:export-assets-v2) endpoint to export data for all assets. For more information about exporting assets, see [Retrieve Asset Data from Vulnerability Management](doc:retrieve-asset-data-from-tenableio).<div class="perms-callout">Requires the Basic [16] user role. See [Roles](doc:roles).</div>'
operationId: assets-list-assets
tags:
- Assets
responses:
'200':
description: Returned if the list of assets was retrieved successfully.
content:
application/json:
schema:
type: object
properties:
assets:
type: array
description: An object containing an array of assets.
items:
$ref: '#/components/schemas/assets_Response-List-Assets'
total:
type: integer
description: The total number of assets returned in the result set.
examples:
response:
value:
assets:
- id: 436224b4-e3e7-4761-ad47-e32daaebec6b
has_agent: true
last_seen: '2025-04-30T12:45:41.039Z'
last_scan_target: 192.0.2.151
sources:
- name: NESSUS_SCAN
first_seen: '2025-04-18T10:31:22.214Z'
last_seen: '2025-04-18T13:39:54.799Z'
- name: NESSUS_AGENT
first_seen: '2025-04-18T11:48:03.328Z'
last_seen: '2025-04-30T12:45:41.039Z'
- name: ExternalAttackSurfaceMap
first_seen: '2024-05-30T07:40:27.030Z'
last_seen: '2025-05-25T07:31:16.777Z'
acr_score: 5
acr_drivers:
- driver_name: device_type
driver_value:
- general_purpose
- driver_name: device_capability
driver_value:
- pci
- driver_name: internet_exposure
driver_value:
- internal
exposure_score: 686
scan_frequency: null
ipv4:
- 192.0.2.151
ipv6:
- 2001:db8:1a7e:90bb:e562:7e41:3c98:86b0
fqdn:
- lab.example.com
mac_address:
- 10:50:56:a6:90:fb
netbios_name: []
operating_system:
- Oracle Linux Server 8.7
hostname:
- ol-euk-8.4.support.lab.tenablesecurity.com
agent_name:
- example-name
aws_ec2_name: []
security_protection_level: null
security_protections: []
exposure_confidence_value: null
- id: a3f9c21d-55c5-4ed4-9a11-1e876790a630
has_agent: true
last_seen: '2025-06-16T08:23:24.640Z'
last_scan_target: 198.51.100.227
sources:
- name: NESSUS_AGENT
first_seen: '2024-10-03T07:31:15.437Z'
last_seen: '2024-11-13T07:25:28.000Z'
- name: NESSUS_SCAN
first_seen: '2025-06-16T08:23:24.640Z'
last_seen: '2025-06-16T08:23:24.640Z'
acr_score: 4
acr_drivers:
- driver_name: device_type
driver_value:
- general_purpose
- driver_name: device_capability
driver_value:
- pci
- driver_name: internet_exposure
driver_value:
- internal
exposure_score: 622
scan_frequency: null
ipv4:
- 198.51.100.227
ipv6:
- 2001:db8:d0ec:46a:c221:c1fc:5ec8:ed3c
- 2001:db8:98e8:ceea:18b8:2d3b:1cfc:3114
fqdn:
- lab2.example.com
mac_address:
- 40:50:56:a6:ba:36
netbios_name: []
operating_system:
- SLES for SAP 15.3
- Linux Kernel 5.3.18-150300.59.98-default on SLES_SAP15.3
hostname:
- example-suse15sp3
agent_name:
- genie-suse15
aws_ec2_name: []
security_protection_level: null
security_protections: []
exposure_confidence_value: null
- id: 377bd14b-8395-418b-b8f1-c948a05c49af
has_agent: false
last_seen: '2025-06-16T08:23:24.640Z'
last_scan_target: 203.0.113.144
sources:
- name: NESSUS_SCAN
first_seen: '2025-06-16T08:23:24.640Z'
last_seen: '2025-06-16T08:23:24.640Z'
acr_score: 5
acr_drivers:
- driver_name: device_type
driver_value:
- general_purpose
- driver_name: device_capability
driver_value:
- pci
- driver_name: internet_exposure
driver_value:
- internal
exposure_score: 628
scan_frequency: null
ipv4:
- 203.0.113.144
ipv6:
- 2001:db8:578a:266c:f8e5:9fc4:c566:8e93
- 2001:db8:6430:4b72:6ec4:931a:56f:2fb1
fqdn:
- lab3.example.com
mac_address:
- 02:50:56:a6:2a:0f
netbios_name: []
operating_system:
- Oracle Linux 8.10
- Linux Kernel 5.15.0-303.171.5.2.1.el8uek.x86_64 on Oracle Linux Server release 8.10
hostname:
- example-host
agent_name: []
aws_ec2_name: []
security_protection_level: null
security_protections: []
exposure_confidence_value: null
total: 3
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to list assets.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- assets_cloud: []
/assets/{asset_uuid}:
get:
summary: Get asset details
description: Returns details of the specified asset.<div class="perms-callout">Requires the Basic [16] user role. See [Roles](doc:roles).</div>
operationId: assets-asset-info
tags:
- Assets
parameters:
- description: The UUID of the asset.
required: true
name: asset_uuid
in: path
schema:
type: string
responses:
'200':
description: Returned if the details for the specified asset were retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_Response-Asset-Details'
examples:
response:
value:
name: example-asset
id: 236224b4-e3e7-4761-ad47-e32daaebec6b
has_agent: true
created_at: '2025-04-18T10:31:22.214Z'
updated_at: '2025-07-02T00:53:32.864Z'
terminated_at: null
deleted_at: null
aes_score_v3: 757
acr_score_v3: 6
first_seen: '2025-04-18T10:31:22.000Z'
last_seen: '2025-04-30T12:45:41.039Z'
last_scan_target: 172.26.90.79
last_authentication_attempt_date: '2025-04-18T13:39:54.799Z'
last_authentication_success_date: '2025-04-18T13:39:54.799Z'
last_authenticated_scan_date: '2025-04-18T14:20:36.407Z'
last_licensed_scan_date: '2025-04-18T14:20:36.407Z'
last_scan_id: 1bd973b9-85d2-4a4d-90c6-60d399238435
last_schedule_id: template-83dfa4ac-32cc-92dd-4a5e-2ff4136cecaa9f62a41bc3058712
sources:
- name: NESSUS_SCAN
first_seen: '2025-04-18T10:31:22.214Z'
last_seen: '2025-04-18T13:39:54.799Z'
- name: NESSUS_AGENT
first_seen: '2025-04-18T11:48:03.328Z'
last_seen: '2025-04-30T12:45:41.039Z'
tags: []
acr_score: 5
acr_drivers:
- driver_name: device_type
driver_value:
- general_purpose
- driver_name: device_capability
driver_value:
- pci
- driver_name: internet_exposure
driver_value:
- internal
exposure_score: 686
scan_frequency:
- interval: 90
frequency: 3
licensed: false
- interval: 30
frequency: 1
licensed: false
- interval: 60
frequency: 1
licensed: false
interfaces:
- ipv4:
- 192.0.2.80
ipv6:
- 2001:db8:d15:6fab:2728:12c1:35cd:1500
fqdn:
- lab.example.com
mac_address:
- 10:50:56:a6:90:fb
name: ens192
virtual: null
aliased: null
network_id:
- 00000000-0000-0000-0000-000000000000
ipv4:
- 192.0.2.80
ipv6:
- 2001:db8:d15:6fab:2728:12c1:35cd:1500
fqdn:
- lab2.example.com
mac_address:
- 10:50:56:a6:90:fb
netbios_name: []
operating_system:
- Oracle Linux Server 8.7
system_type:
- general-purpose
tenable_uuid:
- 76cd04c276c9431ebeabd8a98ec2af69
hostname:
- ol-euk-8.4.support.lab.tenablesecurity.com
agent_name:
- jradman-test
bios_uuid:
- 9b922642-7e01-6c78-e9b3-8618c18f023d
aws_ec2_instance_id: []
aws_ec2_instance_ami_id: []
aws_owner_id: []
aws_availability_zone:
- us-west-1a
aws_region:
- us-west-1
aws_vpc_id:
- vpc-1a2b3c4d
ssh_fingerprint: []
mcafee_epo_guid: []
mcafee_epo_agent_guid: []
qualys_asset_id: []
qualys_host_id: []
servicenow_sysid: []
installed_software:
- cpe:/a:openbsd:openssh:8.0
- cpe:/a:pivotal_software:redis:5.0.3
- cpe:/a:gnupg:libgcrypt:1.8.5
- cpe:/a:haxx:curl:7.61.1
- cpe:/a:haxx:libcurl:7.61.1
- cpe:/a:openssl:openssl:1.1.1k
- cpe:/a:tenable:nessus_agent:10.8.4
- cpe:/a:tukaani:xz:5.2.4
- cpe:/a:vmware:open_vm_tools:12.0.5
bigfix_asset_id: []
security_protection_level: null
security_protections: []
exposure_confidence_value: null
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to view information about an asset.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- assets_cloud: []
/api/v2/assets/bulk-jobs/acr:
post:
summary: Update ACR
description: 'Overwrites the Tenable-provided Asset Criticality Rating (ACR) for the specified assets. Tenable assigns an ACR to each asset on your network to represent the asset''s relative risk as an integer from 1 to 10. For more information about ACR, see [Lumin metrics](https://docs.tenable.com/vulnerability-management/Content/Lumin/LuminMetrics.htm) in the *Tenable Vulnerability Management User Guide*.
You must have a Lumin license to update the ACR for assets in your organization.<div class="perms-callout">Requires the Scan Operator [24] user role. See [Roles](doc:roles).</div>'
operationId: assets-bulk-update-acr
tags:
- Assets
requestBody:
required: true
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/assets_assetsBulkUpdateAcrObject'
responses:
'202':
description: Returned if Tenable Vulnerability Management successfully queued the update request.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to update the ACR for the specified asset.
'404':
description: Returned if Tenable Vulnerability Management could not find the specified asset.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- assets_cloud: []
/api/v2/assets/bulk-jobs/move-to-network:
post:
summary: Move assets
description: 'Moves assets from the specified network to another network. You can use this endpoint to move assets from the default network to a user-defined network, from a user-defined network to the default network, and from one user-defined network to another user-defined network. This request creates an asynchronous job in Tenable Vulnerability Management.
For information about the assets move workflow and payload examples, see [Bulk Asset Operations](doc:bulk-asset-operations).<div class="perms-callout">Requires the Scan Operator [24] user role. See [Roles](doc:roles).</div>'
operationId: assets-bulk-move
tags:
- Assets
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/assets_assetsBulkMoveRequest'
responses:
'202':
description: Returned if Tenable Vulnerability Management successfully moved the assets to the specified network.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_data'
examples:
response:
value:
response:
data:
asset_count: 512
'400':
description: Returned if Tenable Vulnerability Management could not find the specified assets.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to move assets.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- assets_cloud: []
/api/v2/assets/bulk-jobs/delete:
post:
summary: Bulk delete assets
description: 'Deletes the specified assets. This request creates an asynchronous delete job in Tenable Vulnerability Management.
For information about the assets bulk delete workflow and payload examples, see [Bulk Asset Operations](doc:bulk-asset-operations).<div class="perms-callout">Requires the Scan Operator [24] user role. See [Roles](doc:roles).</div>'
operationId: assets-bulk-delete
tags:
- Assets
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- query
properties:
hard_delete:
type: boolean
default: false
description: 'Indicates whether or not to hard delete the specified assets.
<span style="color:red">**Caution:** Deleting assets completely removes the assets from your licensed asset count along with all related data and the deleted assets are not available for restoration. This occurs whether `hard_delete` is set to `true` or `false`.</span>
When `hard_delete` is set to `true`, deleted assets are no longer visible in the user interface or available through the API. When `hard_delete` is set to `false`, deleted assets can only be retrieved via the API using a direct asset UUID, and are available for export via the API for 90 days. The primary goal of setting `hard_delete` to `false` is to reflect those deletions through integrations.
If this parameter is omitted, Tenable Vulnerability Management uses the default value of `false`.'
query:
description: The query filters for selecting assets to delete. The format for a single query filter is different from the format for multiple query filters so you must select one or the other.
$ref: '#/components/schemas/assets_query'
responses:
'202':
description: Returned if Tenable Vulnerability Management successfully deleted the requested assets.
content:
application/json:
schema:
type: object
properties:
response:
type: object
properties:
data:
$ref: '#/components/schemas/assets_data'
examples:
response:
value:
response:
data:
asset_count: 512
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted. For example, if you specify an invalid asset query using a malformed IPv4 address.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to bulk delete assets.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if Tenable Vulnerability Management is unavailable or not ready to process the request. Wait a moment and try your request again.
security:
- assets_cloud: []
/import/assets:
post:
summary: Import assets
description: 'Imports asset data in JSON format.
The request size cannot exceed 5 MB. For example, if the average asset record you want to import is about 2 KB, you can import approximately 2,500 assets in a single request.
**Note:** This endpoint does not support the network_id attribute in asset objects for import. Tenable Vulnerability Management automatically assigns imported assets to the default network object. For more information about network objects, see [Manage Networks](doc:manage-networks-tio).<div class="perms-callout">Requires the Scan Manager [40] user role and Can Edit [64] scan permissions. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>'
operationId: assets-import
tags:
- Assets
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
assets:
type: array
description: 'An array of asset objects to import. Each asset object requires a value for at least one of the following properties: fqdn, ipv4, netbios\_name, mac\_address.
For an example of this request body, see [Add Asset Data to Vulnerability Management](doc:add-asset-data-to-tenableio). For the complete list of importable asset attributes, see [Common Asset Attributes](doc:common-asset-attributes#section-asset-attribute-definitions).
**Caution:** AWS, Azure, and GCP asset data must be imported separately even if the data is associated with the same asset. For example, Azure imports should only contain Azure data in the payload. The import fails if AWS data is included with the Azure data in the payload.'
example: '[{"ipv4":"192.0.2.57","operating_system":"Windows 7 x64"}]'
items:
$ref: '#/components/schemas/assets_Request-Import-Asset'
source:
type: string
description: A user-defined name for the source of the import containing the asset records. You can specify only one source for each import.
example: Custom Import
required:
- assets
- source
responses:
'200':
description: Returned if the import job was queued successfully.
content:
application/json:
schema:
type: object
properties:
asset_import_job_uuid:
type: string
description: The unique identifier of the asset import job.
examples:
response:
value:
asset_import_job_uuid: 467e5338-7783-4a0d-915a-5d00584784a0
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to import assets.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/assets_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- assets_cloud: []
/import/asset-jobs:
get:
summary: List asset import job
# --- truncated at 32 KB (82 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-assets-api-openapi.yml