With the Attachments API, you can download auxiliary files generated by plugins during a scan. These attachments provide forensic evidence and deeper context for identified vulnerabilities. For more information, see the [Tenable Web App Scanning User Guide](https://docs.tenable.com/web-app-scanning/).
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Attachments API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Attachments
description: 'With the Attachments API, you can download auxiliary files generated by plugins during a scan. These attachments provide forensic evidence and deeper context for identified vulnerabilities.
For more information, see the [Tenable Web App Scanning User Guide](https://docs.tenable.com/web-app-scanning/).'
paths:
/was/v2/attachments/{attachment_id}:
get:
summary: Download attachment
description: "Returns the specified attachment file for a vulnerability detected by a Tenable Web App Scanning scan. Attachments provide additional details for a detected vulnerability.\n\n **Note:** The `transfer-encoding` header value of the response stream is set to `chunked`. <div class=\"perms-callout\">Requires the Basic [16] user role or the `WAS.TOGGLE_WAS.USE` custom role privilege. Additionally, requires the Can View [16] scan permission. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>"
operationId: was-v2-attachments-download
tags:
- Attachments
parameters:
- in: path
name: attachment_id
required: true
schema:
type: string
format: uuid
description: The UUID of the attachment to download. To determine the UUID of an attachment, use either the [GET /was/v2/vulnerabilities](ref:was-v2-vulns-list) or [GET /was/v2/scans/{scan_id}/vulnerabilities](ref:was-v2-scans-details-vulns) endpoint.
responses:
'200':
description: Returns the specified attachment file as a chunked transfer-encoded stream.
content:
text/plain:
schema:
type: string
examples:
response:
value: 'PUT /tenable-wasscan-9a3511f8-7852-4096-a7c0-6065ff8ebad3 HTTP/1.1
Host: testfire.net
Accept-Encoding: gzip, deflate
User-Agent: Nessus WAS/%v
X-Tenable-Wasscan-Id: 9a3511f8-7852-4096-a7c0-6065ff8ebad3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Cookie: JSESSIONID=76893A2AF20FA28774258A1FF4877A86
Content-Length: 68
Created by Tenable WAS scan. PUT9a3511f8-7852-4096-a7c0-6065ff8ebad3'
image/png:
schema:
type: string
format: binary
'400':
description: Returned if your request specifies an invalid attachment ID.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
reasons:
- code: INVALID_ID_FORMAT
reason: The provided ID of '1234567' must be UUID type
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'404':
description: Returned if Tenable Web App Scanning cannot find the specified attachment file.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
reasons:
- code: NOT_FOUND
reason: Resource with ID 'b29f198c-eac6-4107-b046-c621f542cd39' not found
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
components:
schemas:
ErrorResponse:
type: object
required:
- reasons
description: Tenable Web App Scanning error response.
properties:
reasons:
type: array
description: A list of reasons for the Tenable Web App Scanning error.
items:
type: object
description: A reason for the Tenable Web App Scanning error, including a code and an extended description.
minItems: 1
required:
- code
- reason
properties:
code:
type: string
description: "The Tenable Web App Scanning error code. Error code values include:\n - `NOT_FOUND`—Returned if Tenable Web App Scanning could not find the resource you specified.\n - `INVALID_ID_FORMAT`—Returned if you specify a resource ID in an invalid format.\n - `INVALID_PARAMETER`—Returned if you specify an invalid URL parameter.\n- `INVALID_JSON_BODY`—Returned if you specify invalid JSON in request payload.\n - `DUPLICATE_ENTITY`—Returned if you attempt to create a duplicate resource.\n - `NOT_ALLOWED`—Returned if Tenable Web App Scanning encounters a stateful conflict, for example, if you attempt to start a scan that is already in progress.\n - `OPERATION_FORBIDDEN`—Returned if you do not have sufficient permissions to access a resource or complete a task."
reason:
type: string
description: The extended description of the cause of the Tenable Web App Scanning error.
securitySchemes:
Bearer:
type: apiKey
in: header
name: Authorization
description: 'Example: Bearer {{token}}'
x-readme:
proxy-enabled: false
explorer-enabled: true
samples-enabled: true
samples-languages:
- python
- curl
- node
- powershell
- ruby
- javascript
- objectivec
- java
- php
- csharp
- go
- swift
- kotlin