openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Attack Path Exports API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Attack Path Exports
description: The Tenable Attack Path Exports API enables users to export top attack paths, attack technique data, and MITRE ATT&CK heatmap data in JSON or CSV format. MITRE heatmap exports in JSON conform to the MITRE ATT&CK Navigator layer schema, allowing direct import into Navigator. For more information about attack paths and attack techniques, see [Attack Path](https://docs.tenable.com/exposure-management/Content/exposure-management/attack-path/attack-path.htm) in the _Tenable Exposure Management User Guide_.
x-displayName: Attack Path Exports
paths:
/api/v1/export/attack-path:
post:
summary: Export top attack paths
description: Submits an export request for top attack paths that match the specified search criteria. Returns an export ID used to check the status of the export and download the results. <div class="perms-callout">Requires the Basic [16] user role or the `ATTACK_PATH_ANALYSIS.EXPORT.MANAGE_OWN` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: apa-export-attack-path
tags:
- Attack Path Exports
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_Request-Export-Attack-Paths'
examples:
basic_export:
summary: Export vectors as CSV
value:
file_format: CSV
sort:
property: priority
direction: desc
filtered_export:
summary: Export specific vectors with filter
value:
file_format: JSON
filters:
operator: and
value:
- property: priority
operator: eq
value: critical
vector_ids:
- CC5A96068E61D0B1E5DB5D1FD9394813
columns:
- path_name
- priority
- sequence_chain
responses:
'202':
description: Returned if the attack path export request was successfully queued.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ExportRequestId'
examples:
response:
value:
export_id: 7f58afba-3d63-4c6d-9693-9554497ea0f9
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponseStatus'
examples:
response:
value:
message: Invalid file_format. Must be CSV or JSON.
status: 400
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to export attack paths.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if the attack path export feature is not enabled for your account.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Attack path export is not enabled for this account.
security:
- Attack_Path_Exports_cloud: []
/api/v1/export/attack-technique:
post:
summary: Export attack techniques
description: Submits an export request for attack technique data that matches the specified search criteria. Returns an export ID used to check the status of the export and download the results. <div class="perms-callout">Requires the Basic [16] user role or the `ATTACK_PATH_ANALYSIS.EXPORT.MANAGE_OWN` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: apa-export-attack-technique
tags:
- Attack Path Exports
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_Request-Export-Attack-Techniques'
examples:
basic_export:
summary: Export attack techniques as CSV
value:
file_format: CSV
sort:
property: priority
direction: desc
filtered_export:
summary: Export specific attack techniques with filter
value:
file_format: JSON
filters:
operator: ==
key: priority
value: high
attack_technique_ids:
- technique-id-1
- technique-id-2
responses:
'202':
description: Returned if the attack technique export request was successfully queued.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ExportRequestId'
examples:
response:
value:
export_id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponseStatus'
examples:
response:
value:
message: Invalid file_format. Must be CSV or JSON.
status: 400
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to export attack techniques.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if the attack path export feature is not enabled for your account.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Attack path export is not enabled for this account.
security:
- Attack_Path_Exports_cloud: []
/api/v1/export/mitre-heatmap:
post:
summary: Export MITRE ATT&CK heatmap
description: Submits an export request for MITRE ATT&CK heatmap data that matches the specified filter criteria. JSON exports conform to the [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) layer schema, enabling direct import into Navigator. CSV exports return a flat table of technique data. Returns an export ID used to check the status of the export and download the results. <div class="perms-callout">Requires the Basic [16] user role or the `ATTACK_PATH_ANALYSIS.EXPORT.MANAGE_OWN` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: apa-export-mitre-heatmap
tags:
- Attack Path Exports
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_Request-Export-Mitre-Heatmap'
examples:
basic_export:
summary: Export the MITRE heatmap as a Navigator layer (JSON)
value:
file_format: JSON
filter:
matrix: enterprise
filtered_export:
summary: Export only Windows techniques with high or critical severity
value:
file_format: JSON
filter:
matrix: enterprise
platform: Windows
severities:
- high
- critical
show_all_techniques: false
file_name: windows_critical_heatmap
csv_export:
summary: Export the MITRE heatmap as CSV
value:
file_format: CSV
filter:
matrix: enterprise
responses:
'202':
description: Returned if the MITRE heatmap export request was successfully queued.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ExportRequestId'
examples:
response:
value:
export_id: b9c1f2e8-4a7d-4f5b-9e2c-1d3a5b7c9e1f
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponseStatus'
examples:
response:
value:
message: Invalid file_format. Must be CSV or JSON.
status: 400
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to export MITRE heatmap data.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if the MITRE heatmap export feature is not enabled for your account.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: MITRE heatmap export is not enabled for this account.
security:
- Attack_Path_Exports_cloud: []
/api/v1/export/{export_id}/status:
get:
summary: Get export status
description: Retrieves the current status of an attack path, attack technique, or MITRE heatmap export request. <div class="perms-callout">Requires the Basic [16] user role or the `ATTACK_PATH_ANALYSIS.EXPORT.MANAGE_OWN` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: apa-export-status
tags:
- Attack Path Exports
parameters:
- description: Specifies the unique identifier (UUID) of the export request.
explode: false
in: path
name: export_id
required: true
schema:
type: string
style: simple
responses:
'200':
description: Returned if the status of the specified export request was retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_Response-Export-Status'
examples:
queued:
summary: Export is queued
value:
export_id: 7f58afba-3d63-4c6d-9693-9554497ea0f9
status: QUEUED
submitted_at: '2025-07-23T22:15:25.849Z'
last_refreshed_at: '2025-07-23T22:15:25.849Z'
finished:
summary: Export is finished
value:
export_id: 7f58afba-3d63-4c6d-9693-9554497ea0f9
status: FINISHED
submitted_at: '2025-07-23T22:15:25.849Z'
last_refreshed_at: '2025-07-23T22:15:27.305Z'
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to view the export status.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
'404':
description: Returned if specified export request was not found.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponseStatus'
examples:
response:
value:
message: The request with id 1697e68f-7e14-41ad-9146-f2e08bd59296 was not found
status: 404
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if the attack path export feature is not enabled for your account.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Attack path export is not enabled for this account.
security:
- Attack_Path_Exports_cloud: []
/api/v1/export/{export_id}/download:
get:
summary: Download export
description: Downloads the results of a completed attack path, attack technique, or MITRE heatmap export request. The response format depends on the `file_format` specified in the original export request. MITRE heatmap exports in JSON format conform to the [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/) layer schema. <div class="perms-callout">Requires the Basic [16] user role or the `ATTACK_PATH_ANALYSIS.EXPORT.MANAGE_OWN` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: apa-export-download
tags:
- Attack Path Exports
parameters:
- description: Specifies the unique identifier (UUID) of the export request.
explode: false
in: path
name: export_id
required: true
schema:
type: string
style: simple
responses:
'200':
description: Returned if the specified export file was retrieved successfully.
content:
application/octet-stream:
schema:
oneOf:
- title: Attack Path Export (JSON)
description: The response model for attack path exports in JSON format.
type: array
items:
$ref: '#/components/schemas/Attack_Path_Exports_AttackPathExportRecord'
- title: Attack Path Export (CSV)
description: For the CSV response model of attack path exports, see the example CSV response.
type: string
- title: Attack Technique Export (JSON)
description: The response model for attack technique exports in JSON format.
type: array
items:
$ref: '#/components/schemas/Attack_Path_Exports_AttackTechniqueExportRecord'
- title: Attack Technique Export (CSV)
description: For the CSV response model of attack technique exports, see the example CSV response.
type: string
- title: MITRE Heatmap Export (JSON)
description: The response model for MITRE heatmap exports in JSON format. The document conforms to the MITRE ATT&CK Navigator layer schema, allowing direct import into Navigator.
$ref: '#/components/schemas/Attack_Path_Exports_MitreHeatmapNavigatorLayer'
- title: MITRE Heatmap Export (CSV)
description: For the CSV response model of MITRE heatmap exports, see the example CSV response.
type: string
examples:
Attack Path Export (JSON):
value:
- path_name: Domain Admin Compromise via Kerberoasting
priority_rating: Critical
source_nes: 8.5
target_acr: 9.2
sequence_chain: Workstation-01 → Kerberoasting (T1558.003) → DC-01
enablers: Weak service account password; SPN configured on privileged account
asset_ids: a1b2c3d4-0001-0001-0001-000000000001;a1b2c3d4-0001-0001-0001-000000000002
- path_name: Lateral Movement to File Server
priority_rating: High
source_nes: 7.1
target_acr: 8
sequence_chain: Laptop-05 → Pass-the-Hash (T1550.002) → FileServer-02
enablers: Cached credentials; Local admin reuse
asset_ids: a1b2c3d4-0002-0002-0002-000000000001;a1b2c3d4-0002-0002-0002-000000000002
Attack Path Export (CSV):
value: 'path_name,priority_rating,source_nes,target_acr,sequence_chain,enablers,asset_ids
Domain Admin Compromise via Kerberoasting,Critical,8.5,9.2,Workstation-01 → Kerberoasting (T1558.003) → DC-01,Weak service account password; SPN configured on privileged account,a1b2c3d4-0001-0001-0001-000000000001;a1b2c3d4-0001-0001-0001-000000000002
Lateral Movement to File Server,High,7.1,8.0,Laptop-05 → Pass-the-Hash (T1550.002) → FileServer-02,Cached credentials; Local admin reuse,a1b2c3d4-0002-0002-0002-000000000001;a1b2c3d4-0002-0002-0002-000000000002'
Attack Technique Export (JSON):
value:
- mitre_id: T1558.003
technique_name: Kerberoasting
priority: Critical
status: To Do
state: Open
through: Weak service account password
source_names: Workstation-01;Laptop-05
source_classes: Windows;Windows
source_ids: a1b2c3d4-0001-0001-0001-000000000001;a1b2c3d4-0002-0002-0002-000000000001
target_names: DC-01;DC-02
target_classes: Windows;Windows
target_ids: a1b2c3d4-0001-0001-0001-000000000002;a1b2c3d4-0003-0003-0003-000000000001
tactics: Credential Access
data_sources: Active Directory
top_attack_path_count: 5
critical_assets_count: 3
Attack Technique Export (CSV):
value: 'mitre_id,technique_name,priority,status,state,through,source_names,source_classes,source_ids,target_names,target_classes,target_ids,tactics,data_sources,top_attack_path_count,critical_assets_count
T1558.003,Kerberoasting,Critical,To Do,Open,Weak service account password,Workstation-01;Laptop-05,Windows;Windows,a1b2c3d4-0001-0001-0001-000000000001;a1b2c3d4-0002-0002-0002-000000000001,DC-01;DC-02,Windows;Windows,a1b2c3d4-0001-0001-0001-000000000002;a1b2c3d4-0003-0003-0003-000000000001,Credential Access,Active Directory,5,3'
MITRE Heatmap Export (JSON):
value:
name: Tenable APA MITRE Heatmap
versions:
attack: '14'
navigator: 4.9.5
layer: '4.5'
domain: enterprise-attack
description: Heatmap of MITRE ATT&CK techniques observed in your environment, scored by Tenable Attack Path Analysis.
techniques:
- techniqueID: T1558.003
tactic: credential-access
score: 92
color: '#a50026'
comment: '12 active findings; highest severity: Critical'
enabled: true
- techniqueID: T1550.002
tactic: lateral-movement
score: 71
color: '#f46d43'
comment: '5 active findings; highest severity: High'
enabled: true
gradient:
colors:
- '#a6d96a'
- '#fee08b'
- '#a50026'
minValue: 0
maxValue: 100
MITRE Heatmap Export (CSV):
value: 'techniqueID,tactic,score,color,comment,enabled
T1558.003,credential-access,92,#a50026,12 active findings; highest severity: Critical,true
T1550.002,lateral-movement,71,#f46d43,5 active findings; highest severity: High,true'
'204':
description: Returned if the specified export is not yet ready for download.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to download exports.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
'404':
description: Returned if the specified export request was not found.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponseStatus'
examples:
response:
value:
message: The request with id 7d8a71b1-3cab-4768-8905-0040917ad451 was not found
status: 404
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if the attack path export feature is not enabled for your account.
content:
application/json:
schema:
$ref: '#/components/schemas/Attack_Path_Exports_ErrorResponse'
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Attack path export is not enabled for this account.
security:
- Attack_Path_Exports_cloud: []
components:
schemas:
Attack_Path_Exports_FileFormat:
description: Specifies the file format for the exported data.
enum:
- CSV
- JSON
type: string
Attack_Path_Exports_ErrorResponseStatus:
type: object
properties:
message:
type: string
description: An error message indicating the invalid parameter or value.
status:
type: integer
description: The HTTP response status code.
Attack_Path_Exports_Attack-Technique-Multiple-Filters-Nested:
description: Defines a nested logical operator used within a compound filter. This enables deep filtering logic while preventing circular references.
type: object
properties:
operator:
type: string
description: Specifies the logical operator used to combine the nested conditions.
enum:
- and
- or
value:
type: array
description: Contains an array of single filter conditions.
items:
$ref: '#/components/schemas/Attack_Path_Exports_Attack-Technique-Single-Filter'
required:
- value
Attack_Path_Exports_AttackPathExportRecord:
type: object
description: A single attack path record in the export results.
properties:
path_name:
type: string
description: The name assigned to the attack path. For many paths, the system uses generative AI to create a descriptive name based on the potential threat.
prio
# --- truncated at 32 KB (58 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-attack-path-exports-api-openapi.yml