After you submit a scan to Tenable for ASV review, you can use the Tenable PCI ASV API to retrieve a list of your attestations and see your current attestation request status. For more information, see [Create an Attestation](https://docs.tenable.com/vulnerability-management/Content/pci-asv/CreateAttestation.htm) in the Tenable Vulnerability Management User Guide.
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Attestations API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Attestations
description: After you submit a scan to Tenable for ASV review, you can use the Tenable PCI ASV API to retrieve a list of your attestations and see your current attestation request status. For more information, see [Create an Attestation](https://docs.tenable.com/vulnerability-management/Content/pci-asv/CreateAttestation.htm) in the Tenable Vulnerability Management User Guide.
paths:
/pci-asv/attestations/list:
get:
tags:
- Attestations
summary: List attestations
description: 'Returns a list of PCI attestations in PCI ASV.
**Note:** You need to request access to this endpoint through Tenable support even if you have a valid PCI ASV license. <div class="perms-callout">Requires the Administrator [64] user role. See [Roles](doc:roles).</div>'
operationId: pci-attestations-list
parameters:
- description: 'Filters the list of PCI attestations by status.
To retrieve attestations that are currently in progress but have yet to be submitted for review, you can use the following status types:<ul><li>`IN_PROGRESS`—Attestations that are in progress.</li><li>`NEEDS_WORK`—Attestations that require additional work.</li></ul>
To retrieve attestations that are currently in review, you can use the following status types: <ul><li>`IN_REVIEW`—Attestations that are currently under review.</li><li>`INFO_REQUESTED`—Attestations that require additional information for one or more disputes.</li><li>`INFO_PROVIDED`—Attestations where you have provided additional information but the information is yet to be reviewed.</li></ul>
To retrieve attestations that have completed the review process, you can use the following status types: <ul><li>`FAILED`—Attestations that have failed review.</li><li>`PASSED`—Attestations that have passed review.</li><li>`CLOSED`—Attestations that are no longer active.</li></ul>'
name: status_type
in: query
schema:
type: array
items:
type: string
enum:
- IN_PROGRESS
- NEEDS_WORK
- IN_REVIEW
- INFO_REQUESTED
- INFO_PROVIDED
- FAILED
- PASSED
- CLOSED
- description: 'The field you want to use to sort the results by along with the sort order. The field is specified first, followed by a colon, and the order is specified second (`asc` or `desc`). For example, `name:desc` would sort results by the `name` field in descending order.
If you specify multiple fields, the fields must be separated by commas. For example, `name:desc,started_at:asc` would first sort results by the `name` field in descending order and then by the `started_at` field in ascending order.'
name: sort
in: query
schema:
type: string
- description: The number of records to retrieve.
name: limit
in: query
schema:
type: integer
format: int32
- description: The starting record to retrieve. If this parameter is omitted, Tenable PCI ASV uses the default value of `0`.
name: offset
in: query
schema:
type: integer
format: int32
responses:
'200':
description: Returned if the list of PCI attestations was retrieved successfully.
content:
application/json:
schema:
type: object
required:
- pagination
- items
properties:
pagination:
$ref: '#/components/schemas/Response-Pagination'
attestations:
type: array
description: An array of PCI ASV attestation objects.
items:
$ref: '#/components/schemas/Response-AttestationList'
examples:
response:
value:
pagination:
total: 2
offset: 0
limit: 200
sort:
- name: name
order: asc
attestations:
- owner: example@example.com
latest_comment: None
submitted_at: '2021-02-12T10:27:21.988Z'
dispute_count: 0
customer_uuid: 0010d632-4c24-4b71-9a4f-71416c375d47
scan_completion_date: '2021-01-28T12:42:21Z'
created_at: '2021-02-12T10:25:48.267Z'
failure_count: 15
created_by: example@example.com
uuid: a13b1497-5fec-41be-a9d6-ffef794c304c
asset_count: 1
passed_dispute_count: 0
undisputed_failure_count: 15
scan_expiration_date: '2021-04-28T12:42:21Z'
updated_at: '2021-09-08T05:07:18.827Z'
contact:
contact_name: person
email: person@example.com
title: SW
phone_number: '123456789'
company_name: Example, Inc.
company_url: example.com
city: San Jose
state: CA
zip_code: '95116'
country: ''
submitted_at: '2021-02-12T10:27:21.988Z'
submitted_by_username: pci.test.0@tenable.com
submitted_by_id: 9b0aae86-71f8-40f0-bfd7-c5b7f16602a8
address_1: 1234 Main St.
address_2: ''
updated_by: example@example.com
name: PCI Attestation
failed_dispute_count: 0
cde.uuid: 4e533e20-bb69-d12d-9336-3ce52b679552
company: company
undetermined_dispute_count: 0
excluded_asset_count: 0
status: needs-work
- owner: example@example.com
latest_comment: None
submitted_at: '2021-02-12T10:27:21.988Z'
dispute_count: 0
customer_uuid: 0010d632-4c24-4b71-9a4f-71416c375d47
scan_completion_date: '2021-01-28T12:42:21Z'
created_at: '2021-02-12T10:25:48.267Z'
failure_count: 15
created_by: example@example.com
uuid: a13b1497-5fec-41be-a9d6-ffef794c304c
asset_count: 1
passed_dispute_count: 0
undisputed_failure_count: 15
scan_expiration_date: '2021-04-28T12:42:21Z'
updated_at: '2021-09-08T05:07:18.827Z'
contact:
contact_name: person
email: person@example.com
title: SW
phone_number: '123456789'
company_name: Example, Inc.
company_url: example.com
city: San Jose
state: CA
zip_code: '95116'
country: ''
submitted_at: '2021-02-12T10:27:21.988Z'
submitted_by_username: pci.test.0@tenable.com
submitted_by_id: 9b0aae86-71f8-40f0-bfd7-c5b7f16602a8
address_1: 1234 Main St.
address_2: ''
updated_by: example@example.com
name: PCI Attestation
failed_dispute_count: 0
cde.uuid: 4e533e20-bb69-d12d-9336-3ce52b679552
company: company
undetermined_dispute_count: 0
excluded_asset_count: 0
status: needs-work
'400':
description: Returned if you do not have a license to use Tenable PCI ASV.
content:
application/json:
examples:
response:
value:
errors:
- rule: user.does_not_have_access_for_api
message: Please contact Tenable support to enable API access for this endpoint in your container.
error: Please contact Tenable support to enable API access for this endpoint in your container.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have the required permissions to view the list of attestations. For example, if you're an analyst user instead of an administrator.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/pci-asv/attestations/details/{attestation_uuid}:
get:
tags:
- Attestations
summary: Get attestation details
description: 'Returns the details for the specified PCI attestation.
**Note:** You need to request access to this endpoint through Tenable support even if you have a valid PCI ASV license. <div class="perms-callout">Requires the Administrator [64] user role. See [Roles](doc:roles).</div>'
operationId: pci-attestations-details
parameters:
- description: The UUID of the PCI attestation you want to retrieve details for.
name: attestation_uuid
required: true
in: path
schema:
type: string
format: uuid
responses:
'200':
description: Returned if the details for the specified PCI attestation were retrieved successfully.
content:
application/json:
schema:
type: object
required:
- items
properties:
items:
$ref: '#/components/schemas/Response-AttestationList'
examples:
response:
value:
owner: example@example.com
latest_comment: None
submitted_at: '2021-02-12T10:27:21.988Z'
dispute_count: 0
customer_uuid: 0010d632-4c24-4b71-9a4f-71416c375d47
scan_completion_date: '2021-01-28T12:42:21Z'
created_at: '2021-02-12T10:25:48.267Z'
failure_count: 15
created_by: example@example.com
uuid: a13b1497-5fec-41be-a9d6-ffef794c304c
asset_count: 1
passed_dispute_count: 0
undisputed_failure_count: 15
scan_expiration_date: '2021-04-28T12:42:21Z'
updated_at: '2021-09-08T05:07:18.827Z'
contact:
contact_name: person
email: person@example.com
title: SW
phone_number: '123456789'
company_name: Example, Inc.
company_url: example.com
city: San Jose
state: CA
zip_code: '95116'
country: ''
submitted_at: '2021-02-12T10:27:21.988Z'
submitted_by_username: pci.test.0@tenable.com
submitted_by_id: 9b0aae86-71f8-40f0-bfd7-c5b7f16602a8
address_1: 1234 Main St.
address_2: ''
updated_by: example@example.com
name: PCI Attestation
failed_dispute_count: 0
cde.uuid: 4e533e20-bb69-d12d-9336-3ce52b679552
company: company
undetermined_dispute_count: 0
excluded_asset_count: 0
status: needs-work
'400':
description: Returned if you do not have a license to use Tenable PCI ASV.
content:
application/json:
examples:
response:
value:
errors:
- rule: user.does_not_have_access_for_api
message: Please contact Tenable support to enable API access for this endpoint in your container.
error: Please contact Tenable support to enable API access for this endpoint in your container.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have the required permissions to view the details of attestations. For example, if you're an analyst user instead of an administrator.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/pci-asv/attestations/details/{attestation_uuid}/disputes:
get:
tags:
- Attestations
summary: List attestation disputes
description: 'Returns a list of disputes for the specified PCI attestation.
**Note:** You need to request access to this endpoint through Tenable support even if you have a valid PCI ASV license. <div class="perms-callout">Requires the Administrator [64] user role. See [Roles](doc:roles).</div>'
operationId: pci-attestations-disputes-list
parameters:
- description: The UUID of the PCI attestation you want to retrieve disputes for.
name: attestation_uuid
required: true
in: path
schema:
type: string
format: uuid
- description: 'The field you want to use to sort the results by along with the sort order. The field is specified first, followed by a colon, and the order is specified second (`asc` or `desc`). For example, `created_at:desc` would sort results by the `created_at` field in descending order.
If you specify multiple fields, the fields must be separated by commas. For example, `created_at:desc,severity:asc` would first sort results by the `created_at` field in descending order and then by the `severity` field in ascending order.'
name: sort
in: query
schema:
type: string
- description: The number of records to retrieve.
name: limit
in: query
schema:
type: integer
format: int32
- description: The starting record to retrieve. If this parameter is omitted, Tenable PCI ASV uses the default value of `0`.
name: offset
in: query
schema:
type: integer
format: int32
responses:
'200':
description: Returned if the disputes for the specified PCI attestation were retrieved successfully.
content:
application/json:
schema:
type: object
required:
- items
- pagination
properties:
pagination:
$ref: '#/components/schemas/Response-Pagination'
disputes:
type: array
description: An array of PCI ASV dispute objects.
items:
$ref: '#/components/schemas/Response-DisputeList'
examples:
response:
value:
pagination:
total: 17
offset: 0
limit: 2
sort:
- name: created_at
order: desc
disputes:
- severity: 2
owner: pci-testing@example.com
reason: false-positive
plugin_id: 106230
latest_comment: None
customer_uuid: 196d99ba-7f93-4945-be6c-1a6089b36a7c
created_at: '2021-09-15T12:20:45.19Z'
failure_count: 1
explanation: FP3
plugin_name: Apache Default Index Page
created_by: pci-testing@example.com
determination_comment: Pass
uuid: a0aaf660-9308-422c-8545-daa764886cf9
cloned: true
updated_at: '2021-09-16T04:52:30.837Z'
attestation_uuid: 47d04762-387d-44c0-aadc-b845d7227089
updated_by: pci@example.com
name: target3.pubtarg.tenablesecurity.com 106230
scan_date: '2021-09-15T05:04:21Z'
status: passed
- severity: 2
owner: pci-testing@example.com
reason: false-positive
plugin_id: 17705
latest_comment: None
customer_uuid: 196d99ba-7f93-4945-be6c-1a6089b36a7c
created_at: '2021-09-15T12:20:45.177Z'
failure_count: 1
explanation: FP4
plugin_name: OPIE w/ OpenSSH Account Enumeration
created_by: pci-testing@example.com
uuid: dce82e5a-58ef-481e-a6ab-94ca0c0d1973
cloned: true
updated_at: '2021-09-15T12:20:45.177Z'
attestation_uuid: 47d04762-387d-44c0-aadc-b845d7227089
updated_by: pci-testing@example.com
name: target3.pubtarg.tenablesecurity.com 17705
scan_date: '2021-09-15T05:04:21Z'
status: in-review
'400':
description: Returned if you do not have a license to use Tenable PCI ASV.
content:
application/json:
examples:
response:
value:
errors:
- rule: user.does_not_have_access_for_api
message: Please contact Tenable support to enable API access for this endpoint in your container.
error: Please contact Tenable support to enable API access for this endpoint in your container.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have the required permissions to view the list of disputes for the specified attestation.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/pci-asv/attestations/{attestation_uuid}/failures/undisputed/list:
get:
tags:
- Attestations
summary: List undisputed failures
description: 'Returns a list of undisputed failures of the specified PCI attestation.
**Note:** You need to request access to this endpoint through Tenable support even if you have a valid PCI ASV license. <div class="perms-callout">Requires the Administrator [64] user role. See [Roles](doc:roles).</div>'
operationId: pci-attestations-failures-list
parameters:
- description: The UUID of the PCI attestation you want to retrieve undisputed failures for.
name: attestation_uuid
required: true
in: path
schema:
type: string
format: uuid
- description: 'The field you want to use to sort the results by along with the sort order. The field is specified first, followed by a colon, and the order is specified second (`asc` or `desc`). For example, `asset_name:desc` would sort results by the `asset_name` field in descending order.
If you specify multiple fields, the fields must be separated by commas. For example, `asset_name:desc,severity:asc` would first sort results by the `asset_name` field in descending order and then by the `severity` field in ascending order.'
name: sort
in: query
schema:
type: string
- description: The number of records to retrieve.
name: limit
in: query
schema:
type: integer
format: int32
- description: The starting record to retrieve. If this parameter is omitted, Tenable PCI ASV uses the default value of `0`.
name: offset
in: query
schema:
type: integer
format: int32
responses:
'200':
description: Returned if the list of undisputed failures for the PCI attestation was retrieved successfully.
content:
application/json:
schema:
type: object
required:
- pagination
- items
properties:
pagination:
$ref: '#/components/schemas/Response-Pagination'
failures:
type: array
description: An array of PCI ASV attestation failures objects.
items:
$ref: '#/components/schemas/Response-UndisputedFailuresList'
examples:
response:
value:
pagination:
total: 1
offset: 0
limit: 200
sort:
- name: plugin_id
order: desc
failures:
- severity: 3
plugin_id: 173384
cvss_score: 9.8
address: 127.0.0.1
scan_uuid: 2693c579-0ab0-40c9-8eef-d8f1e18167ef
duplicate: false
rerank_type: not-reranked
plugin_name: OpenSSH < 9.3 Multiple Vulnerabilities
uuid: a3382dad-b0a8-4919-846d-1ec504d1e05f
protocol: tcp
asset_name: Asset Name
port: 22
attestation_uuid: dd39c320-ee0f-4a8d-9a7b-4cd334425fd7
scan_name: Scan Name
scan_date: '2023-06-08T17:05:04Z'
'400':
description: Returned if you do not have a license to use Tenable PCI ASV.
content:
application/json:
examples:
response:
value:
errors:
- rule: user.does_not_have_access_for_api
message: Please contact Tenable support to enable API access for this endpoint in your container.
error: Please contact Tenable support to enable API access for this endpoint in your container.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have the required permissions to view the list of assets for the attestation. For example, if you're an analyst user instead of an administrator.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/pci-asv/attestations/{attestation_uuid}/assets/list:
get:
tags:
- Attestations
summary: List attestation assets
description: 'Returns a list of PCI assets attested in the specified attestation in PCI ASV.
**Note:** You need to request access to this endpoint through Tenable support even if you have a valid PCI ASV license. <div class="perms-callout">Requires the Administrator [64] user role. See [Roles](doc:roles).</div>'
operationId: pci-attestations-assets-list
parameters:
- description: The UUID of the PCI attestation you want to retrieve assets for.
name: attestation_uuid
required: true
in: path
schema:
type: string
format: uuid
- description: 'The field you want to use to sort the results by along with the sort order. The field is specified first, followed by a colon, and the order is specified second (`asc` or `desc`). For example, `fqdn:desc` would sort results by the `fqdn` field in descending order.
If you specify multiple fields, the fields must be separated by commas. For example, `fqdn:desc,scan_name:asc` would first sort results by the `fqdn` field in descending order and then by the `scan_name` field in ascending order.'
name: sort
in: query
schema:
type: string
- description: The number of records to retrieve.
name: limit
in: query
schema:
type: integer
format: int32
- description: The starting record to retrieve. If this parameter is omitted, Tenable PCI ASV uses the default value of `0`.
name: offset
in: query
schema:
type: integer
format: int32
responses:
'200':
description: Returned if the list of assets for the PCI attestation was retrieved successfully.
content:
application/json:
schema:
type: object
required:
- pagination
- items
properties:
pagination:
$ref: '#/components/schemas/Response-Pagination'
assets:
type: array
description: An array of PCI ASV attestation assets objects.
items:
$ref: '#/components/schemas/Response-AttestationAssetList'
examples:
response:
value:
pagination:
total: 1
offset: 0
limit: 200
sort:
- name: name
order: asc
assets:
- excluded: false
undisputed_failure_count: 14
address: 127.0.0.1
fqdn: target.example.com
# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-attestations-api-openapi.yml