With the Configurations API, you can create and maintain reusable scan settings. These endpoints allow you to perform standard CRUD operations on configuration objects to standardize scanning across your environment. For more information, see [Scan Templates](https://docs.tenable.com/web-app-scanning/Content/WAS/Scans/WASScanSettings.htm) in the _Tenable Web App Scanning User Guide_.
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Configurations API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Configurations
description: 'With the Configurations API, you can create and maintain reusable scan settings. These endpoints allow you to perform standard CRUD operations on configuration objects to standardize scanning across your environment.
For more information, see [Scan Templates](https://docs.tenable.com/web-app-scanning/Content/WAS/Scans/WASScanSettings.htm) in the _Tenable Web App Scanning User Guide_.'
paths:
/was/v2/configs:
post:
summary: Create scan configuration
description: "Creates a new scan configuration.\n\n This operation is asynchronous and returns with an immediate 202. The scan configuration is guaranteed to be created at some point in the immediate future depending on resource load. To track the status of the operation, use the [GET /was/v2/configs/{config_id}/status/{tracking_id}](ref:was-v2-config-status) endpoint. The `config_id` and `tracking_id` can be retrieved from the URI provided in the `Location` header of the `202 Accepted` response. <div class=\"perms-callout\">Requires the Scan Manager [40] user role or the `WAS.TOGGLE_WAS.USE` custom role privilege. Additionally, requires the Can Edit [64] scan permission. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>"
operationId: was-v2-config-create
tags:
- Configurations
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/Request-Config'
responses:
'202':
description: Returned if Tenable Web App Scanning accepted the request for processing.
headers:
Location:
description: Use the contents of this header appended to the prefix `/was/v2` to execute lookups on the current status of the resource.
schema:
type: string
format: uri
example: /configs/{config_id}/status/{tracking_id}
content:
application/json:
schema:
$ref: '#/components/schemas/Response-Scan-Config'
examples:
response:
value:
config_id: 77d748e5-c007-4f79-9a03-d1c35b7d95f4
container_id: 9f084368-f11e-4d69-be63-df5e2a0b2635
owner_id: ef22f2bf-db1b-4471-984f-9507dcc083e1
template_id: f93dfcb4-6eb2-4820-9b64-3dee8893a3f0
user_template_id: null
name: Scan Configuration Example
targets:
- https://example.com
applications: []
tag_targets:
- 2f06e776-ecc3-4fbe-a005-6e84b4ed61a3
description: null
created_at: '2020-09-01T23:36:04.289Z'
updated_at: '2020-09-01T23:36:04.289Z'
settings:
timeout: 08:00:00
debug_mode: false
credentials: null
scope:
option: all
urls: null
exclude_file_extensions:
- js
- css
- png
- jpeg
- gif
- pdf
- csv
- svn-base
- svg
- jpg
- ico
exclude_path_patterns:
- logout
dom_depth_limit: 5
directory_depth_limit: 10
page_limit: 10000
crawl_script: null
decompose_paths: false
exclude_binaries: true
auto_redundant_paths: 5
openapi_file: null
openapi_filename: null
openapi_file_url: null
crawl_script_filename: null
deduplicate_pages: null
graphql_file: null
graphql_filename: null
graphql_file_url: null
graphql_introspection: null
soap_file: null
soap_filename: null
soap_file_url: null
plugin:
rate_limiter:
requests_per_second: 25
autothrottle: true
timeout_threshold: 100
mode: disable
ids: []
names: []
families: []
browser:
screen_width: 1600
screen_height: 1200
ignore_images: true
job_timeout: 30
analysis: null
pool_size: 3
http:
response_max_size: 500000
request_redirect_limit: 2
user_agent: WAS/%v
custom_user_agent: false
request_headers:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
include_scan_id: false
request_concurrency: 10
request_timeout: 5
chrome:
script_finish_wait: 5000
script_page_load_wait: 30000
script_command_wait: 500
disable_web_security: false
assessment:
rfi_remote_url: http://rfi.nessus.org/rfi.txt
dictionary: limited
fingerprinting: null
enable: true
audit:
forms: true
cookies: true
ui_forms: true
ui_inputs: true
headers: true
links: true
parameter_names: false
parameter_values: true
jsons: true
xmls: true
scanner_id: null
pause_window: null
schedule: null
default_permissions: no_access
results_visibility: dashboard
permissions: []
notifications:
emails: []
'400':
description: Returned if your request specifies invalid scan configuration parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/InputErrorResponse'
examples:
response:
value:
code: INPUT_FORM_VIOLATION
fields:
- field: .name
message_type: VALUE_MUST_BE_SPECIFIED
value:
message: the value must be specified
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permissions to create a scan configuration or if you attempt to assign an invalid owner to a scan configuration. For more information, see [Roles](doc:roles) and [Permissions](doc:permissions).
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/api/v3/export/configs/remediation/{vuln_id}:
get:
summary: Get remediation scan configuration
description: 'Returns a scan configuration for the vulnerability that you want to remediate.
**Note:** This endpoint does not create the remediation scan configuration. Use the response from this endpoint as the request body for the [Create scan config](ref:was-v2-config-create) endpoint to create the remediation scan. <div class="perms-callout">Requires the Scan Manager [40] user role or the `WAS.TOGGLE_WAS.USE` custom role privilege. Additionally, requires the Can Edit [64] scan permission. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>'
operationId: was-v3-config-remediation
tags:
- Configurations
parameters:
- in: path
name: vuln_id
required: true
schema:
type: string
format: uuid
description: The UUID of the vulnerability you want to remediate. You can use the [Search vulnerabilities](ref:was-v2-vulns-search) endpoint or the [Search vulnerabilities for scan](ref:was-v2-scans-details-vulns-search) endpoint to determine the UUID of the vulnerability you want to remediate.
responses:
'200':
description: Returned if the remediation scan configuration was generated successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Response-Scan-Config'
examples:
response:
value:
name: Remediation scan of plugin 115540
targets:
- http://203.0.113.224:3334/remediation
owner_id: a8ba6418-0b8e-44b9-add6-17bf941719a6
template_id: 3223f18e-5a94-4e02-b560-77a4a8246cd3
scanner_id: '36960339'
permissions: []
settings:
assessment:
rfi_remote_url: http://rfi.nessus.org/rfi.txt
dictionary: limited
enable: true
audit:
forms: false
cookies: true
ui_forms: false
ui_inputs: false
headers: false
links: false
parameter_names: false
parameter_values: true
jsons: false
xmls: false
path_parameters: false
include_vector_patterns: []
browser:
screen_height: 1200
screen_width: 1600
ignore_images: true
job_timeout: 60
pool_size: 3
chrome:
script_finish_wait: 5000
script_page_load_wait: 30000
script_command_wait: 500
disable_web_security: false
debug_mode: false
http:
response_max_size: 5000000
request_redirect_limit: 3
custom_user_agent: false
request_headers:
Accept: '*/*'
Accept-Language: en-US,en;q=0.5
include_scan_id: false
request_concurrency: 10
request_timeout: 30
plugin:
rate_limiter:
requests_per_second: 25
autothrottle: true
timeout_threshold: 100
mode: disable
ids:
- 114211
- 98148
- 98204
- 113837
- 98203
- 113894
- 113895
- 112439
- 112921
- 98214
- 98226
- 114006
- 112772
- 113893
- 114244
- 113342
- 113230
- 114232
- 98210
- 98765
- 112719
- 98223
- 113452
- 98207
- 98211
- 112809
- 113580
- 114132
- 113899
- 114147
- 114064
- 114202
- 114199
- 114201
- 114200
- 112545
- 113975
- 98703
- 114148
- 98647
- 112421
- 98987
- 112613
- 98644
- 113247
- 114029
- 98224
- 112771
- 98047
- 113370
- 114106
- 113972
- 98525
- 114219
- 114065
- 112361
- 114166
- 98988
- 98701
- 113871
- 98986
- 113901
- 98538
- 112895
- 112697
- 114223
- 112893
- 98780
- 98206
- 113043
- 113579
- 112894
- 98200
- 113338
- 113170
- 112925
- 98225
- 113340
- 113978
- 113229
- 98201
- 113422
- 98080
- 98593
- 114149
- 112714
- 98103
- 113237
- 113371
- 114167
- 113218
- 98065
- 112686
- 98649
- 113951
- 98642
- 112949
- 98205
- 113973
- 113258
- 98702
- 114089
- 112922
- 113211
- 112547
- 112615
- 112804
- 113207
- 113455
- 113059
- 113068
- 98208
- 112630
- 113974
- 112811
- 98059
- 98202
- 98070
- 98101
- 113374
- 98088
- 98054
- 113554
- 98061
- 98083
- 98524
- 98100
- 98407
- 98068
- 98067
- 114237
- 98212
- 113898
- 98063
- 112907
- 98062
- 98064
- 113553
- 98050
- 98091
- 113851
- 112528
- 113392
- 114224
- 114146
- 98146
- 98943
- 98937
- 98209
- 113904
- 98213
- 98398
- 112703
names: []
families:
- Component Vulnerability
- Injection
- HTTP Security Header
- Web Servers
- File Inclusion
- Data Exposure
- Authentication & Session
- Cross Site Scripting
- Code Execution
- General
- SSL/TLS
- Cross Site Request Forgery
queue_timeout: 08:00:00
scope:
option: urls
exclude_file_extensions:
- js
- css
- png
- jpeg
- gif
- pdf
- csv
- svn-base
- svg
- jpg
- ico
- woff
- woff2
- exe
- msi
- zip
exclude_path_patterns:
- logout
dom_depth_limit: 5
directory_depth_limit: 10
page_limit: 10000
decompose_paths: false
exclude_binaries: true
auto_redundant_paths: 5
openapi_file: null
openapi_filename: null
openapi_file_url: null
crawl_script_filename: null
deduplicate_pages: false
graphql_file: null
graphql_filename: null
graphql_file_url: null
graphql_introspection: null
soap_file: null
soap_filename: null
soap_file_url: null
session: {}
timeout: 00:10:00
remediation:
findings:
- vuln_id: f7c91cfa-b9c4-46eb-bcdc-3defb08e2e4b
scan_id: 72b549a2-9921-4eeb-86f3-1e2b9ab7ca82
plugin_id: 115540
found_on_url: http://203.0.113.224:3334/remediation
details:
inputType: cookie
inputName: connect.sid
creation_type: from_url_via_browser
in_remediation: true
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permissions to generate a remediation scan configuration. For more information, see [Roles](doc:roles) and [Permissions](doc:permissions).
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'404':
description: Returned if Tenable Web App Scanning could not find the specified vulnerability.
'422':
description: Returned if the plugin for the specified vulnerability is non-remediable.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/was/v2/configs/search:
post:
tags:
- Configurations
summary: Search scan configurations
description: Returns a list of web application scan configurations. If a scan has been run using the configuration, the list also contains information about the last scan that was run. <div class="perms-callout">Requires the Basic [16] user role or the `WAS.SCAN_WAS.READ` custom role privilege. Additionally, requires the Can View [16] scan permission. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: was-v2-config-search
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/offset'
- $ref: '#/components/parameters/sort'
requestBody:
required: true
content:
application/json:
schema:
oneOf:
- title: Single Filter
$ref: '#/components/schemas/AppliedFilters-ScanConfigs'
- title: Multiple Filters
type: object
properties:
AND:
type: array
description: An array of filters that must all be satisfied.
items:
$ref: '#/components/schemas/AppliedFilters-ScanConfigs'
OR:
type: array
description: An array of filters where at least one must be satisfied.
items:
$ref: '#/components/schemas/AppliedFilters-ScanConfigs'
responses:
'200':
description: A list of web application scan configurations. If a scan has been run using the configuration, the list also contains information about the last scan that was run.
content:
application/json:
schema:
type: object
required:
- pagination
- items
properties:
pagination:
$ref: '#/components/schemas/PaginationResponse'
items:
type: array
description: A list of scan configurations.
items:
$ref: '#/components/schemas/ConfigMetadata'
examples:
response:
value:
pagination:
total: 1690
offset: 0
limit: 10
sort:
- name: name
order: asc
- name: created_at
order: desc
- name: updated_at
order: desc
items:
- config_id: b7eb721f-5768-48a4-969f-aee8bc29ac22
owner_id: ef22f2bf-db1b-4471-984f-9507dcc083e1
is_shared: false
user_permissions: configure
name: '3370'
target_count: 1
description: null
created_at: '2020-05-12T09:43:42.620Z'
updated_at: '2020-05-12T09:43:42.620Z'
schedule:
timezone: Asia/Calcutta
starttime: 20200512T153000
rrule: FREQ=YEARLY;COUNT=1
enabled: false
template_id: ea71052b-5b48-4712-8255-3711d00a6514
last_scan: null
user_template: null
- config_id: 0aa9445f-b673-4563-b7e2-612ac37e885a
owner_id: 3e0eae98-dd3b-4c88-aa12-bac0b17567c6
is_shared: false
user_permissions: configure
name: 3370_WASTest
target_count: 1
description: test
created_at: '2020-05-12T10:06:06.919Z'
updated_at: '2020-05-12T10:06:50.955Z'
schedule:
timezone: Asia/Calcutta
starttime: 20200512T160000
rrule: FREQ=YEARLY;COUNT=1
enabled: false
template_id: ea71052b-5b48-4712-8255-3711d00a6514
last_scan: null
user_template: null
- config_id: 31b6dd5e-5edb-457d-9350-b9e31bd02bf1
owner_id: 01c924ee-e6ab-4d55-b283-dffba6dcce4c
is_shared: false
user_permissions: configure
name: A1_WAS_scan
target_count: 1
description: ''
created_at: '2020-06-11T15:08:48Z'
updated_at: '2020-06-11T15:08:48Z'
schedule: null
template_id: f93dfcb4-6eb2-4820-9b64-3dee8893a3f0
last_scan: null
user_template:
user_template_id: 0c539366-172d-49bd-9c3d-90a9947ea48e
name: A1_WAS_scan
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/was/v2/configs/{config_id}:
get:
summary: Get scan configuration details
description: Returns details for the specified scan configuration.<div class="perms-callout">Requires the Scan Operator [24] user role or the `WAS.SCAN_WAS.READ` custom role privilege. Additionally, requires the Can Execute [32] scan permission. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: was-v2-config-details
tags:
- Configurations
parameters:
- description: The UUID of the scan configuration that you want to retrieve details for.
in: path
name: config_id
required: true
schema:
type: string
format: uuid
responses:
'200':
description: Returns details for the specified scan configuration.
content:
application/json:
schema:
$ref: '#/components/schemas/Response-Scan-Config'
examples:
response:
value:
settings:
timeout: 08:00:00
debug_mode: false
credentials:
credential_ids:
- a982f52a-d1ee-48bf-8c94-e5d3b62804e6
scope:
option: all
urls: []
exclude_file_extensions:
- js
- css
- png
- jpeg
- gif
- pdf
-
# --- truncated at 32 KB (116 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-configurations-api-openapi.yml