Tenable Credentials API
The Credentials API from Tenable — 4 operation(s) for credentials.
OpenAPI Specification
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Credentials API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Credentials
x-displayName: Credentials
paths:
/credentials:
post:
summary: Create managed credential
description: Creates a managed credential object that you can use when configuring and running scans. You can grant other users the permission to use the managed credential object in scans and to edit the managed credential configuration.<div class="perms-callout">Requires the Basic [16] user role or the `VM.VM_SCAN.VM_SCAN_MANAGED_CREDENTIAL.CREATE` custom role privilege. See [Roles](doc:roles).</div>
operationId: credentials-create
tags:
- Credentials
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
name:
description: The name of the managed credential. This name must be unique within your Tenable Vulnerability Management instance.
type: string
description:
description: The description of the managed credential object.
type: string
type:
description: The type of credential object. For a list of supported credential types, use the GET /credentials/types endpoint.
type: string
settings:
$ref: '#/components/schemas/credentials_CredentialSettingsRequestObject'
permissions:
description: A list of user permissions for the managed credential. If a request message omits this parameter, Tenable Vulnerability Management automatically creates a `permissions` object for the user account that submits the request.
type: array
items:
$ref: '#/components/schemas/credentials_ManagedCredentialPermissions'
required:
- name
- type
- settings
example:
name: Windows devices (Headquarters)
description: Use for scans of Windows devices located at headquarters.
type: Windows
settings:
domain: ''
username: user@example.com
auth_method: Password
password: aJ^deq34Rc
permissions:
- grantee_uuid: b16460d1-6b35-4fdc-8896-72b8683564d6
type: user
permissions: 64
name: user@example.com
responses:
'200':
description: Returned if a managed credential object was created successfully.
content:
application/json:
schema:
type: object
properties:
uuid:
type: string
description: The UUID of the new managed credential object.
examples:
response:
value:
uuid: d37f77aa-3d5c-45fb-863e-998dbe06763e
'400':
description: Returned if Tenable Vulnerability Management encounters invalid JSON in request body.
'401':
description: Returned if Tenable Vulnerability Management cannot authenticate the user account that submitted the request.
'403':
description: Returned if you do not have permission to create managed credential objects.
'409':
description: Returned if a managed credential object with the same name already exists.
'415':
description: Returned if the request payload is in an unsupported format.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if a Tenable Vulnerability Management service is unavailable. Wait a moment, and try your request again.
content:
application/json:
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Please wait a moment and try your request again.
security:
- credentials_cloud: []
get:
summary: List managed credentials
description: "Lists managed credentials where you have been assigned at least CAN USE (32) permissions. \n\n**Note:** This endpoint does not list scan-specific or policy-specific credentials (that is, credentials stored in either a scan or a policy). To view a list of scan-specific or policy-specific credentials, use the editor details endpoint (GET /editor/{type}/{id}). <div class=\"perms-callout\">Requires the Can Use [32] credential permission or the `VM.VM_SCAN.VM_SCAN_MANAGED_CREDENTIAL.READ` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>"
operationId: credentials-list
tags:
- Credentials
parameters:
- description: "A filter condition in the following format: `field:operator:value`. For managed credentials, you can only filter on the `name` field, using the following operators: \n* eq—The name of the returned credential is equal to the text you specify. \n* neq—The returned list of managed credentials excludes the credential object where the name is equal to the text you specify. \n* match—The returned list includes managed credentials where the name contains the text you specify at least partially.\n\nYou can specify multiple `f` parameters, separated by ampersand (&) characters. If you specify multiple `f` parameters, use the `ft` parameter to specify how Tenable Vulnerability Management applies the multiple filter conditions."
required: false
name: f
in: query
schema:
type: string
- description: The operator that Tenable Vulnerability Management applies if multiple \`f\` parameters are present. The `OR` and `AND` operators are supported. If you omit this parameter and multiple `f` parameters are present, Tenable Vulnerability Management applies the `AND` operator by default.
required: false
name: ft
in: query
schema:
type: string
- description: The UUID of a scan owner. This parameter limits the returned data to managed credentials assigned to scans owned by the specified user.
name: referrer_owner_uuid
in: query
schema:
type: string
- description: The number of records to retrieve. If this parameter is omitted, Tenable Vulnerability Management uses the default value of `50`. This parameter has a minimum value of `1` and a maximum value of `300`.
required: false
name: limit
in: query
schema:
type: integer
minimum: 1
maximum: 300
format: int32
- description: The starting record to retrieve. If this parameter is omitted, Tenable Vulnerability Management uses the default value of `0`.
required: false
name: offset
in: query
schema:
type: integer
format: int32
- description: The field you want to use to sort the results by along with the sort order. The field is specified first, followed by a colon, and the order is specified second (`asc` or `desc`). For example, `name:asc` would sort results by the `name` field in ascending order.
required: false
name: sort
in: query
schema:
type: string
responses:
'200':
description: Returns a list of managed credentials.
content:
application/json:
schema:
type: object
properties:
credentials:
type: array
items:
$ref: '#/components/schemas/credentials_ManagedCredentialObject'
pagination:
$ref: '#/components/schemas/credentials_PaginationResponse'
examples:
response:
value:
credentials:
- uuid: a3820211-a59c-4fdd-b6f9-65583f61bf61
name: Windows devices (Headquarters)
description: Use for scans of Windows devices located at headquarters.
category:
id: Host
name: Host
type:
id: Windows
name: Windows
created_date: 1551295980
created_by:
id: 15
display_name: user@example.com
last_used_by:
id: null
display_name: null
permission: 32
user_permissions: 32
pagination:
total: 1
limit: 50
offset: 0
sort:
- name: created_date
order: desc
'400':
description: Returned if the query parameters in your request were invalid.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if a Tenable Vulnerability Management service is unavailable. Wait a moment, and try your request again.
content:
application/json:
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Please wait a moment and try your request again.
security:
- credentials_cloud: []
/credentials/{uuid}:
get:
summary: Get managed credential details
description: Returns details of the specified managed credential object.<div class="perms-callout">Requires the Can Use [32] credential permission or the `VM.VM_SCAN.VM_SCAN_MANAGED_CREDENTIAL.READ` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: credentials-details
tags:
- Credentials
parameters:
- description: The UUID of the managed credential for which you want to view details.
required: true
name: uuid
in: path
schema:
type: string
responses:
'200':
description: Returns the details of the specified managed credential object.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ManagedCredentialDetails'
examples:
response:
value:
name: Windows devices (Headquarters)
description: Use for scans of Windows devices located at headquarters.
category:
id: Host
name: Host
type:
id: Windows
name: Windows
ad_hoc: false
user_permissions: 64
settings:
domain: ''
username: user@example.com
auth_method: Password
password: '********'
permissions:
- grantee_uuid: 59042c90-5379-43a2-8cf4-87d97f7cb68f
type: user
permissions: 64
name: user1@tenable.com
- grantee_uuid: 397431c8-e945-4882-8d0d-7267a3bd27c2
type: user
permissions: 64
name: user2@example.com
- grantee_uuid: 99057c1e-e36a-448f-83ec-ae0b8e733ea9
type: user
permissions: 32
name: user3@example.com
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have sufficient permissions to view the specified managed credential object.
'404':
description: Returned if Tenable Vulnerability Management cannot find a managed credential object with the specified UUID.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if a Tenable Vulnerability Management service is unavailable. Wait a moment, and try your request again.
content:
application/json:
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Please wait a moment and try your request again.
'504':
description: Returned if Tenable Vulnerability Management is unavailable. Wait a moment, and try your request again.
content:
application/json:
examples:
response:
value:
statusCode: 504
error: Gateway Timeout
message: Please wait a moment and try your request again.
security:
- credentials_cloud: []
put:
summary: Update managed credential
description: "Updates a managed credential object. \n\n**Note:** You cannot use this endpoint to update the credential type. If you create a managed credential with the incorrect type, create a new managed credential with the correct credential type, and delete the incorrect managed credential.<div class=\"perms-callout\">Requires the Can Edit [64] credential permission or the `VM.VM_SCAN.VM_SCAN_MANAGED_CREDENTIAL.EDIT` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>"
operationId: credentials-update
tags:
- Credentials
parameters:
- description: The UUID of the managed credential object you want to update.
required: true
name: uuid
in: path
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
name:
description: The new name of the managed credential object. This name must be unique within your Tenable Vulnerability Management instance.
type: string
description:
description: The new description of the managed credential object.
type: string
ad_hoc:
description: A value specifying if the credential is managed (`false`) versus stored in a scan or policy configuration (`true`). You can only set this parameter from `true` to `false`. You cannot set this parameter to `true`. If you omit this parameter, the value defaults to `false`.
type: boolean
settings:
$ref: '#/components/schemas/credentials_CredentialSettingsRequestObject'
permissions:
description: User permissions for the managed credential.
type: array
items:
$ref: '#/components/schemas/credentials_ManagedCredentialPermissions'
responses:
'200':
description: Returned if the managed credential object was updated successfully.
content:
application/json:
schema:
type: object
properties:
updated:
type: boolean
examples:
response:
value:
updated: true
'400':
description: Returned if Tenable Vulnerability Management encounters invalid JSON in the request body.
'401':
description: Returned if Tenable Vulnerability Management cannot authenticate the user account that submitted the request.
'403':
description: Returned if you do not have permission to update the specified managed credential object.
'404':
description: Returned if Tenable Vulnerability Management could not find the specified managed credential object, either because the object does not exist or because the object has been deleted.
'409':
description: Returned if a managed credential object with the same name already exists.
'415':
description: Returned if the request payload is in an unsupported format.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if a Tenable Vulnerability Management service is unavailable. Wait a moment, and try your request again.
content:
application/json:
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Please wait a moment and try your request again.
security:
- credentials_cloud: []
delete:
summary: Delete managed credential
description: Deletes the specified managed credential object. When you delete a managed credential object, Tenable Vulnerability Management also removes the credential from any scan that uses the credential.<div class="perms-callout">Requires the Can Edit [64] credential permission or the `VM.VM_SCAN.VM_SCAN_MANAGED_CREDENTIAL.DELETE` custom role privilege. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: credentials-delete
tags:
- Credentials
parameters:
- description: The UUID for the managed credential object you want to delete.
required: true
name: uuid
in: path
schema:
type: string
responses:
'200':
description: Returned if the specified managed credential object was deleted successfully.
content:
application/json:
schema:
type: object
properties:
deleted:
type: boolean
examples:
response:
value:
deleted: true
'401':
description: Returned if Tenable Vulnerability Management cannot authenticate the user account that submitted the request.
'403':
description: Returned if you do not have sufficient permissions to delete the specified managed credential object.
'404':
description: Returned if Tenable Vulnerability Management could not find the managed credential object you specified.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if a Tenable Vulnerability Management service is unavailable. Wait a moment, and try your request again.
content:
application/json:
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Please wait a moment and try your request again.
security:
- credentials_cloud: []
/credentials/types:
get:
summary: List credential types
description: Lists all credential types supported for managed credentials in Tenable Vulnerability Management. For more information about using the data returned by this endpoint to create managed credentials, see [Determine Settings for a Credential Type](doc:determine-settings-for-credential-type). <div class="perms-callout">Requires the Basic [16] user role or the `VM.VM_SCAN.VM_SCAN_MANAGED_CREDENTIAL.READ` custom role privilege. See [Roles](doc:roles).</div>
operationId: credentials-list-credential-types
tags:
- Credentials
responses:
'200':
description: Returns a list of supported credential types and associated settings.
content:
application/json:
schema:
type: object
properties:
credentials:
type: array
items:
$ref: '#/components/schemas/credentials_CredentialObject'
examples:
response:
value:
credentials:
- id: Cloud Services
category: Cloud Services
default_expand: false
types:
- id: Amazon AWS
name: Amazon AWS
max: 1
configuration:
- type: password
name: AWS Access Key ID
required: true
id: access_key_id
- type: password
name: AWS Secret Key
required: true
id: secret_key
expand_settings: true
- id: Microsoft Azure
name: Microsoft Azure
max: 1
configuration:
- type: text
name: Username
required: true
id: username
- type: password
name: Password
required: true
id: password
- type: text
name: Client Id
required: true
id: client_id
expand_settings: true
- id: Office 365
name: Office 365
max: 1
configuration:
- type: text
name: Username
required: true
id: username
- type: password
name: Password
required: true
id: password
- type: text
name: Client Id
required: true
id: client_id
- type: password
name: Client Secret
required: true
id: client_secret
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/credentials_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
'503':
description: Returned if a Tenable Vulnerability Management service is unavailable. Wait a moment, and try your request again.
content:
application/json:
examples:
response:
value:
statusCode: 503
error: Service Unavailable
message: Please wait a moment and try your request again.
security:
- credentials_cloud: []
/credentials/files:
post:
summary: Upload credentials file
description: "Uploads a file for use with a managed credential (for example, as a private key file for an SSH credential).\n\n Tenable Vulnerability Management validates this request with the required `fileType` query parameter. The supported `fileTypes` are: `pem`, `json`, `csv`, `x.509`, `p12`, `cookie`, `ssh` (only RSA and DSA OpenSSH keys/certificates are supported). To pass validation, `cookie` files must adhere to the Netscape cookies file format. Additionally, `csv` files must adhere to one of the following formats: <ul><li>`target, port, database_name, username, cred_manager`</li> <li>`target, port, instance_name, username, auth_type, cred_manager`</li> <li>`target, port, service_type, service_ID, username, auth_type, cred_manager`</li><li>`target, port, service_type, service_ID, username, auth_type, cred_manager, accountname_or_secretname`</li></ul> \n\nFor more information about using this file, see [Create a Managed Credential](doc:create-managed-credential). <div class=\"perms-callout\">Requires the Basic [16] user role or the `VM.VM_SCAN.VM_SCAN_MANAGED_CREDENTIAL.CREATE` custom role privilege. See [Roles](doc:roles).</div
# --- truncated at 32 KB (51 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-credentials-api-openapi.yml