Tenable Exports API
With the Exports API, you can manage asynchronous finding exports. Use these endpoints to initiate export jobs, monitor status, and download results in chunks for integration with external workflow management systems.
OpenAPI Specification
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Exports API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Exports
description: With the Exports API, you can manage asynchronous finding exports. Use these endpoints to initiate export jobs, monitor status, and download results in chunks for integration with external workflow management systems.
paths:
/was/v1/export/vulns:
post:
summary: Export findings
description: "Exports Tenable Web App Scanning findings that match the request criteria. \n\nUsers need at least BASIC [16] user permissions and the Can View access control permission for the asset objects they want to export. You can set the Can View permission for the All Assets object for all assets. ADMINISTRATOR [64] users can export without the explicit Can View access control permissions. \n\n**Caution**: The `vpr_v2_score` filter parameter is scheduled for deprecation on July 1, 2026 as part of the transition to VPR v2. To ensure continued functionality, update all integrations to use the `vpr_score` filter parameter. On the deprecation date, the system will update `vpr_score` to support the new VPR model. For more information, see [Vulnerability Priority Rating: Transition to VPR Version 2](changelog:vulnerability-priority-rating-transition-to-version-2). \n\n**Note:** There are limits for concurrent export requests. For more information, see [Concurrency Limiting](doc:concurrency-limiting) and [Rate Limiting](doc:rate-limiting). <div class=\"perms-callout\">Requires the Basic [16] user role and the Can View access control permission for the asset objects to be exported. Administrator [64] users can export without the explicit Can View access control permissions. See [Roles](doc:roles).</div>"
operationId: was-export-findings
tags:
- Exports
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
num_assets:
type: integer
description: Specifies the number of assets used to chunk the findings. The findings export is split up by number of asset IDs in a chunk. The exported data of a chunk is the sum of all the findings for each asset in that chunk. The range for number of assets in a chunk is a minimum of 50 (the default size) to a maximum of 5,000. If you specify a value outside this range, the system uses the upper or lower-bound value.
format: int32
default: 50
minimum: 50
maximum: 5000
include_unlicensed:
type: boolean
default: false
description: Specifies whether or not to include unlicensed assets. The default is `false` when no parameter is specified.
filters:
type: object
description: 'Specifies filters to apply to the findings export.
**Note:** By default, vulnerability exports will only include accepted and non-accepted vulnerabilities found or fixed within the last 30 days if no time-based filters are submitted with the request.'
properties:
asset_uuid:
description: A list of asset UUIDs for which you want to filter findings returned in the findings export.
type: array
items:
type: string
format: uuid
asset_name:
description: An asset name for which you want to filter findings returned in the findings export.
type: string
cvss4_base_score:
$ref: '#/components/schemas/cvss4_filter'
epss_score:
$ref: '#/components/schemas/epss_filter'
first_found:
description: Returns findings that were first found between the specified date and now. The date must be specified in Unix 10-digit time format (seconds).
type: integer
format: int64
last_fixed:
type: integer
description: Returns findings that were fixed between the specified date and now. The date must be specified in Unix 10-digit time format (seconds).
format: int64
last_found:
type: integer
description: Returns findings that were last found between the specified date and now. The date must be specified in Unix 10-digit time format (seconds).
format: int64
indexed_at:
type: integer
description: Returns findings that were indexed into Tenable Web App Scanning at the specified date. The date must be specified in Unix 10-digit time format (seconds).
format: int64
ipv4s:
description: A list of IPv4 addresses for which for which you want to filter findings returned in the findings export.
type: array
items:
type: string
owasp_2010:
description: A list of chapters from the OWASP Categories 2010 report for which you want to filter findings returned in the findings export.
type: array
items:
type: string
enum:
- A1
- A2
- A3
- A4
- A5
- A6
- A7
- A8
- A9
- A10
owasp_2013:
description: A list of chapters from the OWASP Categories 2013 report for which you want to filter findings returned in the findings export.
type: array
items:
type: string
enum:
- A1
- A2
- A3
- A4
- A5
- A6
- A7
- A8
- A9
- A10
owasp_2017:
description: A list of chapters from the OWASP Categories 2017 report for which you want to filter findings returned in the findings export.
type: array
items:
type: string
enum:
- A1
- A2
- A3
- A4
- A5
- A6
- A7
- A8
- A9
- A10
owasp_2021:
description: A list of chapters from the OWASP Categories 2021 report for which you want to filter findings returned in the findings export.
type: array
items:
type: string
enum:
- A1
- A2
- A3
- A4
- A5
- A6
- A7
- A8
- A9
- A10
owasp_api_2019:
description: A list of chapters from the OWASP Categories API 2019 report for which you want to filter findings returned in the findings export.
type: array
items:
type: string
enum:
- API1
- API2
- API3
- API4
- API5
- API6
- API7
- API8
- API9
- API10
plugin_ids:
description: A list of plugin IDs for which you want to filter the findings returned in the findings export. If your request omits this parameter, the export includes all findings regardless of plugin ID.
type: array
items:
type: integer
severity:
description: "Returns findings with the specified severity. Defaults to all severity levels. The severity of a finding is defined using the Common Vulnerability Scoring System (CVSS) base score. Supported array values are:\n - info—The finding has a CVSS score of 0.\n - low—The finding has a CVSS score between 0.1 and 3.9.\n - medium—The finding has a CVSS score between 4.0 and 6.9.\n - high—The finding has a CVSS score between 7.0 and 9.9.\n - critical—The finding has a CVSS score of 10.0."
type: array
items:
type: string
enum:
- INFO
- LOW
- MEDIUM
- HIGH
- CRITICAL
severity_modification_type:
description: "Returns findings with the specified severity modification type. This filter can be used to return findings with a modified severity due to a recast or accept rule. Supported case-sensitive values are:\n - NONE—No modification to the severity has been made.\n - RECASTED—A user has recast the risk associated with the finding.\n - ACCEPTED—A user has accepted the risk associated with the finding."
type: array
items:
type: string
enum:
- NONE
- RECASTED
- ACCEPTED
since:
type: integer
description: "The start date for the range of data you want to export. The date must be specified in Unix 10-digit time format (seconds). Use this filter in conjunction with the state filter as follows:\n - If the state filter is set to `OPEN` or `REOPENED`, the export includes data for findings that were seen on or after the since date you specify.\n - If the state filter is set to `FIXED`, the export includes data for findings that were fixed on or after the since date you specify.\n - If you do not include the `state` filter in your request, the export includes data for `OPEN` and `REOPENED` findings that were seen on or after the since date you specify, and `FIXED` findings that were fixed on or after the since date you specify.\n**Note:** This filter cannot be used in conjunction with the `first_found`, `last_found`, or `last_fixed` filters."
format: int64
state:
description: "Returns findings with the specified state. Supported, case-insensitive values are:\n - OPEN—The finding is currently present on an asset.\n - REOPENED—The finding was previously marked as fixed on an asset but has returned.\n - FIXED—The finding was present on an asset but is no longer detected.\n\nThis parameter is required if your request includes `first_found`, `last_found`, or `last_fixed` parameters. If your request omits this parameter, the export includes default states `OPEN` and `REOPENED` only.\n\nNote that the API uses different terms for finding states than the user interface. The `new` and `active` states in the user interface map to the `OPEN` state in the API. The `resurfaced` state in the user interface maps to the `REOPENED` state in the API. The `FIXED` state is the same."
type: array
items:
type: string
enum:
- OPEN
- REOPENED
- FIXED
vpr_score:
$ref: '#/components/schemas/vpr_filter'
vpr_v2_score:
$ref: '#/components/schemas/vpr_v2_filter'
responses:
'200':
description: Returned if a WAS findings export request was queued successfully.
content:
application/json:
schema:
type: object
properties:
export_uuid:
type: string
description: The UUID of the WAS findings export job.
examples:
response:
value:
export_uuid: bf765455-53aa-4e70-9ef3-87cfca1d2be0
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to export WAS findings.
'409':
description: Returned if your request was a duplicate of an ongoing export that was already submitted. Tenable Web App Scanning prevents duplicate exports from running concurrently. For example, export requests with the same filters.
content:
application/json:
schema:
type: object
properties:
active_job_id:
type: string
description: The UUID of ongoing WAS findings export job that was already submitted.
failure_reason:
type: string
description: A description of the conflict.
examples:
response:
value:
active_job_id: a55181e3-a551-4b9b-9c17-b019412cc35c
failure_reason: The request could not be completed due to a conflict with the ongoing export
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting) and [Concurrency Limiting](doc:concurrency-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/was/v1/export/vulns/{export_uuid}/status:
get:
summary: Get findings export status
description: "Returns the status of a Tenable Web App findings export request. Tenable Web App Scanning processes the chunks in parallel so the chunks may not complete in order, and the chunk IDs may not be arranged sequentially in the completed output.\n\n **Note:** Output for an individual plugin is limited to 1,024 KB (1 MB). <div class=\"perms-callout\">Requires the Basic [16] user role. See [Roles](doc:roles).</div>"
operationId: was-export-findings-status
tags:
- Exports
parameters:
- description: The UUID for the WAS findings export request to retrieve the status for.
required: true
name: export_uuid
in: path
schema:
type: string
description: The unique identifier of an export request. This value corresponds to the value returned in the [/was/v1/export/vulns](ref:was-export-vulns) response message.
responses:
'200':
description: Returned if the status for the specified WAS findings export was retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/response-findings-export-status'
examples:
response:
value:
uuid: 2d1a9cd9-85d6-4e63-9483-9b7b82a0914b
status: FINISHED
chunks_available:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
chunks_failed: []
chunks_cancelled: []
total_chunks: 10
chunks_available_count: 10
empty_chunks_count: 0
finished_chunks: 10
filters:
first_found: 1540350772
last_fixed: 0
last_found: 0
indexed_at: 0
since: 0
severity:
- CRITICAL
state:
- OPEN
- REOPENED
num_assets_per_chunk: 100
created: 1732582685595
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to view the WAS findings export status.
'404':
description: Returned if Tenable Web App Scanning could not find the specified WAS findings export job.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/was/v1/export/vulns/status:
get:
summary: List findings export jobs
description: Retrieves a list of WAS findings export jobs. This list includes the 1,000 most recent export jobs regardless of status. However, this list includes completed jobs only if the job completed in the previous three days. <div class="perms-callout">Requires the Basic [16] user role. See [Roles](doc:roles).</div>
operationId: was-export-findings-jobs-list
tags:
- Exports
responses:
'200':
description: Returned if the list of WAS findings export jobs was retrieved successfully.
content:
application/json:
schema:
type: object
properties:
exports:
type: array
items:
$ref: '#/components/schemas/response-findings-export-jobs'
examples:
response:
value:
exports:
- uuid: 447ea9b1-447e-4aa1-aba1-deaacb38a9cf
status: FINISHED
total_chunks: 0
chunks_available_count: 0
empty_chunks_count: 0
finished_chunks: 0
filters:
state:
- OPEN
- REOPENED
since: 1611102529
first_found: 0
last_found: 0
last_fixed: 0
indexed_at: 0
num_assets_per_chunk: 50
created: 1613694529186
- uuid: 69c201d1-9afd-4a4a-8acf-43c367ab03bf
status: FINISHED
total_chunks: 0
chunks_available_count: 0
empty_chunks_count: 0
finished_chunks: 0
filters:
state:
- OPEN
- REOPENED
since: 1611102552
first_found: 0
last_found: 0
last_fixed: 0
indexed_at: 0
num_assets_per_chunk: 50
created: 1613694552649
- uuid: 95eae0fe-1272-4495-a63b-639bd2a2f4f2
status: ERROR
total_chunks: 0
chunks_available_count: 0
empty_chunks_count: 0
finished_chunks: 0
filters:
severity:
- LOW
state:
- FIXED
since: 0
first_found: 0
last_found: 0
last_fixed: 0
indexed_at: 0
vpr_score:
eq:
- 2
neq:
- 3
gt: 0
gte: 0
lt: 0
lte: 0
vpr_v2_score:
eq:
- 2
neq:
- 3
gt: 0
gte: 0
lt: 0
lte: 0
epss_score:
eq:
- 10
neq:
- 20
gt: 30
gte: 40
lt: 90
lte: 80
cvss4_base_score:
eq:
- 5
neq:
- 2
gt: 0
gte: 0
lt: 0
lte: 0
plugin_ids:
- 0
num_assets_per_chunk: 50
created: 1614377678711
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permissions to list WAS findings export jobs.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/was/v1/export/vulns/{export_uuid}/chunks/{chunk_id}:
get:
summary: Download findings export chunk
description: 'Downloads exported WAS findings as a JSON file. The response content type is `application/octet-stream`.
Chunks are available for download for up to 24 hours after they have been created. Tenable Web App Scanning returns a 404 message for expired chunks. Export chunks do not include an attribute if that attribute is empty in the vulnerability record.
A successful response message contains attributes that correspond to CVSS metrics; these metrics are described fully in the following documents:<ul><li>[A Complete Guide to the Common Vulnerability Scoring System, Version 2.0](https://www.first.org/cvss/v2/guide)</li><li>[Common Vulnerability Scoring System v3.0: Specification Document](https://www.first.org/cvss/specification-document)</li></ul><div class="perms-callout">Requires the Basic [16] user role. See [Roles](doc:roles).</div>'
operationId: was-export-findings-download-chunk
tags:
- Exports
x-readme:
explorer-enabled: false
parameters:
- description: The UUID of the WAS findings export job.
required: true
name: export_uuid
in: path
schema:
type: string
- description: The ID of the chunk you want to export.
required: true
name: chunk_id
in: path
schema:
type: integer
format: int32
responses:
'200':
description: Returned if the findings export chunk was retrieved successfully.
content:
application/octet-stream:
schema:
description: ''
type: array
items:
$ref: '#/components/schemas/response-was-findings-chunk'
examples:
response:
value:
- finding_id: 044a6c5f-3b1c-5c2d-bc76-36e0072ab19c
url: https://www.unixtimestamp.com/contact.php
output: 'Current Version: 2.2.4
Fixed Version: 3.0.0
Detected technology URL: https://www.unixtimestamp.com/contact.php'
state: OPEN
severity: MEDIUM
severity_id: 2
severity_default_id: 2
severity_modification_type: NONE
first_found: '2024-02-01T16:08:41Z'
last_found: '2024-02-01T16:08:41Z'
indexed_at: '2024-02-01T16:08:41Z'
plugin:
bid:
- '105658'
id: 112435
risk_factor: MEDIUM
original_risk_factor_num: 2
locale: en
type: REMOTE
intel_type: SENSOR
name: jQuery 1.12.4 < 3.0.0 Cross-Site Scripting
publication_date: '2018-11-05T00:00:00Z'
modification_date: '2023-03-14T00:00:00Z'
see_also:
- https://github.com/jquery/jquery/issues/2432
- https://github.com/jquery/jquery/pull/2588/commits/c254d308a7d3f1eac4d0b42837804cfffcba4bb2
solution: Upgrade to jQuery version 3.0.0 or later.
synopsis: jQuery 1.12.4 < 3.0.0 Cross-Site Scripting
description: 'According to its self-reported version number, jQuery is at least 1.4.0 and prior to 1.12.0 or at least 1.12.4 and prior to 3.0.0-beta1. Therefore, it may be affected by a cross-site scripting vulnerability due to cross-domain ajax request performed without the dataType.
Note that the scanner has not tested for these issues but has instead relied only on the application''s self-reported version number.'
patch_publication_date: '2018-01-18T00:00:00Z'
exploitability_ease: No known exploits are available
public_display: 112435
policy: []
xrefs:
- type: owasp_asvs
id:
- 4.0.2-14.2.1
- 4.0.2-5.3.3
- type: capec
id:
- '209'
- '588'
- '591'
- '592'
- '63'
- '85'
- type: hipaa
id:
- 164.306(a)(1)
- 164.306(a)(2)
- type: iso
id:
- 27001-A.14.2.5
- type: nist
id:
- sp800_53-CM-6b
- sp800_53-SI-10
- type: disa_stig
id:
- APSC-DV-002490
- APSC-DV-002630
- type: pci_dss
id:
- 3.2-6.2
- 3.2-6.5.7
cpe:
- cpe:2.3:a:jquery:jquery:*:*:*:*:*:
# --- truncated at 32 KB (98 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-exports-api-openapi.yml