Tenable Exports (Compliance Data) API
The Exports (Compliance Data) API from Tenable — 5 operation(s) for exports (compliance data).
OpenAPI Specification
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Exports (Compliance Data) API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Exports (Compliance Data)
x-displayName: Exports (Compliance Data)
paths:
/compliance/export:
post:
summary: Export compliance data
description: "Exports compliance data that matches the request criteria. The compliance export API does not return results for individual scans. Instead, the exported data is an aggregation / summary of all compliance scan data. As new compliance scans are run, the summary is updated with the latest audit results.\n\n**Note:** If you do not submit a request body with the POST request, Tenable Vulnerability Management returns a `415 Unsupported Media Type` error. If you do not want to use any body parameters, you must still supply an empty JSON body with the request to avoid this error. For example: `{}` \n\n**Note:** There are limits for concurrent export requests. For more information, see [Concurrency Limiting](doc:concurrency-limiting) and [Rate Limiting](doc:rate-limiting). <div class=\"perms-callout\">Requires the Basic [16] user role or the `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` custom role privilege. Additionally, requires the Can View access control permission for the asset objects to be exported. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>"
operationId: io-exports-compliance-create
tags:
- Exports (Compliance Data)
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
num_findings:
type: integer
description: 'Specifies the number of compliance findings per exported chunk. The valid range is 50-10000. The value defaults to `5000` if this parameter is omitted. If you specify a value outside of the supported range, the value defaults to the upper or lower-bound value.
**Note:** Some chunks may contain fewer findings than the specified `num_findings.`'
format: int32
minimum: 50
maximum: 10000
default: 5000
example: 5000
asset:
type: array
description: A list of asset UUIDs for which you want to return compliance data. The list can contain a maximum of 200 asset UUIDs.
items:
type: string
filters:
type: object
description: 'A list of filters that Tenable Vulnerability Management applies to exported compliance data. Omit the filters object to return compliance data for all assets.
**Note:** The `first_seen` filter cannot be used by itself. You must use `last_seen` and `first_seen` together or only `last_seen`. Additionally, when the `ACTIVE` is specified for the `state` filter, both `ACTIVE` and `NEW` findings are returned.'
properties:
last_seen:
type: integer
format: int64
description: Returns compliance findings for assets that were last seen (as `active`) by a scan between the specified date (in Unix time) and now.
example: 1589824486
first_seen:
type: integer
format: int64
description: 'Returns compliance findings for assets that were first seen by a scan between the specified date (in Unix time) and now.
Note that this filter can only be used in conjunction with the `last_seen` filter.'
example: 1589824486
last_observed:
type: integer
format: int64
description: Returns compliance data for assets that were last observed (whether `active` or `fixed`) by a scan between the specified date (in Unix time) and now.
example: 1589824486
indexed_at:
type: integer
format: int64
description: Returns compliance data for assets that were indexed into Tenable Vulnerability Management at the specified date (in Unix time).
example: 1589824486
since:
type: integer
format: int64
description: "The start date for the range of compliance data you want to export. The date must be specified in Unix time format. Note that `since` is based on the `indexed_at` at timestamp. Use this filter in conjunction with the `state` filter as follows:\n - If the `state` filter is set to `OPEN` or `REOPENED`, the export includes compliance findings for assets that were seen on or after the `since` date you specify.\n - If the `state` filter is set to `FIXED`, the export includes compliance findings for assets that were fixed on or after the since date you specify.\n - If you do not include the `state` filter in your request, the export includes data for `OPEN` and `REOPENED` findings that were seen on or after the `since` date you specify, and `FIXED` findings that were fixed on or after the since date you specify."
example: 1589824486
audit_name:
type: string
description: Returns compliance findings with the specified audit name. You can use an asterisk to match text. For example `Ensure default *`.
example: 5.5.4 Ensure default group for the root account is GID 0
audit_file_name:
type: string
description: Returns compliance findings with the specified audit file name. You can use an asterisk to match text, for example `CIS_CentOS_8_Server_L1_v1*`.
example: CIS_CentOS_8_Server_L1_v1.0.0.audit
compliance_results:
description: "Returns compliance findings with the specified compliance status. Supported values are:\n - PASSED—Returned if the asset has passed the compliance check.\n - FAILED—Returned if the asset has failed the compliance check.\n - WARNING—Returned in cases where there is no definable passing criteria; for example, an audit where you must verify that members of the administrator group are appropriate for your organization.\n - SKIPPED—Returned if the plugin determined that the check is not applicable to the asset. It can also be returned in other various cases; for example, if a check requires that a direct command be run to gather data on an offline network device or if a check contains commands that won't run on the specified OS.\n - ERROR—Returned if Tenable Vulnerability Management failed to complete the compliance check.\n - UNKNOWN—Returned when a status cannot be determined for the OVAL check. The OVAL engine sets this status."
type: array
items:
type: string
enum:
- PASSED
- FAILED
- WARNING
- SKIPPED
- ERROR
- UNKNOWN
ipv4_addresses:
type: array
description: A list of IPv4 addresses for which you want to return compliance findings.
items:
type: string
example:
- 192.168.1.1
ipv6_addresses:
type: array
description: A list of IPv6 addresses for which you want to return compliance findings.
items:
type: string
example:
- 2001:0db8:85a3:0000:0000:8a2e:0370:7334
network_id:
type: string
format: uuid
description: The ID of the network associated with the scanners that that gathered the compliance data you want to export. The default network ID is `00000000-0000-0000-0000-000000000000`. To determine the ID of a custom network, use the [GET /networks](ref:networks-list) endpoint. For more information about network objects, see [Manage Networks](doc:manage-networks-tio).
plugin_id:
type: array
description: A list of plugin IDs for which you want to return compliance findings.
items:
type: integer
format: int32
example:
- 1234
state:
description: "Returns compliance findings for assets that have the specified state. Supported values are:\n - OPEN—The compliance finding is currently present on a host.\n - REOPENED—The compliance finding was previously marked as fixed on a host but has returned.\n - FIXED—The compliance finding was present on a host but is no longer detected.\n\nNote that the API uses different terms for states than the user interface. The `new` and `active` states in the user interface map to the `open` state in the API. The `resurfaced` state in the user interface maps to the `reopened` state in the API. The `fixed` state is the same."
type: array
items:
type: string
enum:
- OPEN
- REOPENED
- FIXED
tags:
description: Returns compliance findings for assets that have the specified tags.
type: array
items:
type: object
properties:
category:
type: string
description: The tag category.
example: Office
values:
type: array
description: The tag values for the tag category.
items:
type: string
example:
- Dallas
responses:
'200':
description: Returned if a compliance export request was queued successfully.
content:
application/json:
schema:
type: object
properties:
export_uuid:
type: string
description: The UUID of the compliance export job.
examples:
response:
value:
export_uuid: ae0ca095-2e09-4721-9a86-9c174382f01c
'400':
description: Returned if your request specifies invalid input parameters. For example, an invalid filter parameter.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to export compliance data.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting) and [Concurrency Limiting](doc:concurrency-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- Export_Compliance_Data_cloud: []
/compliance/export/{export_uuid}/status:
get:
summary: Get compliance export status
description: Returns the status of the specified compliance export. Tenable Vulnerability Management processes the chunks in parallel so the chunks may not complete in order. <div class="perms-callout">Requires the Basic [16] user role or the `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` custom role privilege. See [Roles](doc:roles).</div>
operationId: io-exports-compliance-status
tags:
- Exports (Compliance Data)
parameters:
- description: The UUID for the compliance export request.
required: true
name: export_uuid
in: path
schema:
type: string
responses:
'200':
description: Returned if the status of the specified compliance export was retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_response-compliance-export-status'
examples:
response:
value:
uuid: 6b3ce4b9-604d-4de6-9dd2-a0bb5aa38cc1
status: FINISHED
chunks_available:
- 1
- 2
- 3
chunks_failed: []
chunks_cancelled: []
chunks_available_count: 3
empty_chunks_count: 0
finished_chunks: 3
filters: {}
num_findings: 5000
asset: []
created: 1720682287157
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to view the compliance export status.
'404':
description: Returned if Tenable Vulnerability Management cannot find a compliance export job with the specified ID.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- Export_Compliance_Data_cloud: []
/compliance/export/status:
get:
summary: List compliance export jobs
description: Returns a list of the last 1,000 compliance export requests along with their statuses and related metadata. <div class="perms-callout">Requires the Basic [16] user role or the `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` custom role privilege. See [Roles](doc:roles).</div>
operationId: exports-compliance-status-list
tags:
- Exports (Compliance Data)
responses:
'200':
description: Returned if the list of compliance export jobs was retrieved successfully.
content:
application/json:
schema:
type: object
properties:
exports:
type: array
items:
$ref: '#/components/schemas/Export_Compliance_Data_response-compliance-export-jobs'
examples:
response:
value:
exports:
- uuid: 3c8d6306-4e94-4203-8b28-57d13469154f
status: FINISHED
chunks_available_count: 1
empty_chunks_count: 0
finished_chunks: 1
filters:
last_seen: 1717320495
num_findings: 100
asset: []
created: 1719912495575
- uuid: ce0b0c04-e043-499d-8908-9f9e557d9d24
status: FINISHED
chunks_available_count: 1
empty_chunks_count: 0
finished_chunks: 1
filters:
last_seen: 1717318694
num_findings: 100
asset: []
created: 1719910695474
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to view compliance export statuses.
'404':
description: Returned if Tenable Vulnerability Management could not find any compliance exports.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- Export_Compliance_Data_cloud: []
/compliance/export/{export_uuid}/chunks/{chunk_id}:
get:
summary: Download compliance chunk
description: Downloads a specific compliance data chunk by ID. Chunks are processed in parallel and remain available for download for up to 3 days after creation. A `404` response is returned for expired chunks. <div class="perms-callout">Requires the Basic [16] user role or the `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` custom role privilege. See [Roles](doc:roles).</div>
operationId: io-exports-compliance-download
tags:
- Exports (Compliance Data)
x-readme:
explorer-enabled: false
parameters:
- description: The UUID of the compliance export request.
required: true
name: export_uuid
in: path
schema:
type: string
- description: The ID of the compliance chunk you want to export.
required: true
name: chunk_id
in: path
schema:
type: integer
format: int32
responses:
'200':
description: Returned if the compliance export chunk is downloaded successfully.
content:
application/json:
schema:
description: ''
type: array
items:
$ref: '#/components/schemas/Export_Compliance_Data_response-compliance-export-chunk'
examples:
response:
value:
- asset_uuid: e5e6fa1b-243f-45b7-82cb-285c271cbaa6
first_seen: '2021-01-16T00:18:49Z'
last_seen: '2021-01-28T17:27:07Z'
audit_file: CIS_CentOS_8_Server_L1_v1.0.0.audit
check_id: 00a3efcb8730ae2af470fdfc4eac23dfb1880539ad6a861e6ebc94df6b6f3dbf
check_name: 5.5.4 Ensure default group for the root account is GID 0
check_info: The usermod command can be used to specify which group the root user belongs to. This affects permissions of files that are created by the root user. Using GID 0 for the root account helps prevent root -owned files from accidentally becoming accessible to non-privileged users.
expected_value: 'expect: ^root:x:0:0:
file: /etc/passwd
regex: ^root:
system: Linux'
actual_value: "Compliant file(s):\n /etc/passwd - regex '^root:' found - expect '^root:x:0:0:' found in the following lines:\n 1: root:x:0:0:root:/root:/bin/bash"
status: PASSED
reference:
- framework: 800-171
control: 3.1.1
- framework: 800-53
control: AC-2
see_also: https://workbench.cisecurity.org/files/2518
solution: 'Run the following command to set the root user default group to GID 0 : # usermod -g 0 root'
db_type: sqlserver
plugin_id: 21157
state: OPEN
description: "\"Check 6: [PASSED]\"\n\ninfo block\n\nSolution:\nsolution block\nReference:\nComplianceReference(framework=800-171, control=3.4.2), ComplianceReference(framework= 800-53, control=CM-6), ComplianceReference(framework= CSCv7, control=BVVV)}\n\nPolicy Value:\nsome value\n\nActual Value:\n actual block 6"
compliance_benchmark_name: CIS SQL Server 2019
compliance_benchmark_version: 1.2.0
compliance_control_id: baadfa76f88e685b15df2cdb753a1e6e287cd3f2e4e3f8c7227a30e46f1a5d81
compliance_full_id: a91e96f031534a34949e11d1be63f78b5ba332c14e9c900bdb50ebae7a37d189
compliance_functional_id: 7957fe426e
compliance_informational_id: 52eeae68890a69e5ed722c9f624cba3d70d753f7025514284dc5ced306f74140
synopsis: Compliance checks for database servers.
last_fixed: '2024-01-03T17:24:28.004Z'
last_observed: '2024-01-03T17:24:28.004Z'
metadata_id: 9c30d6c68b6dde740fd7c864fbdf2acc0562e281ef8f156d05f1ed1695574a6e
uname_output: Linux centos-agent-docker3...
indexed_at: '2024-01-05T15:54:59.839Z'
plugin_name: Database Compliance Checks
asset:
id: 037bb045-2c31-5a3a-9b19-8832b9a00210
ipv4_addresses:
- 10.22.20.164
ipv6_addresses:
- fe80::4bb:baff:fe75:ef5c
fqdns:
- 19733542-65892551.test.com
name: 19733543-65892552.test.com
agent_name: Agent namef of asset
agent_uuid: 5084c820f68a431f8ee4e26f7af47fa6
netbios_name: 19733543-65892552.test.com
mac_addresses:
- 04:32:d7:26:ef:82
operating_systems:
- Linux
system_type: system-type
network_id: d6797cf4-42b9-4cad-8591-9dd91c3f0fc3
tags:
- category: Cloud
values:
- AWS
- Azure
- asset_uuid: e5e6fa1b-243f-45b7-82cb-285c271cbaa6
first_seen: '2021-01-28T17:26:40Z'
last_seen: '2021-01-28T17:27:02Z'
audit_file: CIS_CentOS_8_Server_L1_v1.0.0.audit
check_id: 029872b8096c787524a6bc025aaa541f2ac662384859158a5388d3b3e4d07162
check_name: 3.4.4.1.2 Ensure loopback traffic is configured - INPUT
check_info: Configure the loopback interface to accept traffic. Configure all other interfaces to deny traffic to the loopback network (127.0.0.0/8). Loopback traffic is generated between processes on machine and is typically critical to operation of the system. The loopback interface is the only place that loopback network (127.0.0.0/8) traffic should be seen, all other interfaces should ignore traffic on this network as an anti-spoofing measure.
expected_value: 'cmd: /usr/sbin/iptables -L INPUT -v -n | /usr/bin/awk ''{ a[$3":"$4":"$6":"$7":"$8":"$9] = NR; print } END { if (a["ACCEPT:all:lo:*:0.0.0.0/0:0.0.0.0/0"] > 0 && a["ACCEPT:all:lo:*:0.0.0.0/0:0.0.0.0/0"] < a["DROP:all:*:*:127.0.0.0/8:0.0.0.0/0"]) { print "pass" } else { print "fail" } }''
expect: ^pass$
system: Linux'
actual_value: "The command '/usr/sbin/iptables -L INPUT -v -n | /usr/bin/awk '{ a[$3\":\"$4\":\"$6\":\"$7\":\"$8\":\"$9] = NR; print } END { if (a[\"ACCEPT:all:lo:*:0.0.0.0/0:0.0.0.0/0\"] > 0 && a[\"ACCEPT:all:lo:*:0.0.0.0/0:0.0.0.0/0\"] < a[\"DROP:all:*:*:127.0.0.0/8:0.0.0.0/0\"]) { print \"pass\" } else { print \"fail\" } }'' returned : \n\nChain INPUT (policy ACCEPT 2247K packets, 301M bytes)\n pkts bytes target prot opt in out source destination \nfail"
status: PASSED
reference:
- framework: 800-171
control: 3.1.1
- framework: 800-53
control: AC-2
see_also: https://workbench.cisecurity.org/files/2518
solution: 'Run the following command to set the root user default group to GID 0 : # usermod -g 0 root'
db_type: sqlserver
plugin_id: 21157
state: OPEN
description: "\"Check 6: [PASSED]\"\n\ninfo block\n\nSolution:\nsolution block\nReference:\nComplianceReference(framework=800-171, control=3.4.2), ComplianceReference(framework= 800-53, control=CM-6), ComplianceReference(framework= CSCv7, control=BVVV)}\n\nPolicy Value:\nsome value\n\nActual Value:\n actual block 6"
compliance_functional_id: 7957fe426e
compliance_informational_id: 52eeae68890a69e5ed722c9f624cba3d70d753f7025514284dc5ced306f74140
synopsis: Compliance checks for database servers.
last_fixed: '2024-01-03T17:24:28.004Z'
last_observed: '2024-01-03T17:24:28.004Z'
metadata_id: 9c30d6c68b6dde740fd7c864fbdf2acc0562e281ef8f156d05f1ed1695574a6e
uname_output: Linux centos-agent-docker3...
indexed_at: '2024-01-05T15:54:59.839Z'
plugin_name: Database Compliance Checks
asset:
id: 037bb045-2c31-5a3a-9b19-8832b9a00210
ipv4_addresses:
- 10.22.20.164
ipv6_addresses: []
fqdns:
- 19733542-65892551.test.com
name: 19733543-65892552.test.com
agent_name: Agent name of asset
netbios_name: 19733543-65892552.test.com
system_type: system-type
network_id: null
tags: []
'400':
description: Returned if the compliance chunk ID is invalid or the chunk is not ready for download.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to download the compliance export.
'404':
description: Returned if Tenable Vulnerability Management cannot find the specified chunk with the specified export ID.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Compliance_Data_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- Export_Compliance_Data_cloud: []
/compliance/export/{export_uuid}/cancel:
post:
summary: Cancel compliance export
description: Cancels the specified compliance export job. If you cancel an export job, Tenable Vulnerability Management finishes any chu
# --- truncated at 32 KB (54 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-exports-compliance-data-api-openapi.yml