Tenable Exports (Vulnerabilities) API
The Exports (Vulnerabilities) API from Tenable — 5 operation(s) for exports (vulnerabilities).
OpenAPI Specification
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Exports (Vulnerabilities) API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Exports (Vulnerabilities)
x-displayName: Exports (Vulnerabilities)
paths:
/vulns/export:
post:
summary: Export vulnerabilities
description: "Exports vulnerabilities that match the request criteria. \n\nUsers need at least the Basic [16] user permission or the `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` custom role privilege. Additionally, requires the Can View access control permission for the asset objects to be exported. The Can View access control permission can be set for all assets with the `All Assets` object. Administrator [64] users can export without the explicit Can View access control permission. \n\nFor more information about this endpoint, see guidelines and limitations described in [Retrieve Vulnerability Data from Vulnerability Management](doc:retrieve-vulnerability-data-from-tenableio). For request examples, see [Refine Vulnerability Export Requests](doc:refine-vulnerability-export-requests). \n\n **Caution**: The `vpr_v2_score` filter parameter is scheduled for deprecation on July 1, 2026 as part of the transition to VPR v2. To ensure continued functionality, update all integrations to use the `vpr_score` filter parameter. On the deprecation date, the system will update `vpr_score` to support the new VPR model. For more information, see [Vulnerability Priority Rating: Transition to VPR Version 2](changelog:vulnerability-priority-rating-transition-to-version-2). \n\n**Note:** There are limits for concurrent export requests. For more information, see [Concurrency Limiting](doc:concurrency-limiting) and [Rate Limiting](doc:rate-limiting). <div class=\"perms-callout\">Requires the Basic [16] user role or the `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` custom role privilege. Additionally, requires the Can View access control permission for the asset objects to be exported. Administrator [64] users can export without the explicit Can View access control permission. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>"
operationId: exports-vulns-request-export
tags:
- Exports (Vulnerabilities)
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
num_assets:
type: integer
description: Specifies the number of assets used to chunk the vulnerabilities. The vulnerabilities export is split up by number of asset IDs in a chunk. The exported data of a chunk is the sum of all the vulnerabilities for each asset in that chunk. The range for number of assets in a chunk is a minimum of 50 (the default size) to a maximum of 5,000. If you specify a value outside this range, the system uses the upper or lower-bound value.
format: int32
default: 50
minimum: 50
maximum: 5000
include_unlicensed:
type: boolean
default: false
description: Specifies whether or not to include unlicensed assets. The default is `false` when no parameter is specified.
include_software_vulns:
type: boolean
default: false
description: Specifies whether to include software package attribution data in the export output. If set to `true`, the system populates each vulnerability record with a `software_vulns` array containing details such as the package identifier, version, vendor, available fixes, and confidence classification. If omitted, the system uses the default value of `false` and excludes this data.
filters:
type: object
description: 'Specifies filters to apply to the vulnerabilities export.
**Note:** By default, vulnerability exports will only include accepted and non-accepted vulnerabilities found or fixed within the last 30 days if no time-based filters are submitted with the request.'
properties:
since:
type: integer
description: "The start date for the range of data you want to export. The date must be provided as a 10-digit Unix timestamp (in seconds). Use this filter in conjunction with the state filter as follows:\n - If the state filter is set to `OPEN` or `REOPENED`, the export includes data for vulnerabilities that were seen on or after the since date you specify.\n - If the state filter is set to `FIXED`, the export includes data for vulnerabilities that were fixed on or after the since date you specify.\n - If you do not include the `state` filter in your request, the export includes data for `OPEN` and `REOPENED` vulnerabilities that were seen on or after the since date you specify, and `FIXED` vulnerabilities that were fixed on or after the since date you specify.\n\n**Note:** This filter cannot be used in conjunction with the `first_found`, `first_seen`, `last_found`, `last_seen`, or `last_fixed` filters."
format: int64
first_found:
type: integer
description: 'Returns vulnerabilities first discovered on or after the specified date. The date must be provided as a 10-digit Unix timestamp (in seconds).
**Note:** This filter parameter is functionally equivalent to `first_seen`. You can use either one.'
format: int64
first_seen:
type: integer
description: 'Returns vulnerabilities first discovered on or after the specified date. The date must be provided as a 10-digit Unix timestamp (in seconds).
**Note:** This filter parameter is functionally equivalent to `first_found`. You can use either one.'
format: int64
last_found:
type: integer
description: 'Returns vulnerabilities last found on or after the specified date. The date must be provided as a 10-digit Unix timestamp (in seconds).
**Note:** This filter parameter is functionally equivalent to `last_seen`. You can use either one.'
format: int64
last_seen:
type: integer
description: 'Returns vulnerabilities last found on or after the specified date. The date must be provided as a 10-digit Unix timestamp (in seconds).
**Note:** This filter parameter is functionally equivalent to `last_found`. You can use either one.'
format: int64
indexed_at:
type: integer
description: Returns vulnerabilities that were indexed in Tenable Vulnerability Management on the specified date. The date must be provided as a 10-digit Unix timestamp (in seconds).
format: int64
last_fixed:
type: integer
description: Returns vulnerabilities that were last fixed between the specified date and the present. The date must be provided as a 10-digit Unix timestamp (in seconds).
format: int64
time_taken_to_fix:
$ref: '#/components/schemas/Export_Vulnerabilities_time_taken_to_fix_filter'
resurfaced_date:
description: Returns vulnerabilities that resurfaced between the specified date and the present. The date must be provided as a 10-digit Unix timestamp (in seconds).
type: integer
format: int64
cidr_range:
description: Restricts search for vulnerabilities to assets assigned an IP address within the specified CIDR range. For example, 0.0.0.0/0 restricts the search to 0.0.0.1 and 255.255.255.254.
type: string
cve_id:
description: Filters results to vulnerabilities matching the specified Common Vulnerabilities and Exposures (CVE) ID(s). Accepts a maximum of 200 IDs.
type: array
maxItems: 200
items:
type: string
example: CVE-2026-10289
cve_category:
description: "Returns vulnerabilities that match the specified CVE category. For more information about categories, see [Vulnerability Categories](https://docs.tenable.com/vulnerability-management/Content/vulnerability-intelligence/vulnerability-categories.htm) in the *Tenable Vulnerability Management User Guide*. Supported category values are:\n - `cisa known exploitable`—Vulnerabilities that appear in the [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog).\n - `emerging threats`—Vulnerabilities actively monitored by Tenable and that are currently being publicly discussed.\n - `in the news`—Vulnerabilities that are widely reported in the press with notable coverage over the past 30 days.\n - `persistently exploited`—Vulnerabilities leveraged by threat actors over an extended period of time in targeted attacks, ransomware, or malware campaigns.\n - `ransomware`—Vulnerabilities used in current or historical ransomware attacks.\n - `recent active exploitation`—Vulnerabilities for which Tenable has evidence of active exploitation and that have notable coverage in the press over the past 30 days.\n - `top 50 vpr`—Vulnerabilities included in Tenable's top 50 vulnerabilities according to the Vulnerability Priority Rating (VPR). For more information about VPR, see [Vulnerability Priority Rating](https://docs.tenable.com/vulnerability-management/Content/Explore/Findings/RiskMetrics.htm#Vulnerability-Priority-Rating-) in the *Tenable Vulnerability Management User Guide*."
type: array
items:
type: string
cvss4_base_score:
$ref: '#/components/schemas/Export_Vulnerabilities_cvss4_filter'
epss_score:
$ref: '#/components/schemas/Export_Vulnerabilities_epss_filter'
exploit_maturity:
description: "Returns vulnerabilities that match the specified exploit maturity. Tenable assigns exploit maturity values to vulnerabilities based on availability and sophistication of exploit code. Supported values are:\n - `high`—Exploit code is widely available, reliable, and easy to use.\n - `functional`—Exploit code exists but may require some skill.\n - `poc`—Exploit code exists but is not reliable.\n - `unproven`—There is no known exploit code."
type: array
items:
type: string
initiative_id:
type: string
format: uuid
description: "The unique identifier (UUID) of the Exposure Response initiative for which to retrieve associated vulnerabilities. This filter enables scoping results to a specific initiative within the Exposure Response workflow. For more information, see [Exposure Response](https://docs.tenable.com/vulnerability-management/Content/exposure-response/exposure-response-intro.htm) in the _Tenable Vulnerability Management User Guide_. \n\n**Note:** This filter can only be used in combination with one or more of the following filters: `indexed_at`, `since`, `severity`, `state` or `severity_modification_type`."
network_id:
type: string
format: uuid
description: The ID of the network associated with the scanners that detected the vulnerabilities you want to export. The default network ID is `00000000-0000-0000-0000-000000000000`. To determine the ID of a custom network, use the [GET /networks](ref:networks-list) endpoint. For more information about network objects, see [Manage Networks](doc:manage-networks-tio).
plugin_family:
items:
type: string
description: A list of plugin families for which you want to filter the vulnerabilities returned in the vulnerability export. This filter is case-sensitive. If your request omits this parameter, the export includes all vulnerabilities regardless of plugin family. For a list of supported plugin family values, use the [GET /plugins/families](ref:io-plugins-families-list) endpoint.
type: array
plugin_id:
items:
type: integer
description: A list of plugin IDs for which you want to filter the vulnerabilities returned in the vulnerability export. If your request omits this parameter, the export includes all vulnerabilities regardless of plugin ID.
type: array
plugin_type:
description: The plugin type for which you want to filter the vulnerabilities returned in the vulnerability export. For example, `remote`, `local`, `combined`, etc. If your request omits this parameter, the export includes all vulnerabilities regardless of plugin type.
type: string
scan_uuid:
type: string
format: uuid
description: The UUID of the scan that most recently discovered the vulnerabilities to be exported.
severity:
description: "Returns vulnerabilities with the specified severity. Defaults to all severity levels. The severity of a vulnerability is defined using the Common Vulnerability Scoring System (CVSS) base score. Supported array values are:\n - info—The vulnerability has a CVSS score of 0.\n - low—The vulnerability has a CVSS score between 0.1 and 3.9.\n - medium—The vulnerability has a CVSS score between 4.0 and 6.9.\n - high—The vulnerability has a CVSS score between 7.0 and 9.9.\n - critical—The vulnerability has a CVSS score of 10.0."
type: array
items:
type: string
enum:
- info
- low
- medium
- high
- critical
severity_modification_type:
items:
type: string
enum:
- NONE
- RECASTED
- ACCEPTED
description: "Returns vulnerabilities with the specified severity modification type. This filter can be used to return vulnerabilities with a modified severity due to a recast or accept rule. Supported case-sensitive values are:\n - NONE—No modification to the severity has been made.\n - RECASTED—A user has recast the risk associated with the vulnerability.\n - ACCEPTED—A user has accepted the risk associated with the vulnerability."
type: array
software_vulns_potential:
type: boolean
description: 'Filters results based on the confirmation status of the software vulnerabilities. If set to `true`, the export includes only potential vulnerabilities where presence cannot be confirmed with certainty. If set to `false`, the export includes only confirmed vulnerabilities. If omitted, the system includes both types.
**Note:** This parameter cannot be set to `false` when the request includes the `software_vulns_potential_reasons` parameter.'
software_vulns_potential_reasons:
type: array
minItems: 1
items:
type: string
enum:
- Managed
- Component
- Config Required
- Low Fidelity
- Incomplete Version
- Backported
description: 'Filters results to software vulnerabilities classified as potential for the specified reasons. When used without the `software_vulns_potential` parameter, the export includes matching vulnerabilities across both confirmed and potential results. Supported values include `Managed`, `Component`, `Config Required`, `Low Fidelity`, `Incomplete Version`, and `Backported`.
**Note:** This parameter cannot be used if `software_vulns_potential` is set to `false`.'
source:
items:
type: string
description: "Returns vulnerabilities identified by the specified source. A source is the entity that reported the vulnerability details. Sources can include sensors, connectors, and API imports. If your request specifies multiple sources, Tenable Vulnerability Management returns all vulnerabilities seen by any of the specified sources.\n\n The items in the `source` array must correspond to the names of the sources as defined in your organization's implementation of Tenable Vulnerability Management. Commonly used source names include:\n - AGENT—The vulnerability data was obtained from a Tenable Nessus Agent scan.\n - NNM—The vulnerability data was obtained from a Tenable Nessus Network Monitor (NNM) scan.\n - NESSUS—The vulnerability data was obtained from a Tenable Nessus scan."
type: array
state:
description: "Returns vulnerabilities with the specified state. Supported, case-insensitive values are:\n - OPEN—The vulnerability is currently present on a host.\n - REOPENED—The vulnerability was previously marked as fixed on a host but has returned.\n - FIXED—The vulnerability was present on a host but is no longer detected.\n\nThis parameter is required if your request includes `first_found`, `last_found`, or `last_fixed` parameters. If your request omits this parameter, the export includes default states `OPEN` and `REOPENED` only.\n\nNote that the API uses different terms for vulnerability states than the user interface. The `new` and `active` states in the user interface map to the `OPEN` state in the API. The `resurfaced` state in the user interface maps to the `REOPENED` state in the API. The `FIXED` state is the same."
type: array
items:
type: string
enum:
- OPEN
- REOPENED
- FIXED
tag.<category>:
type: array
items:
type: string
description: "Returns vulnerabilities on assets with the specified asset tags. \n\nThe tag filter format is defined as \"tag\", a period (\".\"), and then tag category name. For example, `tag.Location`. You can specify multiple tag categories and multiple tag values. When multiple tag categories are provided, the logical operation applied to the tag categories is an `AND` operation. When multiple tag values are provided, the logical operation applied to the values is an `OR` operation. For examples using the tag filter, see the examples listed in the [Refine Vulnerability Export Requests](doc:refine-vulnerability-export-requests) documentation. \n\n<span style=\"color:red\">**Caution:** Due to the limitations of OpenAPI, this parameter does not work with the \"Try It!\" button in the developer portal. If your request includes this parameter you must replace the `<category>` keyword with your actual tag category and manually run the request. For examples using the tag filter, see the examples listed in the [Refine Vulnerability Export Requests](doc:refine-vulnerability-export-requests) documentation.</span> \n\nFor more information about tags, see the <a href=\"https://docs.tenable.com/vulnerability-management/Content/Settings/Tagging/Tags.htm\" target=\"_blank\">Tags</a> in the Tenable Vulnerability Management User Guide."
vpr_score:
$ref: '#/components/schemas/Export_Vulnerabilities_vpr_filter'
vpr_v2_score:
$ref: '#/components/schemas/Export_Vulnerabilities_vpr_v2_filter'
vpr_threat_intensity:
description: Returns vulnerabilities that match the specified threat intensity. The threat intensity of a vulnerability is based on the number and frequency of recently observed threat events. Supported values include `very high`, `high`, `medium`, `low`, or `very low`.
type: array
items:
type: string
weaponization:
description: "Returns vulnerabilities that match the specified weaponization. Weaponized vulnerabilities are vulnerabilities that are ready for use in a particular type of cyberattack. Supported values are:\n - `apt` (advanced persistent threat)\n - `botnet`\n - `malware` \n - `ransomware`\n - `rootkit`"
type: array
items:
type: string
zero_day:
description: Filters vulnerabilities by zero-day status. If omitted, both zero-day and non–zero-day vulnerabilities are included in the export results. Zero-day vulnerabilities are those for which no official patch or fix was available at the time of disclosure.
type: boolean
responses:
'200':
description: Returned if a vulnerability export request was queued successfully.
content:
application/json:
schema:
type: object
properties:
export_uuid:
type: string
description: The UUID of the vulnerabilities export job.
examples:
response:
value:
export_uuid: bf765455-53aa-4e70-9ef3-87cfca1d2be0
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Vulnerabilities_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to export vulnerabilities.
'409':
description: Returned if your request was a duplicate of an ongoing export that was already submitted. Tenable Vulnerability Management prevents duplicate exports from running concurrently. For example, export requests with the same filters.
content:
application/json:
schema:
type: object
properties:
active_job_id:
type: string
description: The UUID of ongoing vulnerabilities export job that was already submitted.
failure_reason:
type: string
description: A description of the conflict.
examples:
response:
value:
active_job_id: 1f3381e3-a551-4b9b-9c17-b019412cc35c
failure_reason: The request could not be completed due to a conflict with the ongoing export
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting) and [Concurrency Limiting](doc:concurrency-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Vulnerabilities_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- Export_Vulnerabilities_cloud: []
/vulns/export/{export_uuid}/status:
get:
summary: Get vulnerability export status
description: "Returns the status of a vulnerability export request. Tenable Vulnerability Management processes the chunks in parallel so the chunks may not complete in order, and the chunk IDs may not be arranged sequentially in the completed output.\n\n **Note:** Output for an individual plugin is limited to 1,024 KB (1 MB). <div class=\"perms-callout\">Requires the Basic [16] user role or the `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` custom role privilege. See [Roles](doc:roles).</div>"
operationId: exports-vulns-export-status
tags:
- Exports (Vulnerabilities)
parameters:
- description: The UUID for the vulnerabilities export request to retrieve the status for.
required: true
name: export_uuid
in: path
schema:
type: string
description: The unique identifier of an export request. This value corresponds to the value returned in the [/vulns/export](ref:exports-vulns-request-export) response message.
responses:
'200':
description: Returned if the status for the specified vulnerabilities export was retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Vulnerabilities_response-vulns-export-status'
examples:
response:
value:
uuid: 1d896500-2f92-467c-aa4d-6fe8d007b127
status: FINISHED
chunks_available:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
chunks_failed: []
chunks_cancelled: []
total_chunks: 10
chunks_available_count: 10
empty_chunks_count: 0
finished_chunks: 10
filters:
severity:
- CRITICAL
state:
- OPEN
tags:
tag.Location:
- Dallas
since: 0
first_found: 1540350772
last_found: 0
last_fixed: 0
first_seen: 0
last_seen: 0
indexed_at: 0
indexed_at_end_value: 0
cve_id:
- CVE-2025-44228
- CVE-2025-0589
resurfaced_date: 0
cve_category:
- in_the_news
- persistently_exploited
- ransomware
exploit_maturity:
- unproven
- poc
vpr_threat_intensity:
- Low
- Medium
- Very Low
weaponization:
- botnet
- apt
- malware
num_assets_per_chunk: 50
created: 1732582396387
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Vulnerabilities_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to view the vulnerabilities export status.
'404':
description: Returned if Tenable Vulnerability Management could not find the specified vulnerabilities export job.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/Export_Vulnerabilities_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- Export_Vulnerabilities_cloud: []
/vulns/export/status:
get:
summary: List vuln export jobs
description: Retrieves a list of vulnerability export jobs. This list includes the 1,000 most recent export jobs regardless of status. However, this list includes completed jobs only if the job completed in the previous three days. <div class="perms-callout">Requires the Basic [16] user role or the `VM.VM_EXPLORE.VM_EXPLORE.EXPORT` custom role privilege. See [Roles](doc:roles).</div>
operationId: exports-vulns-export-status-recent
tags:
- Exports (Vulnerabilities)
responses:
'200':
description: Returned if the list of vulnerability export jobs was retrieved successfully.
content:
applicati
# --- truncated at 32 KB (132 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-exports-vulnerabilities-api-openapi.yml