Tenable Recast Rules API
The Recast Rules API from Tenable — 4 operation(s) for recast rules.
OpenAPI Specification
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Recast Rules API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Recast Rules
x-displayName: Recast Rules
paths:
/v1/recast/rules:
post:
summary: Create recast rule
description: 'Creates a new recast or accept rule. <div class="perms-callout">Requires the Administrator [64] user role or one of the following custom role privileges: `VM.VM_RECAST.VM_RECAST.CREATE` for Vulnerability Management or `WAS.RECAST_RULE.MANAGE` for Web App Scanning. See [Roles](doc:roles).</div>'
operationId: recast-rules-create
tags:
- Recast Rules
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_Request-Create-Recast-Rule'
examples:
request:
value:
rule_name: R1-CVE-2015-9876
description: description1
rule_value:
action: RECAST
severity: '1'
original_severity: '0'
resource_type: HOST
filter:
and:
- property: asset.name
operator: eq
value:
- win-2ovr3hh18lv
- property: definition.cve
operator: eq
value:
- CVE-2015-9876
expires_at: '2025-11-15T23:42:45Z'
responses:
'200':
description: Returned if the recast rule was created successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_Rule-Object'
examples:
response:
value:
rule_value:
action: RECAST
false_positive: false
severity: LOW
original_severity: MEDIUM
rule_name: test1
description: description1
rule_id: 810207f8-a9de-4bc8-8b7c-3f149b12ec94
container_id: 1cb2b875-1dc7-4fdc-98ef-527b41be853c
created_by: f9975077-7f1e-4be4-b2e4-e1171d17af1a
created_at: '2025-08-26T19:11:32.052550334Z'
expires_at: '2025-11-15T23:42:45Z'
resource_type: HOST
filter:
and:
- property: asset.name
operator: eq
value:
- win-2ovr3hh18lv
- property: definition.id
operator: eq
value: '10114'
- property: port
operator: eq
value: 8080
- property: definition.cve
operator: eq
value:
- CVE-2015-9876
disabled_details:
disabled: false
'400':
description: Returned if your request specified invalid parameters, if your request was improperly formatted, or if you attempted to create a duplicate rule.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to create recast rules.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- recast-rules_cloud: []
/v1/recast/rules/search:
post:
summary: Search recast rules
description: 'Searches for rules that match the requested criteria.<div class="perms-callout">Requires the Administrator [64] user role or one of the following custom role privileges: `VM.VM_RECAST.VM_RECAST.READ` for Vulnerability Management or `WAS.RECAST_RULE.READ` for Web App Scanning. See [Roles](doc:roles).</div>'
operationId: recast-rules-search
tags:
- Recast Rules
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
resource_type:
description: The type of findings targeted by the recast rules to search for. Supported values are `HOST`, `HOST_AUDIT`, and `WEBAPP`.
type: array
items:
type: string
enum:
- HOST
- HOST_AUDIT
- WEBAPP
filter:
$ref: '#/components/schemas/recast-rules_recastFilter'
limit:
type: integer
minimum: 1
maximum: 500
default: 100
description: The number of records to retrieve. If this parameter is omitted, Tenable uses the default value of `100`. The minimum value is `1`, and the maximum value is `500`.
sort:
description: The property you want to use to sort the results by along with the sort order.
type: array
items:
$ref: '#/components/schemas/recast-rules_recastSortObject'
next:
type: string
description: Specifies the token used to retrieve the next page of results for cursor-based pagination. For the initial request, omit this parameter or set it to `null` to return the first page. For subsequent requests, set this parameter to the exact string value returned in the `next` response property of the previous page. If the `next` response property evaluates to `null`, no additional pages are available.
examples:
request:
value:
limit: 200
filter:
and:
- property: original_severity
operator: eq
value:
- CRITICAL
resource_type:
- HOST
sort:
- property: severity
order: asc
responses:
'200':
description: Returned if the search results were retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_Response-Recast-Search'
examples:
response:
value:
rules:
- rule_value:
action: RECAST
false_positive: false
severity: MEDIUM
original_severity: HIGH
rule_name: 'Recast - Plugin ID: 123642 - Created: 2023-03-14'
rule_id: df57ac2f-c6f9-4107-a78e-1165af4396e6
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
updated_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
created_at: '2023-03-14T08:17:48Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2025-03-03T14:18:07.627099Z'
last_processed_at: '2025-06-04T13:42:28.378701Z'
resource_type: HOST
filter:
and:
- value: '123642'
operator: eq
property: definition.id
disabled_details:
disabled: false
- rule_value:
action: RECAST
false_positive: false
severity: LOW
original_severity: HIGH
rule_name: 'Recast - Plugin ID: 123444 - Created: 2023-03-14'
rule_id: 3f328986-a1f6-47a2-8234-868af9c376dc
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
updated_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
created_at: '2023-03-14T09:00:27Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2025-03-03T14:18:07.614102Z'
last_processed_at: '2025-06-04T13:42:28.486107Z'
resource_type: HOST
filter:
and:
- or:
- value:
- 198.51.100.1-198.51.100.255
operator: eq
property: asset.ipv4_addresses
- value:
- thishouse.com
operator: eq
property: asset.name
- value:
- 2001:db8::/32
operator: eq
property: asset.ipv6_addresses
- value: '123444'
operator: eq
property: definition.id
disabled_details:
disabled: false
- rule_value:
action: RECAST
false_positive: false
severity: LOW
original_severity: MEDIUM
rule_name: 'Recast - Plugin ID: 111222 - Created: 2023-03-14'
rule_id: c431172a-3543-44f5-8fe8-6ff7bbb5cfdb
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
updated_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
created_at: '2023-03-14T09:33:50Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2025-03-03T14:18:07.620698Z'
last_processed_at: '2025-06-04T13:42:28.331125Z'
resource_type: HOST
filter:
and:
- or:
- value:
- 0.0.0.0-255.255.255.255
operator: eq
property: asset.ipv4_addresses
- value: '111222'
operator: eq
property: definition.id
disabled_details:
disabled: false
- rule_value:
action: CHANGE_RESULT
comment: Added a comment
false_positive: false
compliance_result: WARNING
rule_name: 'Recast - Audit File: Check 98 - Created: 2023-04-07'
rule_id: bd4edc0c-cfc7-4abb-bae1-3c7e726a1521
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
updated_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
created_at: '2023-04-07T08:10:53.384754Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2023-04-07T10:36:12.540366Z'
last_processed_at: '2025-06-04T10:12:27.405400Z'
resource_type: HOST_AUDIT
filter:
and:
- value: faker.audit 98
operator: eq
property: compliance.audit_file
- value: Check 98
operator: eq
property: compliance.audit_name
- value: FAILED
operator: eq
property: original_compliance_result
disabled_details:
disabled: true
disabled_at: '2025-11-13T16:37:19.712092Z'
disabled_by: 179e0893-e9cd-481a-993c-df973235bdfa
- rule_value:
action: CHANGE_RESULT
false_positive: false
compliance_result: WARNING
rule_name: 'Recast - Audit File: Check 97 - Created: 2023-04-11'
rule_id: 63d87097-976a-4761-b139-9689c16c0963
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
updated_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
created_at: '2023-04-11T09:11:46.610317Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2023-04-11T09:11:46.612425Z'
last_processed_at: '2025-06-04T13:42:42.148130Z'
resource_type: HOST_AUDIT
filter:
and:
- value: faker.audit 97
operator: eq
property: compliance.audit_file
- value: Check 97
operator: eq
property: compliance.audit_name
- value: FAILED
operator: eq
property: original_compliance_result
disabled_details:
disabled: true
disabled_at: '2025-11-14T23:42:45Z'
disabled_reason: Rule Expiration
- rule_value:
action: CHANGE_RESULT
false_positive: false
compliance_result: WARNING
rule_name: 'Recast - Audit File: Check 96 - Created: 2023-04-11'
rule_id: d75b76a3-3af2-4f0d-8cec-d7fb43bd9a87
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
updated_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
created_at: '2023-04-11T14:35:55.974315Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2023-04-11T14:35:55.975352Z'
last_processed_at: '2025-06-04T13:42:42.107976Z'
resource_type: HOST_AUDIT
filter:
and:
- value: faker.audit 96
operator: eq
property: compliance.audit_file
- value: Check 96
operator: eq
property: compliance.audit_name
- value: FAILED
operator: eq
property: original_compliance_result
disabled_details:
disabled: true
disabled_at: '2025-11-13T16:37:19.712092Z'
disabled_by: 179e0893-e9cd-481a-993c-df973235bdfa
- rule_value:
action: CHANGE_RESULT
comment: ''
false_positive: false
compliance_result: WARNING
rule_name: 'Recast - Audit File: Check 95 - Created: 2023-04-12'
rule_id: a0307b59-b4dd-49a8-a306-6de60636ed3d
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
updated_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
created_at: '2023-04-12T18:04:50.533164Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2023-04-12T18:04:50.535297Z'
last_processed_at: '2025-06-04T13:42:42.133781Z'
resource_type: HOST_AUDIT
filter:
and:
- value: faker.audit 95
operator: eq
property: compliance.audit_file
- value: Check 95
operator: eq
property: compliance.audit_name
- value: FAILED
operator: eq
property: original_compliance_result
- or:
- value:
- 198.51.100.0/24
operator: eq
property: asset.ipv4_addresses
disabled_details:
disabled: true
disabled_at: '2025-11-13T16:37:19.712092Z'
disabled_by: 179e0893-e9cd-481a-993c-df973235bdfa
- rule_value:
action: CHANGE_RESULT
false_positive: false
compliance_result: WARNING
rule_name: 'Recast - Audit File: Check 94 - Created: 2023-04-13'
rule_id: 5d19a27e-b088-449f-99b0-60293ea7ba55
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
updated_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
created_at: '2023-04-13T10:17:18.082494Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2023-04-13T10:23:28.149125Z'
last_processed_at: '2025-06-04T13:42:43.521235Z'
resource_type: HOST_AUDIT
filter:
and:
- value: faker.audit 94
operator: eq
property: compliance.audit_file
- value: Check 94
operator: eq
property: compliance.audit_name
- or:
- value:
- a.example.com
- b.example.com
- c.example.com
- d.example.com
- e.example.com
operator: match
property: asset.fqdns
- value:
- 198.51.100.0
- 198.51.100.2
- 198.51.100.3
- 198.51.100.4
- 198.51.100.5
- 198.51.100.6
- 198.51.100.7
- 198.51.100.8
- 198.51.100.9
operator: eq
property: asset.ipv4_addresses
disabled_details:
disabled: true
disabled_at: '2025-11-13T16:37:19.712092Z'
disabled_by: 179e0893-e9cd-481a-993c-df973235bdfa
- rule_value:
action: CHANGE_RESULT
false_positive: false
compliance_result: WARNING
rule_name: 'Recast - Audit File: Check 93 - Created: 2023-04-13'
rule_id: 59c0d8e6-15b5-4d36-be76-1dec91abef09
container_id: 3336dfd2-2473-49f3-b405-b91bdd57bf00
created_by: d907f7f7-f3e9-4005-966e-691145f3df2f
updated_by: d907f7f7-f3e9-4005-966e-691145f3df2f
created_at: '2023-04-13T12:15:27.933565Z'
expires_at: '2025-11-15T23:42:45Z'
updated_at: '2023-04-13T12:15:27.934626Z'
last_processed_at: '2025-06-04T13:42:42.203791Z'
resource_type: HOST_AUDIT
filter:
and:
- value: faker.audit 93
operator: eq
property: compliance.audit_file
- value: Check 93
operator: eq
property: compliance.audit_name
- or:
- value:
- a.example.com
- b.example.com
- c.example.com
- d.example.com
- e.example.com
operator: match
property: asset.fqdns
- value:
- 198.51.100.0
- 198.51.100.2
- 198.51.100.3
- 198.51.100.4
- 198.51.100.5
- 198.51.100.6
- 198.51.100.7
- 198.51.100.8
- 198.51.100.9
operator: eq
property: asset.ipv4_addresses
disabled_details:
disabled: true
disabled_at: '2025-11-13T16:37:19.712092Z'
disabled_by: 179e0893-e9cd-481a-993c-df973235bdfa
pagination:
limit: 9
next: eyJsaW1pdCI6MiwibmV4dCI6Ik1nPT0iLCJyZXNvdXJjZV90eXBlIjpbXSwiaW5jbHVkZV9tZXRhZGF0YSI6dHJ1ZX0=
total: 39
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permission to search recast rules.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- recast-rules_cloud: []
/v1/recast/rules/{rule_id}:
get:
summary: Get recast rule details
description: 'Returns the details of the specified recast or accept rule. <div class="perms-callout">Requires the Administrator [64] user role or one of the following custom role privileges: `VM.VM_RECAST.VM_RECAST.READ` for Vulnerability Management or `WAS.RECAST_RULE.READ` for Web App Scanning. See [Roles](doc:roles).</div>'
operationId: recast-rules-details
tags:
- Recast Rules
parameters:
- description: The UUID of the recast rule to return details for.
required: true
name: rule_id
in: path
schema:
type: string
responses:
'200':
description: Returned if the details for the specified recast rule were retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_Rule-Object'
examples:
response:
value:
rule_value:
action: RECAST
false_positive: false
severity: LOW
original_severity: MEDIUM
rule_name: test1
rule_id: 810207f8-a9de-4bc8-8b7c-3f149b12ec94
container_id: 1cb2b875-1dc7-4fdc-98ef-527b41be853c
created_by: f9975077-7f1e-4be4-b2e4-e1171d17af1a
created_at: '2025-08-26T19:11:32.052550334Z'
resource_type: HOST
filter:
and:
- property: asset.name
operator: eq
value:
- win-2ovr3hh18lv
- property: definition.id
operator: eq
value: '10114'
- property: port
operator: eq
value: 8080
- property: definition.cve
operator: eq
value:
- CVE-2015-9876
disabled_details:
disabled: true
disabled_at: '2025-11-19T00:06:00.518673Z'
disabled_by: 5aeac72a-1635-4138-b13d-7dc0512e604c
disabled_reason: Temporarily disabled
'400':
description: Returned if your request specified invalid parameters or if your request was improperly formatted.
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'403':
description: Returned if you do not have permissions to retrieve recast rule details.
'404':
description: Returned if the specified recast rule was not found.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
security:
- recast-rules_cloud: []
put:
summary: Update recast rule
description: 'Updates the specified recast or accept rule with the specified criteria. <div class="perms-callout">Requires the Administrator [64] user role or one of the following custom role privileges: `VM.VM_RECAST.VM_RECAST.EDIT` for Vulnerability Management or `WAS.RECAST_RULE.MANAGE` for Web App Scanning. See [Roles](doc:roles).</div>'
operationId: recast-rules-update
tags:
- Recast Rules
parameters:
- description: The UUID of the recast rule.
required: true
name: rule_id
in: path
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_Request-Create-Recast-Rule'
examples:
request:
value:
rule_name: R1-CVE-2015-9876
description: description1
rule_value:
action: RECAST
severity: '1'
original_severity: '0'
resource_type: HOST
filter:
and:
- property: asset.name
operator: eq
value:
- win-2ovr3hh18lv
- property: definition.cve
operator: eq
value:
- CVE-2015-9876
expires_at: '2025-11-15T23:42:45Z'
disabled_details:
disabled: true
responses:
'200':
description: Returned if the specified recast rule was updated successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/recast-rules_Rule-Object'
examples:
# --- truncated at 32 KB (83 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-recast-rules-api-openapi.yml