With the Templates API, you can manage scan and user templates. Use these endpoints to retrieve default settings or create custom templates based on organizational policies. Templates serve as the blueprint for creating new scans. For more information, see [Scan Template Types](https://docs.tenable.com/web-app-scanning/Content/WAS/Scans/ScannerTemplates.htm) in the _Tenable Web App Scanning User Guide_.
openapi: 3.0.0
info:
version: 1.0.0
title: Downloads About Templates API
description: 'The Downloads API enables customers to access and download installation and update files for available Tenable products. You can use the API endpoints to list product pages, list downloads available for a specific product, and to download a file. The endpoints can also be used to determine and download the latest version of a file to facilitate the automation of an installation.
**Note:** The Tenable Downloads API uses a different server URL than the Tenable Vulnerability Management API:
`https://www.tenable.com/downloads/api/v2/pages`.
### Authentication
Like the Downloads website, certain files require authentication to download. When files have a `"requires_auth": true` attribute on the product list page, the Downloads API uses bearer token authentication and requires a valid token in the Authorization header to download the file:
```
Authorization: Bearer AbCdEf123456
```
To access or reset your authentication token, navigate to the [Authentication Token](https://www.tenable.com/downloads/api-docs) page.
Examples of product downloads that **do not** require authentication include Nessus and Nessus Agents.'
servers:
- url: https://www.tenable.com/downloads/api/v2
security:
- Bearer: []
tags:
- name: Templates
description: 'With the Templates API, you can manage scan and user templates. Use these endpoints to retrieve default settings or create custom templates based on organizational policies. Templates serve as the blueprint for creating new scans.
For more information, see [Scan Template Types](https://docs.tenable.com/web-app-scanning/Content/WAS/Scans/ScannerTemplates.htm) in the _Tenable Web App Scanning User Guide_.'
paths:
/was/v2/templates:
get:
summary: List Tenable-provided templates
description: Returns a paginated list of Tenable-provided templates that are available to be used for scan configurations.<div class="perms-callout">Requires the Standard [32] user role or the `WAS.SCAN_WAS_SYSTEM_TEMPLATE.USE` custom role privilege. See [Roles](doc:roles).</div>
operationId: was-v2-templates-list
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/offset'
- $ref: '#/components/parameters/sort'
tags:
- Templates
responses:
'200':
description: Returned if the list of Tenable-provided templates was retrieved successfully.
content:
application/json:
schema:
type: object
required:
- pagination
- items
properties:
pagination:
$ref: '#/components/schemas/PaginationResponse'
items:
type: array
description: A list of Tenable-provided templates.
items:
$ref: '#/components/schemas/ConfigTemplate'
examples:
response:
value:
pagination:
total: 2
offset: 0
limit: 2
sort:
- name: name
order: asc
items:
- template_id: 1ead655c-6638-4075-81c7-7f288e1203bd
name: api
description: A scan that checks an API for vulnerabilities.
plugin_state: open
scanner_types:
- scanner
- container_group
- cloud_group
settings:
timeout: 08:00:00
debug_mode: false
scope:
exclude_path_patterns: []
page_limit: 100
option: null
urls: null
exclude_file_extensions: null
dom_depth_limit: null
directory_depth_limit: null
crawl_script: null
exclude_binaries: null
auto_redundant_paths: null
decompose_paths: null
openapi_file: null
openapi_filename: null
openapi_file_url: null
graphql_file: null
graphql_filename: null
graphql_file_url: null
graphql_introspection: null
soap_file: null
soap_filename: null
soap_file_url: null
crawl_script_filename: null
browser:
analysis: false
screen_width: null
screen_height: null
ignore_images: null
job_timeout: null
pool_size: null
http:
response_max_size: 500000
request_redirect_limit: null
user_agent: WAS/%v
custom_user_agent: false
request_concurrency: 10
request_timeout: 5
request_headers:
Accept: '*/*'
Accept-Language: en-US,en;q=0.5
include_scan_id: false
chrome:
script_finish_wait: null
script_page_load_wait: null
script_command_wait: null
disable_web_security: false
assessment:
enable: true
rfi_remote_url: http://rfi.nessus.org/rfi.txt
element_exclusions: null
dictionary: null
fingerprinting: true
audit:
xmls: true
forms: null
jsons: true
links: true
cookies: true
headers: true
ui_forms: null
ui_inputs: null
parameter_names: false
parameter_values: true
path_parameters: true
plugin:
rate_limiter:
requests_per_second: 25
autothrottle: true
timeout_threshold: 100
defaults:
timeout: 08:00:00
debug_mode: false
scope:
exclude_path_patterns: []
page_limit: 100
option: null
urls: null
exclude_file_extensions: null
dom_depth_limit: null
directory_depth_limit: null
crawl_script: null
exclude_binaries: null
auto_redundant_paths: null
decompose_paths: null
openapi_file: null
openapi_filename: null
openapi_file_url: null
graphql_file: null
graphql_filename: null
graphql_file_url: null
graphql_introspection: null
soap_file: null
soap_filename: null
soap_file_url: null
crawl_script_filename: null
browser:
analysis: false
screen_width: null
screen_height: null
ignore_images: null
job_timeout: null
pool_size: null
http:
response_max_size: 500000
request_redirect_limit: null
user_agent: WAS/%v
custom_user_agent: false
request_concurrency: 10
request_timeout: 5
request_headers:
Accept: '*/*'
Accept-Language: en-US,en;q=0.5
include_scan_id: false
chrome:
script_finish_wait: null
script_page_load_wait: null
script_command_wait: null
disable_web_security: false
assessment:
enable: true
rfi_remote_url: http://rfi.nessus.org/rfi.txt
element_exclusions: null
dictionary: null
fingerprinting: true
audit:
xmls: true
forms: null
jsons: true
links: true
cookies: true
headers: true
ui_forms: null
ui_inputs: null
parameter_names: false
parameter_values: true
path_parameters: true
plugin:
rate_limiter:
requests_per_second: 25
autothrottle: true
timeout_threshold: 100
plugins:
- plugin_id: 112315
name: Apache Tomcat 7.0.23 < 7.0.91 Open Redirect
family: Component Vulnerability
policy:
- pci
- scan
- api
'400':
description: Returned if your request specifies invalid parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/was/v2/templates/{template_id}:
get:
tags:
- Templates
summary: Get Tenable-provided template details
description: Returns the details for a Tenable-provided template. Tenable-provided templates can be used to define scan configurations.<div class="perms-callout">Requires the Standard [32] user role or the `WAS.SCAN_WAS_SYSTEM_TEMPLATE.USE` custom role privilege. See [Roles](doc:roles).</div>
operationId: was-v2-templates-details
parameters:
- in: path
name: template_id
required: true
description: The UUID of the Tenable-provided template resource.
schema:
type: string
format: uuid
responses:
'200':
description: Returned if the details for the specified Tenable-provided template were retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/ConfigTemplate'
examples:
response:
value:
template_id: d5b3cb1c-9c72-4974-a936-3dfbd2e2835e
name: config_audit
description: An audit of web application compliance with configuration security guidelines.
plugin_state: locked
scanner_types:
- scanner
- container_group
- cloud_group
settings:
timeout: null
debug_mode: null
input_force: null
scope:
option: paths
urls: null
exclude_file_extensions: null
exclude_path_patterns: null
dom_depth_limit: 1
directory_depth_limit: null
page_limit: 1
crawl_script: null
decompose_paths: null
exclude_binaries: true
auto_redundant_paths: 1
plugin: null
browser:
screen_width: null
screen_height: null
ignore_images: null
job_timeout: null
analysis: false
pool_size: 1
http: null
chrome_script: null
assessment:
rfi_remote_url: null
element_exclusions: null
dictionary: null
fingerprinting: null
enable: true
audit:
forms: false
cookies: false
ui_forms: false
ui_inputs: false
headers: false
links: false
parameter_names: false
parameter_values: false
jsons: false
xmls: false
cookies_extensively: null
with_raw_payloads: false
with_both_http_methods: false
with_extra_parameter: false
defaults:
timeout: 00:10:00
debug_mode: null
input_force: null
scope:
option: paths
urls: null
exclude_file_extensions: null
exclude_path_patterns: null
dom_depth_limit: 1
directory_depth_limit: null
page_limit: 1
crawl_script: null
decompose_paths: null
exclude_binaries: true
auto_redundant_paths: 1
plugin: null
browser:
screen_width: null
screen_height: null
ignore_images: null
job_timeout: null
analysis: false
pool_size: 1
http:
response_max_size: null
request_redirect_limit: null
user_agent: WAS/%v
custom_user_agent: false
request_headers:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
request_concurrency: null
request_timeout: null
chrome_script: null
assessment:
rfi_remote_url: null
element_exclusions: null
dictionary: null
fingerprinting: null
enable: true
audit:
forms: false
cookies: false
ui_forms: false
ui_inputs: false
headers: false
links: false
parameter_names: false
parameter_values: false
jsons: false
xmls: false
cookies_extensively: null
with_raw_payloads: false
with_both_http_methods: false
with_extra_parameter: false
plugins:
- plugin_id: 115491
name: SSL/TLS Cipher Suites Supported
family: SSL/TLS
- plugin_id: 98056
name: Missing HTTP Strict Transport Security Policy
family: HTTP Security Header
- plugin_id: 112496
name: TLS 1.0 Weak Protocol
family: SSL/TLS
- plugin_id: 112544
name: HTTP to HTTPS Redirect Not Enabled
family: SSL/TLS
- plugin_id: 112555
name: Report Only Content Security Policy Detected
family: HTTP Security Header
- plugin_id: 98612
name: Missing 'Expect-CT' Header
family: HTTP Security Header
- plugin_id: 112553
name: Missing 'Cache-Control' Header
family: HTTP Security Header
- plugin_id: 112527
name: Disabled 'X-XSS-Protection' Header
family: HTTP Security Header
- plugin_id: 98062
name: Cookie set for parent domain
family: Web Applications
- plugin_id: 112495
name: SSL/TLS Self-Signed Certificate
family: SSL/TLS
- plugin_id: 98618
name: HTTP Header Information Disclosure
family: HTTP Security Header
- plugin_id: 112526
name: Missing 'X-XSS-Protection' Header
family: HTTP Security Header
- plugin_id: 112537
name: SSL/TLS Null Cipher Suites Supported
family: SSL/TLS
- plugin_id: 98617
name: SSL/TLS Forward Secrecy Cipher Suites Not Supported
family: SSL/TLS
- plugin_id: 112542
name: SSL/TLS Certificate Signed Using Weak Hashing Algorithm
family: SSL/TLS
- plugin_id: 112546
name: TLS 1.1 Deprecated Protocol
family: SSL/TLS
- plugin_id: 112493
name: SSL/TLS Certificate Expired
family: SSL/TLS
- plugin_id: 112554
name: Permissive Content Security Policy Detected
family: HTTP Security Header
- plugin_id: 112551
name: Missing Content Security Policy
family: HTTP Security Header
- plugin_id: 98715
name: Permissive HTTP Strict Transport Security Policy Detected
family: HTTP Security Header
- plugin_id: 98648
name: Missing 'Content-Type' Header
family: HTTP Security Header
- plugin_id: 98527
name: Missing Referrer Policy
family: HTTP Security Header
- plugin_id: 98526
name: Missing Feature Policy
family: HTTP Security Header
- plugin_id: 112541
name: SSL/TLS Certificate Common Name Mismatch
family: SSL/TLS
- plugin_id: 115540
name: Cookie Without SameSite Flag Detected
family: Web Applications
- plugin_id: 98057
name: Insecure 'Access-Control-Allow-Origin' header
family: HTTP Security Header
- plugin_id: 98616
name: TLS 1.2 Not Supported Protocol
family: SSL/TLS
- plugin_id: 112539
name: SSL/TLS Weak Cipher Suites Supported
family: SSL/TLS
- plugin_id: 112538
name: SSL/TLS Insecure Cipher Suites Supported
family: SSL/TLS
- plugin_id: 98091
name: Mixed Resource Detection
family: Web Applications
- plugin_id: 112552
name: Deprecated Content Security Policy
family: HTTP Security Header
- plugin_id: 112530
name: SSL/TLS Versions Supported
family: SSL/TLS
- plugin_id: 112491
name: SSL/TLS Certificate Information
family: SSL/TLS
- plugin_id: 112536
name: SSL/TLS Anonymous Cipher Suites Supported
family: SSL/TLS
- plugin_id: 112529
name: Missing 'X-Content-Type-Options' Header
family: HTTP Security Header
- plugin_id: 112494
name: SSL Insecure Protocols
family: SSL/TLS
- plugin_id: 98063
name: Cookie Without HttpOnly Flag Detected
family: Web Applications
- plugin_id: 112540
name: SSL/TLS Certificate RSA Keys Less Than 2048 bits
family: SSL/TLS
- plugin_id: 112543
name: HTTPS Not Detected
family: SSL/TLS
- plugin_id: 98060
name: Missing 'X-Frame-Options' Header
family: HTTP Security Header
- plugin_id: 98064
name: Cookie Without Secure Flag Detected
family: Web Applications
'400':
description: Returned if your request specifies an invalid template UUID.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
reasons:
- code: INVALID_ID_FORMAT
reason: The provided ID of '10-ABC' must be UUID type
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'404':
description: Returned if Tenable Web App Scanning cannot find the specified template.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
reasons:
- code: NOT_FOUND
reason: Resource with id 'f93dfcb4-6eb2-4820-9b64-3dee8893a3f0' not found
'429':
description: Returned if you attempt to send too many requests in a specific period of time. For more information, see [Rate Limiting](doc:rate-limiting).
content:
text/html:
examples:
response:
value: "<html>\n\n<head>\n <title>429 Too Many Requests</title>\n</head>\n\n<body bgcolor=\"white\">\n <center>\n <h1>429 Too Many Requests</h1>\n </center>\n <hr>\n <center>nginx</center>\n</body>\n\n</html>"
'500':
description: Returned if an internal error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 500
error: Internal Server Error
message: An internal server error occurred. Please wait a moment and try your request again.
/was/v2/user-templates/search:
post:
summary: Search user-defined templates
description: Returns a paginated list of user-defined templates that are available to be used for scan configurations.<div class="perms-callout">Requires either the Scan Operator [24] user role, the `WAS.SCAN_WAS.MANAGE` custom role privilege, or the `WAS.SCAN_WAS_USER_TEMPLATE.READ` custom role privilege. Additionally, requires the Can View [16] scan template (policy) permission. See [Roles](doc:roles) and [Permissions](doc:permissions).</div>
operationId: was-v2-user-templates-search
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/offset'
- $ref: '#/components/parameters/sort'
requestBody:
required: true
content:
application/json:
schema:
oneOf:
- title: Single Filter
$ref: '#/components/schemas/AppliedFilters-UserTemplates'
- title: Multiple Filters
type: object
properties:
AND:
type: array
description: An array of filters that must all be satisfied.
items:
$ref: '#/components/schemas/AppliedFilters-UserTemplates'
OR:
type: array
description: An array of filters where at least one must be satisfied.
items:
$ref: '#/components/schemas/AppliedFilters-UserTemplates'
tags:
- Templates
responses:
'200':
description: Returns a list of user-defined templates.
content:
application/json:
schema:
type: object
required:
- pagination
- items
properties:
pagination:
$ref: '#/components/schemas/PaginationResponse'
items:
type: array
description: The list of user-defined templates.
items:
$ref: '#/components/schemas/UserTemplate'
examples:
response:
value:
pagination:
total: 90
offset: 0
limit: 4
sort:
- name: name
order: asc
- name: created_at
order: desc
- name: updated_at
order: desc
items:
- user_template_id: 0c539366-172d-49bd-9c3d-90a9947ea48e
template_id: f93dfcb4-6eb2-4820-9b64-3dee8893a3f0
created_at: '2020-06-11T15:07:41Z'
updated_at: '2020-08-04T13:54:41.726Z'
name: A1_WAS_scan
description: null
owner_id: ef22f2bf-db1b-4471-984f-9507dcc083e1
container_id: 9f084368-f11e-4d69-be63-df5e2a0b2635
default_permissions: no_access
results_visibility: dashboard
permissions: []
user_permissions: configure
is_shared: false
- user_template_id: bb0e52de-99e5-45f3-bd3c-25ddb8e43f48
template_id: f93dfcb4-6eb2-4820-9b64-3dee8893a3f0
created_at: '2020-08-06T12:58:14.027Z'
updated_at: '2020-08-06T12:58:14.027Z'
name: another template
description: things
owner_id: 01c924ee-e6ab-4d55-b283-dffba6dcce4c
container_id: 9f084368-f11e-4d69-be63-df5e2a0b2635
default_permissions: no_access
results_visibility: dashboard
permissions: []
user_permissions: configure
is_shared: false
- user_template_id: e9911b2e-1e8c-4c47-a4f5-a20b650250fa
template_id: f93dfcb4-6eb2-4820-9b64-3dee8893a3f0
created_at: '2020-08-06T13:43:09.815Z'
updated_at: '2020-08-06T13:43:09.815Z'
name: a whole new template
description: null
owner_id: 01c924ee-e6ab-4d55-b283-dffba6dcce4c
container_id: 9f084368-f11e-4d69-be63-df5e2a0b2635
default_permissions: no_access
results_visibility: dashboard
permissions: []
user_permissions: configure
is_shared: false
- user_template_id: 2cb41447-4fe2-426c-8e43-454cf8f53f49
template_id: f93dfcb4-6eb2-4820-9b64-3dee8893a3f0
created_at: '2020-06-23T11:29:43.718Z'
updated_at: '2020-07-27T20:18:28.369Z'
name: blabla - mode
description: null
owner_id: 01c924ee-e6ab-4d55-b283-dffba6dcce4c
container_id: 9f084368-f11e-4d69-be63-df5e2a0b2635
default_permissions: no_access
results_visibility: dashboard
permissions:
- entity: user
entity_id: eb2b3caa-536f-421a-9aa4-c833677a6e9b
level: configure
user_permissions: configure
is_shared: true
'401':
description: Returned if the API keys specified in your request are invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
response:
value:
statusCode: 401
error: Unauthorized
message: Invalid credentials.
'429':
d
# --- truncated at 32 KB (79 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/tenable/refs/heads/main/openapi/tenable-templates-api-openapi.yml