Tenable Vulnerability Management API (Nessus)

What authentication does the Tenable Vulnerability Management API use?

The Tenable API uses API key authentication with two headers: X-ApiKeys containing both an accessKey and secretKey in the format 'accessKey={access_key};secretKey={secret_key}'. Through Jentic, both keys are stored encrypted in your Jentic One instance and agents receive properly formatted auth headers without raw keys entering context.

Can I launch a vulnerability scan programmatically with the Tenable API?

Yes. Use POST /scans to create a scan with a template UUID, target list (IPs, hostnames, or CIDR ranges), and optional credentials. Then launch it via POST /scans/{scanId}/launch. Monitor progress with GET /scans/{scanId} until status shows 'completed', then export results via POST /scans/{scanId}/export.

What are the rate limits for the Tenable Vulnerability Management API?

Tenable enforces rate limits based on your license tier. Standard accounts allow approximately 500 requests per minute for most endpoints. Export operations have separate concurrency limits (typically 2-3 concurrent exports). The API returns 429 status codes with Retry-After headers when limits are exceeded.

How do I export vulnerability findings in bulk through Jentic?

Search Jentic for 'export vulnerability scan results', which returns the POST /assets/export and related chunk download operations. Initiate an export with severity filters, poll the status endpoint until complete, then download each chunk sequentially. Install with pip install jentic and run it through Jentic One, the self-hosted execution layer.

Can I manage Nessus agents through the API?

Yes. The agent management endpoints let you list agents, create agent groups, assign agents to groups, and configure scan policies for agent-based scanning. Agent groups are useful for scanning hosts in network segments that lack direct connectivity from the scanner, such as DMZ or air-gapped environments.

Does the API support querying by specific CVE?

Yes. Use the GET /plugins endpoint to search for plugins by CVE ID, which returns the detection plugin details. The workbench endpoints also support filtering scan results by plugin ID or CVE to find all affected assets for a specific vulnerability across your infrastructure.

Can I limit what my agent is allowed to do with the Tenable Nessus API?

Yes. Because you run Jentic One yourself, your own rules decide which Tenable operations and credentials the agent may use. Since the scan id sits in the URL path, such as GET /scans/{scanId} and POST /scans/{scanId}/export, you can pin the agent to a single scan so it reads and exports that scan and nothing else. You pick the operations it may call, so launching new scans via POST /scans stays off unless you grant it.