Tenable APIs for AI Agents
Identity AuthAuthenticationVulnerability ManagementMixed ProvenanceAPI keyAgent Ready
For Agents
APIs4 in catalogue
Endpoints332 indexed
AuthAPI key — 1 credential for all 4 APIs
ProvenanceMixed provenance
An agent can launch vulnerability scans, export findings and asset inventories, inspect Active Directory objects and identity exposure deviances, export externally discovered assets, and administer managed customer accounts across Tenable's security surface. It ties infrastructure scanning, identity posture, external attack surface, and multi-tenant account management into a single credentialed workflow.
Tenable spans four distinct security surfaces from one vendor: network and infrastructure vulnerability scanning, Active Directory identity exposure, external attack surface discovery, and MSSP multi-account administration. An agent can move from finding an exposed asset to scanning it for vulnerabilities to checking related identity risk without leaving the vendor.
Use for: Vulnerability scanning, Active Directory identity exposure analysis, external attack surface asset discovery, and MSSP multi-account administration across Tenable's security products
Not supported: endpoint detection response, SIEM correlation, application code analysis, payment processing, customer messaging
Credentials: All four Tenable APIs authenticate with an API key, though the header and key format vary by product (an access-key-plus-secret-key pair for the Vulnerability Management and MSSP Portal APIs, and single-header keys for Identity Exposure and Attack Surface Management), so a single credential does not cover every API.
Across 4 Tenable APIs: 3 vendor-official, 1 Jentic-generated, all indexed by Jentic and kept validated and agent-ready.
Tenable is a cybersecurity vendor whose APIs cover network vulnerability scanning, Active Directory exposure analysis, external attack surface discovery, and multi-account managed service provider administration. Its four APIs let agents launch and export vulnerability scans across infrastructure, read the state of Active Directory objects and detected deviances, export discovered external assets, and manage customer accounts within an MSSP portal, all over a common API key model.
Tenable API Catalog
4 APIs across 4 product groups. All share one credential.
Developer Tools1
E Commerce1
Which Tenable API should I use?
| I want to... | Use |
|---|---|
| Find and export externally exposed internet-facing assets | Attack Surface Management |
| Scan discovered infrastructure for vulnerabilities and export findings | Tenable Vulnerability Management API (Nessus) |
| Assess Active Directory identity exposure and object-level deviances | Identity Exposure |
| Administer multiple customer instances as a managed service provider | MSSP Portal |
Install Jentic One Beta
Connect the Tenable APIs to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Tenable APIs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Ftenable.com" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Ftenable.com" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Once connected, ask your agent something like: “scan and manage security exposure across Tenable assets, identities, and accounts”.
What AI Agents Can Do with Tenable
Each workflow spans multiple Tenable APIs. Jentic routes each operation to the right API automatically.
Discover an exposed asset then scan it for vulnerabilities
An agent exports externally discovered assets from Attack Surface Management, then launches a vulnerability scan against those hosts with the Nessus API and exports the severity-scored findings.
Example prompt:
Export the asset list via POST /assets/export/json on Attack Surface Management, then launch a scan against those hosts via POST /scans on the Nessus API and export critical findings
APIs used
Attack Surface Management + Tenable Vulnerability Management API (Nessus)
Correlate infrastructure vulnerabilities with identity exposure
An agent exports critical vulnerability findings from the Nessus API and reads the state of related Active Directory objects and their deviances from Identity Exposure to judge combined risk.
Example prompt:
Export critical findings via POST /vulns/export on the Nessus API, then read affected AD objects and deviances via GET /api/ad-objects on Identity Exposure
APIs used
Tenable Vulnerability Management API (Nessus) + Identity Exposure
Roll out security scanning across managed customer accounts
An MSSP agent lists managed child accounts from the MSSP Portal, then launches vulnerability scans per account with the Nessus API and exports the results for each tenant.
Example prompt:
List child accounts via GET /mssp/accounts on the MSSP Portal, then for each account launch a scan via POST /scans on the Nessus API and export the results
APIs used
MSSP Portal + Tenable Vulnerability Management API (Nessus)
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Instead of wiring four Tenable APIs by hand, each with its own host and API key header format, you install Jentic One once and your agent finds and adds the Tenable APIs it needs from the Jentic directory. You store each API key once and the agent calls the operations.
Permission scoping
Your own rules in your Jentic One instance decide which Tenable operations the agent may call. You can pin an agent to read-only scan exports or a single managed account, so higher-risk operations like launching new scans or creating evaluation accounts are excluded unless you add them.
Credential isolation
Each Tenable credential, whether a single API key or an access-key-plus-secret-key pair, is stored encrypted by your own self-hosted Jentic One instance and injected at execution time. Raw keys never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search the Jentic directory by intent, such as 'export exposed assets' or 'scan hosts for vulnerabilities', and Jentic returns the matching Tenable operation with its input schema so the agent calls the right endpoint across the four APIs without browsing reference docs.
FAQs
Specific to using Tenable APIs through Jentic.
What can an agent do across Tenable's APIs?
An agent can discover externally exposed assets, launch and export vulnerability scans against infrastructure, read Active Directory identity exposure and detected deviances, and administer multiple managed customer accounts. Together these cover external attack surface, infrastructure risk, identity posture, and multi-tenant account management.
Do these Tenable APIs share one credential?
No. Every Tenable API uses API key authentication, but the header and key format differ by product. The Vulnerability Management and MSSP Portal APIs use an access-key-plus-secret-key pair, while Identity Exposure and Attack Surface Management use single-header keys, so you configure the right credential per API.
Which Tenable API should an agent use for external assets versus infrastructure scanning?
Use Attack Surface Management to discover and export internet-facing assets that belong to an organization, and use the Vulnerability Management (Nessus) API to scan known hosts and export severity-scored findings. A common pattern is discovering assets first, then scanning them.
How do the APIs fit together in a security workflow?
An agent can chain them: export exposed assets from Attack Surface Management, scan those hosts with the Nessus API, and correlate the findings with Active Directory deviances from Identity Exposure. Managed service providers can run these steps across many accounts via the MSSP Portal.
Is Active Directory analysis part of the same portfolio?
Yes. Identity Exposure focuses on Active Directory security, returning the state of AD objects over time and the deviances detected for a given security profile, which complements the infrastructure and external asset views the other APIs provide.
Which Tenable API is generated by Jentic rather than published by Tenable?
The Vulnerability Management (Nessus) API spec is Jentic-generated, kept validated and agent-ready because Tenable does not publish an OpenAPI specification for that platform. Identity Exposure, Attack Surface Management, and the MSSP Portal are vendor-official specs.
If you need a different Identity Auth vendor
All 4 are in the Jentic catalogue with the same one-credential, intent-search pattern.
BOOK A DEMO
Start Connecting APIs to Your AI Agents
Browse thousands of APIs and connect them all to your agent with Jentic One. One layer, one credential — every API your agent needs.