Is Active Directory analysis part of the same portfolio?

Yes. Identity Exposure focuses on Active Directory security, returning the state of AD objects over time and the deviances detected for a given security profile, which complements the infrastructure and external asset views the other APIs provide.

Which Tenable API is generated by Jentic rather than published by Tenable?

The Vulnerability Management (Nessus) API spec is Jentic-generated, kept validated and agent-ready because Tenable does not publish an OpenAPI specification for that platform. Identity Exposure, Attack Surface Management, and the MSSP Portal are vendor-official specs.

Tenable APIs for AI Agents

Q: How do the APIs fit together in a security workflow?

An agent can chain them: export exposed assets from Attack Surface Management, scan those hosts with the Nessus API, and correlate the findings with Active Directory deviances from Identity Exposure. Managed service providers can run these steps across many accounts via the MSSP Portal.

Identity AuthAuthenticationVulnerability ManagementMixed ProvenanceAPI keyAgent Ready

www.tenable.com·Developer portal → developer.tenable.com

Tenable API Catalog

4 APIs across 4 product groups. All share one credential.

Which Tenable API should I use?

I want to...	Use	Why
Find and export externally exposed internet-facing assets	Attack Surface Management	Attack Surface Management discovers external assets and exports asset and source lists in XLSX, CSV, and JSON formats.
Scan discovered infrastructure for vulnerabilities and export findings	Tenable Vulnerability Management API (Nessus)	The Vulnerability Management (Nessus) API launches scans against hosts and exports severity-scored findings and asset inventories in chunks.
Assess Active Directory identity exposure and object-level deviances	Identity Exposure	Identity Exposure reads the state of AD objects over time and the deviances detected for a security profile.
Administer multiple customer instances as a managed service provider	MSSP Portal	The MSSP Portal API lists and manages child accounts, account groups, domains, and evaluation accounts across tenants.

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Instead of wiring four Tenable APIs by hand, each with its own host and API key header format, you install Jentic One once and your agent finds and adds the Tenable APIs it needs from the Jentic directory. You store each API key once and the agent calls the operations.

Permission scoping

Your own rules in your Jentic One instance decide which Tenable operations the agent may call. You can pin an agent to read-only scan exports or a single managed account, so higher-risk operations like launching new scans or creating evaluation accounts are excluded unless you add them.

Credential isolation

Each Tenable credential, whether a single API key or an access-key-plus-secret-key pair, is stored encrypted by your own self-hosted Jentic One instance and injected at execution time. Raw keys never enter the agent's prompt, logs, or context.

FAQs

Specific to using Tenable APIs through Jentic.

What can an agent do across Tenable's APIs?

An agent can discover externally exposed assets, launch and export vulnerability scans against infrastructure, read Active Directory identity exposure and detected deviances, and administer multiple managed customer accounts. Together these cover external attack surface, infrastructure risk, identity posture, and multi-tenant account management.

Do these Tenable APIs share one credential?

No. Every Tenable API uses API key authentication, but the header and key format differ by product. The Vulnerability Management and MSSP Portal APIs use an access-key-plus-secret-key pair, while Identity Exposure and Attack Surface Management use single-header keys, so you configure the right credential per API.

Which Tenable API should an agent use for external assets versus infrastructure scanning?

Use Attack Surface Management to discover and export internet-facing assets that belong to an organization, and use the Vulnerability Management (Nessus) API to scan known hosts and export severity-scored findings. A common pattern is discovering assets first, then scanning them.

How do the APIs fit together in a security workflow?

BOOK A DEMO

Start Connecting APIs to Your AI Agents

Browse thousands of APIs and connect them all to your agent with Jentic One. One layer, one credential — every API your agent needs.

Book a Demo

For Agents

APIs4 in catalogue

Endpoints332 indexed

AuthAPI key — 1 credential for all 4 APIs

ProvenanceMixed provenance

An agent can launch vulnerability scans, export findings and asset inventories, inspect Active Directory objects and identity exposure deviances, export externally discovered assets, and administer managed customer accounts across Tenable's security surface. It ties infrastructure scanning, identity posture, external attack surface, and multi-tenant account management into a single credentialed workflow.

Tenable spans four distinct security surfaces from one vendor: network and infrastructure vulnerability scanning, Active Directory identity exposure, external attack surface discovery, and MSSP multi-account administration. An agent can move from finding an exposed asset to scanning it for vulnerabilities to checking related identity risk without leaving the vendor.

Use for: Vulnerability scanning, Active Directory identity exposure analysis, external attack surface asset discovery, and MSSP multi-account administration across Tenable's security products

Not supported: endpoint detection response, SIEM correlation, application code analysis, payment processing, customer messaging

Credentials: All four Tenable APIs authenticate with an API key, though the header and key format vary by product (an access-key-plus-secret-key pair for the Vulnerability Management and MSSP Portal APIs, and single-header keys for Identity Exposure and Attack Surface Management), so a single credential does not cover every API.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Ftenable.com" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Ftenable.com" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

What AI Agents Can Do with Tenable

Each workflow spans multiple Tenable APIs. Jentic routes each operation to the right API automatically.

Discover an exposed asset then scan it for vulnerabilities

An agent exports externally discovered assets from Attack Surface Management, then launches a vulnerability scan against those hosts with the Nessus API and exports the severity-scored findings.

Example prompt:

Export the asset list via POST /assets/export/json on Attack Surface Management, then launch a scan against those hosts via POST /scans on the Nessus API and export critical findings

APIs used

Attack Surface Management + Tenable Vulnerability Management API (Nessus)

Correlate infrastructure vulnerabilities with identity exposure

An agent exports critical vulnerability findings from the Nessus API and reads the state of related Active Directory objects and their deviances from Identity Exposure to judge combined risk.

Example prompt:

Export critical findings via POST /vulns/export on the Nessus API, then read affected AD objects and deviances via GET /api/ad-objects on Identity Exposure

APIs used

Tenable Vulnerability Management API (Nessus) + Identity Exposure

Roll out security scanning across managed customer accounts

An MSSP agent lists managed child accounts from the MSSP Portal, then launches vulnerability scans per account with the Nessus API and exports the results for each tenant.

Example prompt:

List child accounts via GET /mssp/accounts on the MSSP Portal, then for each account launch a scan via POST /scans on the Nessus API and export the results

APIs used

MSSP Portal + Tenable Vulnerability Management API (Nessus)

Tenable APIs for AI Agents

Tenable API Catalog

Developer Tools1

E Commerce1

Identity Auth1

Security1

Which Tenable API should I use?

Why Jentic?

FAQs

Start Connecting APIs to Your AI Agents

Connect the Tenable APIs to your agent

What AI Agents Can Do with Tenable

If you need a different Identity Auth vendor