Tenable Enclave Security: New API Documentation

Tenable has published API documentation for Tenable Enclave Security and Tenable Container Security. The new documentation provides API reference information for managing Enclave Security licensing and programmatically accessing and managing Container Security data.

These APIs are available in Tenable Enclave Security 1.9. For more information about the release, see the Tenable Enclave Security 1.9.0 Release Notes.

Authentication

Requests authenticate with an API key passed in the x-apikey header and route through the Tenable Enclave Security API gateway.

An API key consists of an access key and a secret key, which must be used together. Before you can authenticate with API keys:

1. An administrator enables the Allow API Keys setting in the Tenable Enclave Security interface.
2. Each user generates an API key for their account.

Administrators can generate keys for any account. Users in other roles can generate keys only for accounts that share their role.

🛑

Caution

Secret keys are displayed only once, when you generate them, and cannot be viewed again in the interface. Generating a new key for a user replaces that user's existing key and deauthorizes any request that uses the previous key.

For more information, see API Key Authentication, Enable API Key Authentication, and Generate an API Key in the Tenable Enclave Security User Guide.

Base Server URL

Because Tenable Enclave Security is self-hosted, there is no shared base URL. Replace the base server URL in every request with the URL of your own Tenable Enclave Security instance.

Example Request

For example, to list the available query types, you could use the following cURL request:

curl --request GET \
     --url 'https://your-server-url/public/consec/api/v1/query/types' \
     --header 'x-apikey: accesskey=<ACCESS_KEY>; secretkey=<SECRET_KEY>' \
     --header 'accept: application/json'

Permissions

Actions performed with an API key are attributed to the user account associated with that key, and are limited to the privileges granted to that account.

Container Security endpoints each require a specific Container Security permission, such as permConSecViewApp to read data or permConSecManageScanners to manage scanners. Each endpoint's reference page lists the permission it requires. For more information, see Container Security Permissions and Container Security Roles.

Endpoints

The documentation is organized into two API sets that mirror how Tenable Enclave Security is structured. Platform APIs apply to your deployment as a whole, and are shared by every product running on it. Container Security APIs cover a single product within that deployment.

Each endpoint has its own reference page documenting the request and response schemas, the parameters and filters it accepts, example payloads, and the permission it requires. You can also try any endpoint directly from its reference page.

The documentation includes the following APIs.

Tenable Enclave Security Platform

Platform-level APIs apply across your Tenable Enclave Security deployment rather than to a single product. Tenable Enclave Security manages licensing through a shared service, so a single request returns license status and utilization for every blade in the deployment, including Tenable Security Center and Container Security.

For more information, see the Tenable Enclave Security User Guide.

License

Register a license key file and monitor license status. Tenable Enclave Security manages licensing centrally across blades, so the utilization endpoint reports capacity and current usage for each blade in a single response.

Tenable Container Security

The Container Security API provides programmatic access to your container image data — images together with the layers, packages, and vulnerabilities they contain — and to the scanners and scans that produce it. Use it to query Container Security data directly or to integrate it with external tooling such as SIEM, ticketing, and automation pipelines.

For more information, see the Tenable Container Security User Guide.

Exports

Export the relationships between container images, layers, packages, and vulnerabilities in bulk. Each endpoint takes one side of the relationship and returns the related records, so you can pull the layers and packages belonging to a set of images, or the images, layers, and packages affected by a set of vulnerabilities. Use these endpoints to feed Container Security data into SIEM, ticketing, and automation pipelines.

Global Settings

View and configure asset age-out. Asset age-out automatically removes image records that have not been seen within a retention period you define, which keeps your Container Security inventory focused on active images rather than accumulating records for images that have been deprecated or replaced.

Images

Query and manage the container image inventory. The search endpoints accept filter criteria, let you select which fields to return, and support pagination and sorting. The remaining endpoints list the registries and pipelines that images come from, list image tags, delete image assets, and generate a Software Bill of Materials (SBOM) report.

Layers

Search the image layers discovered across your container images. Because layers are shared between images, searching at the layer level shows where a given base layer is reused and which images inherit its contents.

Packages

Search the software packages detected inside your container images. Package-level searches are useful for answering supply chain questions, such as which images contain a specific package version.

Queries

Discover the filter criteria the search endpoints accept. Rather than hard-coding field names, call these endpoints to retrieve the query types available for images, layers, and packages, along with the fields and comparison operators supported for each. Use the results to build valid filters for the search endpoints in the sections below.

Scanners

Manage the scanners that inspect your registries. A scanner can be a deployment scanner or a consec scanner, and the download endpoint returns the scanner binary or the cluster configuration depending on which type you created. You can also retrieve the scans currently running on a given scanner.

Scans

Create, configure, and control container image scans. Scan configurations are managed independently of execution, so you can create and update a scan and then start it on demand or stop one that is already running.

Vulnerabilities

Search the vulnerabilities detected across your container images. Use these endpoints to retrieve the current vulnerability set for reporting or triage, and the Exports endpoints above to pull the images, layers, and packages each vulnerability affects.

For more information about Tenable Enclave Security, see the Tenable Enclave Security User Guide. For information about Tenable Container Security, see the Tenable Container Security User Guide.