Search attack paths

post

https://cloud.tenable.com/api/v1/t1/apa/top-attack-paths/search

Returns a list of the top attack paths leading to critical assets. The response includes details about each attack path, such as associated techniques, nodes, and metadata. This endpoint enables you to use advanced search capabilities, including filtering, sorting, and pagination.

Note: Attack paths inherit their status from underlying techniques. To prioritize active threats, the system excludes the following statuses by default:

chain_prevented — The attack chain is partially fixed.
accepted — The risk is accepted.
done — Remediation is complete.

To retrieve all paths regardless of status, set the exclude_resolved parameter to false.

For more information, see Top Attack Paths in the Exposure Management User Guide.

Requires the Basic [16] user role or the ATTACK_PATH_ANALYSIS.QUERY.SEARCH custom role privilege. See Roles and Permissions.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

limit

integer

100 to 10000

Defaults to 1000

The number of attack path records to retrieve. If omitted, the default value is 1000. The minimum value is 100 and the maximum value is 10000.

offset

integer

≥ 0

Defaults to 0

The number of records to skip for offset-based pagination. If omitted, the default value is 0.

sort

string

The property and direction to sort the results by, in the format property:direction. For example: name:asc, priority:desc, or path_status:asc.

Supported properties for sorting include name, priority, and path_status.

run_ai_summarization

string

enum

Defaults to false

Indicates whether or not to run the AI summarization for missing paths.

Generative AI enables users to better understand attack paths and their associated risk, and it provides additional insight into the assets affected by the attack paths.

Note that enabling the AI summarization results in slower response times.

Allowed:

exclude_resolved

boolean

Defaults to true

Excludes resolved attack paths from the results. When true (default), the system filters out paths with the following path_status values:

done — Remediation is complete.
chain_prevented — The attack chain is partially broken.
accepted — The risk is accepted.

Set to false to include all attack paths regardless of status.

Body Params

Filter conditions for searching attack paths. Filter operators can include nested conditions and operators to create complex filtering logic.

Defines a single filter condition used to narrow the search results for attack paths.

property

string

enum

Specifies the property used to filter the results. For example: priority, name, or technique.

operator

string

enum

Specifies the comparison operator applied to the property filter. For example: eq (equals), ne (not equals), or contains.

value

Defines the specific value or values to match against the property. This can be a single value or an array of values depending on the operator used.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200Returned if the attack path search results were retrieved successfully.

400Returned if your request specified invalid parameters or if your request was improperly formatted.

401Returned if the API keys specified in your request are invalid.

403Returned if you do not have permission to search attack paths.

429Returned if you attempt to send too many requests in a specific period of time. For more information, see Rate Limiting.

500Returned if an internal error occurred.