Tenable API Field Guide — AI skill for Claude Code

Tenable API Field Guide

An agent skill that makes AI coding assistants write correct code against Tenable's APIs, and diagnose integrations that misbehave. It works with Claude Code, Codex, Cursor, GitHub Copilot and Gemini CLI.

Tenable's APIs differ by product in auth headers, paging, filter syntax and error behavior, and several defaults quietly change results. An assistant working from memory typically writes a vulnerability export that:

• returns only the last 30 days of data (there's a default time window),
• never includes fixed findings (the default state),
• polls forever if someone cancels the job,
• or retries a 409 that means "this export is already running".

pyTenable adds traps of its own. Misspelled credentials produce an unauthenticated client instead of an error, defaults differ from the API's, and return types vary by module.

This skill gives the assistant rules checked against the public API reference at [developer.tenable.com](https://developer.tenable.com) and against the pyTenable source, so it gets these right the first time.

What it covers

• Auth and clients: header and base URL per product, pyTenable constructors and env var prefixes, SSL, timeouts.
• VM exports: vulnerability, asset (v1/v2), compliance and WAS exports.
  • The lifecycle and status values.
  • Default time and state windows.
  • Filter syntax, including tag filters, which take one form for vulns and assets v1, another for compliance, and aren't supported on assets v2.
  • Chunk handling and expiry.
  • Duplicates (409).
  • Joining findings to assets, and reconciling deleted assets.
• Limits: rate limiting and retry-after, concurrency caps (10 exports, 3 detail calls, 25 active scans), pyTenable's retry behavior, User-Agent identification.
• Pagination: the scheme for each API (VM, WAS, Tenable One, PCI ASV, ASM, Identity Exposure, Security Center, Cloud Security), plus record caps that force you onto exports.
• pyTenable: retur