generated: '2026-07-21'
method: derived
source: openapi/ + https://www.tenable.com/trust/assurance
standards:
  - id: oauth2
    conforms: false
    evidence: no oauth2 securitySchemes in any spec; auth is API-key (X-ApiKeys)
  - id: apikey-auth
    conforms: true
    evidence: all cloud specs use apiKey header X-ApiKeys (accessKey;secretKey); Identity Exposure uses x-api-key; Downloads uses Bearer
  - id: openapi-3
    conforms: true
    evidence: 8 published OpenAPI 3.0 specifications (developer.tenable.com/openapi)
  - id: rfc9457-problem-details
    conforms: false
    evidence: error responses use standard JSON envelope, not application/problem+json
  - id: pagination-limit-offset
    conforms: true
    evidence: limit/offset query parameters across list operations
  - id: rate-limiting
    conforms: true
    evidence: 429 Too Many Requests with Retry-After header; per-user per-minute limits
  - id: soc2
    conforms: true
    evidence: SOC 2 report (third-party audit) — tenable.com/trust/assurance
  - id: iso-27001
    conforms: true
    evidence: ISO/IEC 27001:2022 certification of ISMS
  - id: fedramp
    conforms: true
    evidence: Tenable One VM and Web App Scanning FedRAMP ATO (2021)
  - id: stateramp
    conforms: true
    evidence: Tenable One Vulnerability Management StateRAMP Authorized
  - id: csa-star
    conforms: true
    evidence: member of the CSA STAR program