Qualys Vulnerability Scanner Connector

Qualys Vulnerability Scanner is a cloud-based platform for automated vulnerability assessment, compliance monitoring, and risk management across diverse IT assets.

Qualys Vulnerability Scanner is a leading cloud-based platform for automated vulnerability management, compliance assessment, and security reporting across hybrid IT environments. This connector enables Swimlane Turbine users to automate vulnerability scans, compliance checks, asset and patch management, and detailed reporting directly from their low-code security automation workflows. By integrating Qualys with Swimlane Turbine, security teams can orchestrate end-to-end vulnerability lifecycle management, accelerate threat detection and remediation, and ensure continuous compliance—without manual intervention or custom code. The connector empowers users to schedule, launch, update, and manage scans, retrieve actionable vulnerability and compliance data, and automate reporting for faster, more effective security operations.

Limitations

None to date.

Supported Versions

This Qualys Vulnerability Scanner connector uses the Version 2.0 API.

Host Detection List and Get Host Detections retrieve vulnerability detection details from the Qualys Host Detection API. Qualys requires the X-Requested-With header on those requests; this connector sends it automatically.

Additional Docs

Qualys Vulnerability Scanner Authentication Link

Qualys Vulnerability Scanner API Documentation Link

Configuration

Prerequisites

To use the Qualys Vulnerability Scanner connector, ensure you have the following prerequisites:

API Key Authentication (session-based authentication using username and password):

URL: The base endpoint for your Qualys account's API access.

Username: Your Qualys account username with appropriate API permissions.

Password: The corresponding password for the specified Qualys user.

HTTP Basic Authentication (using username and password):

URL: The Qualys API endpoint URL for your environment.

Username: Valid Qualys account username authorized for API operations.

Password: Password associated with the provided Qualys username.

Authentication Methods

API Key Authentication (Session Based Authentication):

URL: The endpoint URL for Qualys API services.

Username: Your Qualys platform username.

Password: Your Qualys platform password.

HTTP Basic Authentication:

URL: The endpoint URL for Qualys API services.

Username: Your Qualys platform username.

Password: Your Qualys platform password.

Capabilities

This Qualys Vulnerability Scanner connector provides the following capabilities:

Create Azure Internal Scan

Create Cloud Perimeter Scan

Fetch Report

Get Compliance Control List

Get Compliance Scan

Get Host Detections

Get Hosts

Host Detection List

Get Scan Summary

Get VM Scan

Get VM Scan Summary

KnowledgeBase Download

Launch Compliance Scan

Launch VM Scan

Launch VM Scan on EC2 Assets ... and so on

Configurations

Qualys Vulnerability Scanner API Key Auth

Authenticates using a username and password for session-based authentication.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
qusername	Username	string	Required
qpassword	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Qualys Vulnerability Scanner HTTP Basic Auth

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create Azure Internal Scan

Initiate an internal vulnerability scan in Azure environments using Qualys by submitting the necessary scan details in the request body.

Endpoint

URL: /api/2.0/fo/scan/cloud/internal/job/index.php

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
data_body	object	Required	Response data
data_body.action	string	Required	Specify create to configure a new internal Azure scan job.
data_body.module	string	Required	Specify vm for a vulnerability scan.
data_body.cloud_provider	string	Required	Specify azure for an Azure internal scan. The cloud_provider value cannot be changed during an update request. Note - Currently supporting azure only.
data_body.cloud_service	string	Required	Specify vm (Azure virtual machine) for an Azure internal scan. The cloud_service value cannot be changed during an update request.
data_body.connector_name	string	Optional	The name of the connector to be used. We check if the specified connector_name exists for your Qualys subscription. If the specified connector name does not exists in your Qualys subscription, then the API request returns an error message - Invalid connector_name provided. One of these parameters must be specified in the request conector_name or connector_uuid. These are mutually exclusive and cannot be specified in the same request.
data_body.connector_uuid	string	Optional	The ID of the connector to be used. If the specified connector name does not exists in your Qualys subscription, then the API request returns an error message - Invalid connector_uuid provided. One of these parameters must be specified in the request conector_name or connector_uuid. These are mutually exclusive and cannot be specified in the same request.
data_body.scan_title	string	Required	The scan title to create.
data_body.active	number	Required	Specify 1 to create an active schedule. Specify 0 to create an inactive schedule.
data_body.option_title	string	Optional	The title of the option profile to be used. One of these parameters must be specified in the request option_title or option_id. These are mutually exclusive and cannot be specified in the same request.
data_body.option_id	number	Optional	The ID of the option profile to be used. One of these parameters must be specified in a request option_title or option_id. These are mutually exclusive and cannot be specified in the same request.
data_body.priority	number	Optional	Specify a value of 0 - 9 to set a processing priority level for the scan. When not specified, a value of 0 (no priority) is used. Valid values are 0 = No Priority (the default), 1 = Emergency, 2 = Ultimate, 3 = Critical, 4 = Major, 5 = High, 6 = Standard, 7 = Medium, 8 = Minor, 9 = Low.
data_body.iscanner_id	string	Optional	The IDs of the scanner appliances to be used. Multiple entries are comma separated. These parameters cannot be specified in the same request iscanner_id and iscanner_name.
data_body.iscanner_name	string	Optional	The friendly names of the scanner appliances to be used. Multiple entries are comma separated. These parameters cannot be specified in the same request iscanner_id and iscanner_name.
data_body.platform_type	string	Required	Select the platform type as either location or virtual network.
data_body.region_code	string	Optional	The Azure region code. Valid values are ap-northeast-1, ap-southeast-1, ap-southeast-2, ap-east-1, eu-west-1, eu-north-1, asa-east-1, us-east-1, us-west-1, us-west-2, me-south-1, eu-south-1, and af-south-1. This parameter is mandatory when the platform type is set to location.
data_body.virtual_network_id	string	Optional	Provide the ID of the Azure virtual network. This parameter is mandatory when the platform type is set to virtual network.
data_body.tag_include_selector	string	Optional	Select any (the default) to include hosts that match at least one of the selected tags. Select all to include hosts that match all of the selected tags.
data_body.tag_exclude_selector	string	Optional	Select any (the default) to exclude hosts that match at least one of the selected tags. Select all to exclude hosts that match all of the selected tags.
data_body.tag_set_by	string	Optional	Specify “id” (the default) to select a tag set by providing tag IDs. Specify “name” to select a tag set by providing tag names. We will check if the tag ids or tag names are valid.
data_body.tag_set_include	string	Optional	Specify a tag set to include. Hosts that match these tags will be included. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated.
data_body.tag_set_exclude	string	Optional	Specify a tag set to exclude. Hosts that match these tags will be excluded. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated.
data_body.schedule	string	Required	Specify now to schedule the scan job for now. Specify recurring to schedule the scan job to start at a later time or on a recurring basis. See Schedule Parameters for Azure Internal Scans. Possible values are now, recurring.

Input Example

{"headers":{"X-Requested-With":"string"},"data_body":{"action":"create","module":"vm","cloud_provider":"azure","cloud_service":"vm","connector_name":"Example Name","connector_uuid":"string","scan_title":"string","active":123,"option_title":"string","option_id":123,"priority":123,"iscanner_id":"string","iscanner_name":"Example Name","platform_type":"string","region_code":"string","virtual_network_id":"string","tag_include_selector":"any","tag_exclude_selector":"any","tag_set_by":"id","tag_set_include":"string","tag_set_exclude":"string","schedule":"string","occurrence":"string","frequency_days":123,"frequency_weeks":123,"weekdays":"string","frequency_months":123,"day_of_month":123,"day_of_week":123,"week_of_month":"string","start_date":"string","start_hour":123,"start_minute":123,"time_zone_code":"string","observe_dst":"string","recurrence":123,"end_after":123,"end_after_mins":123,"pause_after_hours":123,"pause_after_mins":123,"resume_in_days":"string","resume_in_hours":123,"set_start_time":123,"before_notify":123,"before_notify_unit":"string","before_notify_time":123,"before_notify_message":"string","after_notify":123,"after_notify_message":"string","recipient_group_ids":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT
SIMPLE_RETURN.RESPONSE.ITEM_LIST	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY	string	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE	string	Value for the parameter

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 11 Mar 2025 05:39:01 GMT","Content-Type":"text/xml;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Content-Type-Options":"nosniff, nosniff","X-Frame-Options":"SAMEORIGIN","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, private, must-revalidate, post-check=0, pre-check=0","Pragma":"no-cache","X-Powered-By":"Qualys:USPOD3:19c2b0e7-3e70-e163-833e-64144bbbf8b3:730c59a6-aa5f-e469-81f8-0cd5e......

Create Cloud Perimeter Scan

Initiate or update a cloud perimeter scan in Qualys Vulnerability Scanner using detailed configurations provided in the data body.

Endpoint

URL: /api/2.0/fo/scan/cloud/perimeter/job/index.php

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
data_body	object	Required	Response data
data_body.action	string	Required	Specify "create" to configure a new cloud perimeter scan job.
data_body.module	string	Required	Specify "vm" for a vulnerability scan and "pc" for a compliance scan. Required for Create request.
data_body.cloud_provider	string	Optional	Specify "azure" for an Azure scan. Specify "aws" for an AWS EC2 scan. Specify "gcp" for a GCP scan. The cloud_provider value cannot be changed during an update request. When cloud_provider=azure, the following parameters cannot be specified in the same request platform_type, region_code, vpc_id, include_micro_nano_instances, include_lb_from_connector. These parameters only apply when cloud_provider=aws is specified.
data_body.cloud_service	string	Optional	Specify "vm" (Azure virtual machine) for an Azure scan. Specify "ec2" for an AWS EC2 scan. Specify "compute_engine" for a GCP scan. The cloud_service value cannot be changed during an update request.
data_body.connector_name	string	Optional	The name of the connector to be used. One of these parameters must be specified in the request conector_name or connector_uuid. These are mutually exclusive and cannot be specified in the same request.
data_body.connector_uuid	string	Optional	The ID of the connector to be used. One of these parameters must be specified in the request conector_name or connector_uuid. These are mutually exclusive and cannot be specified in the same request.
data_body.scan_title	string	Optional	The scan title. When not specified the default scan title is "AWS EC2 Perimeter Scan ".
data_body.active	number	Required	Specify "1" to create an active schedule. Specify "0" to create an inactive schedule.
data_body.option_title	string	Optional	The title of the option profile to be used. One of these parameters must be specified in the request option_title or option_id. These are mutually exclusive and cannot be specified in the same request.
data_body.option_id	number	Optional	The ID of the option profile to be used. One of these parameters must be specified in a request option_title or option_id. These are mutually exclusive and cannot be specified in the same request.
data_body.priority	number	Optional	Specify a value of 0 - 9 to set a processing priority level for the scan. When not specified, a value of 0 (no priority) is used. Valid values are 0 = No Priority (the default), 1 = Emergency, 2 = Ultimate, 3 = Critical, 4 = Major, 5 = High, 6 = Standard, 7 = Medium, 8 = Minor, 9 = Low.
data_body.iscanner_id	string	Optional	The IDs of the scanner appliances to be used. Specify "0" for external scanners. Multiple entries are comma separated. These parameters cannot be specified in the same request iscanner_id and iscanner_name. Optional, only valid when your account is configured to allow internal scanners.
data_body.iscanner_name	string	Optional	The friendly names of the scanner appliances to be used or "External" for external scanners. Multiple entries are comma separated. These parameters cannot be specified in the same request iscanner_id and iscanner_name. Optional, only valid when your account is configured to allow internal scanners.
data_body.platform_type	string	Optional	The platform type. Valid values are classic, vpc_peered or selected_vpc.
data_body.region_code	string	Optional	The EC2 region code. Valid values are ap-northeast-1, ap-southeast-1, ap-southeast-2, ap-east-1, eu-west-1, eu-north-1, asa-east-1, us-east-1, us-west-1, us-west-2, me-south-1, eu-south-1, and af-south-1. One of these parameters must be specified in the request region_code or vpc_id. These are mutually exclusive and cannot be specified in the same request.
data_body.vpc_id	string	Optional	The ID of the Virtual Private Cloud (VPC) zone. The ID value must start with vpc-*. We will check if the specified vpc_id exists for the selected connector. One of these parameters must be specified in the request region_code or vpc_id. These are mutually exclusive and cannot be specified in the same request.
data_body.include_micro_nano_instances	number	Optional	Specify 1 to include EC2 assets with instance types t2.nano, t3.nano, t1.micro and m1.small in the scan job. By default, this parameter value is set to 0. Note that these instance types must be activated for your account so that we can include them in the scan. Warning - AWS EC2 assets with instance types t2.nano, t3.nano, t1.micro and m1.small have very limited CPU. When scanning these instance types we recommend you choose an option profile with Light port scanning and no authentication. Alternatively, use Qualys Cloud Agent to perform the equivalent of authenticated scanning for the least performance impact for these instance types.
data_body.tag_include_selector	string	Optional	Select “any” (the default) to include hosts that match at least one of the selected tags. Select “all” to include hosts that match all of the selected tags.
data_body.tag_exclude_selector	string	Optional	Select “any” (the default) to exclude hosts that match at least one of the selected tags. Select “all” to exclude hosts that match all of the selected tags.
data_body.tag_set_by	string	Optional	Specify “id” (the default) to select a tag set by providing tag IDs. Specify “name” to select a tag set by providing tag names. We will check if the tag ids or tag names are valid.
data_body.tag_set_include	string	Optional	Specify a tag set to include. Hosts that match these tags will be included. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated.
data_body.tag_set_exclude	string	Optional	Specify a tag set to exclude. Hosts that match these tags will be excluded. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated.

Input Example

{"headers":{"X-Requested-With":"string"},"data_body":{"action":"create","module":"string","cloud_provider":"string","cloud_service":"string","connector_name":"Example Name","connector_uuid":"string","scan_title":"string","active":123,"option_title":"string","option_id":123,"priority":123,"iscanner_id":"string","iscanner_name":"Example Name","platform_type":"string","region_code":"string","vpc_id":"string","include_micro_nano_instances":123,"tag_include_selector":"any","tag_exclude_selector":"any","tag_set_by":"id","tag_set_include":"string","tag_set_exclude":"string","include_lb_from_connector":123,"elb_dns":"string","schedule":"string","occurrence":"string","frequency_days":123,"frequency_weeks":123,"weekdays":"string","frequency_months":123,"day_of_month":123,"day_of_week":123,"week_of_month":"string","start_date":"string","start_hour":123,"start_minute":123,"time_zone_code":"string","observe_dst":"string","recurrence":123,"end_after":123,"end_after_mins":123,"pause_after_hours":123,"pause_after_mins":123,"resume_in_days":"string","resume_in_hours":123,"set_start_time":123,"before_notify":123,"before_notify_unit":"string","before_notify_time":123,"before_notify_message":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT
SIMPLE_RETURN.RESPONSE.ITEM_LIST	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY	string	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE	string	Value for the parameter

Output Example

Fetch Report

Retrieve a specific vulnerability report from Qualys Vulnerability Scanner using the provided report ID and action parameters.

Endpoint

URL: /api/2.0/fo/report/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Specify action to fetch a report.
parameters.echo_request	number	Optional	Specify 1 to view (echo) input parameters in the XML output. By default these are not included.
parameters.id	number	Required	The report ID you want to take action on.

Input Example

{"parameters":{"action":"fetch","echo_request":0,"id":232123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Output field: file
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","file":{"file":"dfgfdfd34r","file_name":"report_output.csv"}}

Get Compliance Control List

Retrieve a list of compliance controls from Qualys Vulnerability Scanner based on specified action parameters.

Endpoint

URL: api/2.0/fo/compliance/control/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the Get Compliance Control List action
parameters.details	string	Optional	Parameters for the Get Compliance Control List action
parameters.ids	string	Optional	Parameters for the Get Compliance Control List action
parameters.id_min	string	Optional	Parameters for the Get Compliance Control List action
parameters.id_max	string	Optional	Parameters for the Get Compliance Control List action
parameters.updated_after_datetime	string	Optional	Parameters for the Get Compliance Control List action
parameters.created_after_datetime	string	Optional	Parameters for the Get Compliance Control List action
parameters.truncation_limit	string	Optional	Parameters for the Get Compliance Control List action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","details":"string","ids":"string","id_min":"string","id_max":"string","updated_after_datetime":"string","created_after_datetime":"string","truncation_limit":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
CONTROL_LIST_OUTPUT	object	Output field: CONTROL_LIST_OUTPUT
CONTROL_LIST_OUTPUT.RESPONSE	object	Output field: CONTROL_LIST_OUTPUT.RESPONSE
CONTROL_LIST_OUTPUT.RESPONSE.DATETIME	string	Time value
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST	object	Output field: CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL	array	Output field: CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.ID	string	Unique identifier
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.UPDATE_DATE	string	Date value
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.CREATED_DATE	string	Date value
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.CATEGORY	string	Output field: CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.CATEGORY
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.SUB_CATEGORY	string	Output field: CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.SUB_CATEGORY
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.STATEMENT	string	Output field: CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.STATEMENT
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.CRITICALITY	object	Output field: CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.CRITICALITY
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.TECHNOLOGY_LIST	object	Output field: CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.TECHNOLOGY_LIST
CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.FRAMEWORK_LIST	object	Output field: CONTROL_LIST_OUTPUT.RESPONSE.CONTROL_LIST.CONTROL.FRAMEWORK_LIST
CONTROL_LIST_OUTPUT.RESPONSE.WARNING	object	Output field: CONTROL_LIST_OUTPUT.RESPONSE.WARNING
CONTROL_LIST_OUTPUT.RESPONSE.WARNING.CODE	string	Output field: CONTROL_LIST_OUTPUT.RESPONSE.WARNING.CODE
CONTROL_LIST_OUTPUT.RESPONSE.WARNING.TEXT	string	Output field: CONTROL_LIST_OUTPUT.RESPONSE.WARNING.TEXT
CONTROL_LIST_OUTPUT.RESPONSE.WARNING.URL	string	URL endpoint for the request

Output Example

{"CONTROL_LIST_OUTPUT":{"RESPONSE":{"DATETIME":"string","CONTROL_LIST":{},"WARNING":{}}}}

Get Compliance Scan

Retrieve compliance scan results from Qualys Vulnerability Scanner using specified action parameters for detailed security assessment.

Endpoint

URL: api/2.0/fo/scan/compliance/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the Get Compliance Scan action
parameters.scan_ref	string	Optional	Parameters for the Get Compliance Scan action
parameters.ips	string	Optional	Parameters for the Get Compliance Scan action
parameters.client_id	string	Optional	Parameters for the Get Compliance Scan action
parameters.client_name	string	Optional	Parameters for the Get Compliance Scan action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","scan_ref":"string","ips":"string","client_id":"string","client_name":"Example Name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.CODE	string	Output field: SIMPLE_RETURN.RESPONSE.CODE
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT

Output Example

{"SIMPLE_RETURN":{"RESPONSE":{"DATETIME":"string","CODE":"string","TEXT":"string"}}}

Get Host Detections

Retrieve a list of detected vulnerabilities on specified hosts from Qualys Vulnerability Scanner using defined parameters, including action.

Endpoint

URL: api/2.0/fo/asset/host/vm/detection/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the Get Host Detections action
parameters.show_asset_id	string	Optional	Parameters for the Get Host Detections action
parameters.show_reopened_info	string	Optional	Parameters for the Get Host Detections action
parameters.arf_kernel_filter	string	Optional	Parameters for the Get Host Detections action
parameters.severities	string	Optional	Parameters for the Get Host Detections action
parameters.arf_service_filter	string	Optional	Parameters for the Get Host Detections action
parameters.result_limit	string	Optional	Parameters for the Get Host Detections action
parameters.arf_config_filter	string	Optional	Parameters for the Get Host Detections action
parameters.max_days_since_detection_updated	string	Optional	Parameters for the Get Host Detections action
parameters.detection_updated_since	string	Optional	Parameters for the Get Host Detections action
parameters.detection_updated_before	string	Optional	Parameters for the Get Host Detections action
parameters.detection_processed_after	string	Optional	Parameters for the Get Host Detections action
parameters.detection_processed_before	string	Optional	Parameters for the Get Host Detections action
parameters.detection_last_tested_since	string	Optional	Parameters for the Get Host Detections action
parameters.detection_last_tested_after	string	Optional	Parameters for the Get Host Detections action
parameters.include_ignored	string	Optional	Parameters for the Get Host Detections action
parameters.include_disabled	string	Optional	Parameters for the Get Host Detections action
parameters.ips	string	Optional	Parameters for the Get Host Detections action
parameters.show_igs	string	Optional	Parameters for the Get Host Detections action
parameters.ipv6	string	Optional	Parameters for the Get Host Detections action
parameters.ag_ids	string	Optional	Parameters for the Get Host Detections action
parameters.ag_titles	string	Optional	Parameters for the Get Host Detections action
parameters.ids	string	Optional	Parameters for the Get Host Detections action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","show_asset_id":"string","show_reopened_info":"string","arf_kernel_filter":"string","severities":"string","arf_service_filter":"string","result_limit":"string","arf_config_filter":"string","max_days_since_detection_updated":"string","detection_updated_since":"string","detection_updated_before":"string","detection_processed_after":"string","detection_processed_before":"string","detection_last_tested_since":"string","detection_last_tested_after":"string","include_ignored":"string","include_disabled":"string","ips":"string","show_igs":"string","ipv6":"string","ag_ids":"string","ag_titles":"string","ids":"string","id_min":"string","id_max":"string","network_ids":"string","compliance_enabled":"string","no_vm_scan_since":"string","no_compliance_scan_since":"string","vm_scan_since":"string","compliance_scan_since":"string","vm_processed_before":"string","vm_processed_after":"string","vm_scan_date_before":"string","vm_scan_date_after":"string","vm_auth_scan_date_before":"string","vm_auth_scan_date_after":"string","scap_scan_since":"string","no_scap_scan_since":"string","truncation_limit":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
HOST_LIST_VM_DETECTION_OUTPUT	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.DATETIME	string	Time value
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.ID	string	Unique identifier
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.IP	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.IP
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.TRACKING_METHOD	string	HTTP method to use
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.OS	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.OS
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS_DATA	object	Response data
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.NETBIOS	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.NETBIOS
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.LAST_SCAN_DATETIME	string	Time value
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.LAST_VM_SCANNED_DATE	string	Date value
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.LAST_VM_SCANNED_DURATION	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.LAST_VM_SCANNED_DURATION
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DETECTION_LIST	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DETECTION_LIST

Output Example

{"HOST_LIST_VM_DETECTION_OUTPUT":{"RESPONSE":{"DATETIME":"string","HOST_LIST":{}}}}

Get Hosts

Retrieve a list of hosts from Qualys Vulnerability Scanner using specified parameters, including the required 'action' parameter.

Endpoint

URL: api/2.0/fo/asset/host/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.details	string	Optional	Parameters for the Get Hosts action
parameters.os_pattern	string	Optional	Parameters for the Get Hosts action
parameters.result_limit	string	Optional	Parameters for the Get Hosts action
parameters.ips	string	Optional	Parameters for the Get Hosts action
parameters.ipv6	string	Optional	Parameters for the Get Hosts action
parameters.ag_ids	string	Optional	Parameters for the Get Hosts action
parameters.ag_titles	string	Optional	Parameters for the Get Hosts action
parameters.ids	string	Optional	Parameters for the Get Hosts action
parameters.id_min	string	Optional	Parameters for the Get Hosts action
parameters.id_max	string	Optional	Parameters for the Get Hosts action
parameters.network_ids	string	Optional	Parameters for the Get Hosts action
parameters.compliance_enabled	string	Optional	Parameters for the Get Hosts action
parameters.no_vm_scan_since	string	Optional	Parameters for the Get Hosts action
parameters.no_compliance_scan_since	string	Optional	Parameters for the Get Hosts action
parameters.vm_scan_since	string	Optional	Parameters for the Get Hosts action
parameters.compliance_scan_since	string	Optional	Parameters for the Get Hosts action
parameters.vm_processed_before	string	Optional	Parameters for the Get Hosts action
parameters.vm_processed_after	string	Optional	Parameters for the Get Hosts action
parameters.vm_scan_date_before	string	Optional	Parameters for the Get Hosts action
parameters.vm_scan_date_after	string	Optional	Parameters for the Get Hosts action
parameters.vm_auth_scan_date_before	string	Optional	Parameters for the Get Hosts action
parameters.vm_auth_scan_date_after	string	Optional	Parameters for the Get Hosts action
parameters.scap_scan_since	string	Optional	Parameters for the Get Hosts action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"details":"string","os_pattern":"string","result_limit":"string","ips":"string","ipv6":"string","ag_ids":"string","ag_titles":"string","ids":"string","id_min":"string","id_max":"string","network_ids":"string","compliance_enabled":"string","no_vm_scan_since":"string","no_compliance_scan_since":"string","vm_scan_since":"string","compliance_scan_since":"string","vm_processed_before":"string","vm_processed_after":"string","vm_scan_date_before":"string","vm_scan_date_after":"string","vm_auth_scan_date_before":"string","vm_auth_scan_date_after":"string","scap_scan_since":"string","no_scap_scan_since":"string","truncation_limit":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
HOST_LIST_OUTPUT	object	Output field: HOST_LIST_OUTPUT
HOST_LIST_OUTPUT.RESPONSE	object	Output field: HOST_LIST_OUTPUT.RESPONSE
HOST_LIST_OUTPUT.RESPONSE.DATETIME	string	Time value
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST	object	Output field: HOST_LIST_OUTPUT.RESPONSE.HOST_LIST
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST	array	Output field: HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.ID	string	Unique identifier
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.IP	string	Output field: HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.IP
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.TRACKING_METHOD	string	HTTP method to use
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS	string	Output field: HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS_DATA	object	Response data
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.NETBIOS	string	Output field: HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.NETBIOS
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.QG_HOSTID	string	Unique identifier
HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.OS	string	Output field: HOST_LIST_OUTPUT.RESPONSE.HOST_LIST.HOST.OS

Output Example

{"HOST_LIST_OUTPUT":{"RESPONSE":{"DATETIME":"string","HOST_LIST":{}}}}

Get Scan Summary

Retrieve a summary of scan results from Qualys Vulnerability Scanner using specified action parameters.

Endpoint

URL: api/2.0/fo/scan/summary/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the Get Scan Summary action
parameters.include_dead	string	Optional	Parameters for the Get Scan Summary action
parameters.include_excluded	string	Optional	Parameters for the Get Scan Summary action
parameters.include_unresolved	string	Optional	Parameters for the Get Scan Summary action
parameters.include_cancelled	string	Optional	Parameters for the Get Scan Summary action
parameters.include_notvuln	string	Optional	Parameters for the Get Scan Summary action
parameters.include_blocked	string	Optional	Parameters for the Get Scan Summary action
parameters.include_duplicate	string	Optional	Parameters for the Get Scan Summary action
parameters.scan_date_since	string	Optional	Parameters for the Get Scan Summary action
parameters.scan_date_to	string	Optional	Parameters for the Get Scan Summary action
parameters.include_aborted	string	Optional	Parameters for the Get Scan Summary action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","include_dead":"string","include_excluded":"string","include_unresolved":"string","include_cancelled":"string","include_notvuln":"string","include_blocked":"string","include_duplicate":"string","scan_date_since":"string","scan_date_to":"string","include_aborted":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SCAN_SUMMARY_OUTPUT	object	Output field: SCAN_SUMMARY_OUTPUT
SCAN_SUMMARY_OUTPUT.RESPONSE	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE
SCAN_SUMMARY_OUTPUT.RESPONSE.DATETIME	string	Time value
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_REF	string	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_REF
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_DATE	string	Date value
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.HOST_SUMMARY	array	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.HOST_SUMMARY

Output Example

{"SCAN_SUMMARY_OUTPUT":{"RESPONSE":{"DATETIME":"string","SCAN_SUMMARY_LIST":{}}}}

Get VM Scan

Initiate a vulnerability management scan in Qualys Vulnerability Scanner using the specified action parameter and retrieve the corresponding scan results.

Endpoint

URL: api/2.0/fo/scan/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the Get VM Scan action
parameters.ips	string	Optional	Parameters for the Get VM Scan action
parameters.scan_ref	string	Optional	Parameters for the Get VM Scan action
parameters.client_id	string	Optional	Parameters for the Get VM Scan action
parameters.client_name	string	Optional	Parameters for the Get VM Scan action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","ips":"string","scan_ref":"string","client_id":"string","client_name":"Example Name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT
SIMPLE_RETURN.RESPONSE.ITEM_LIST	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM	array	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY	string	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE	string	Value for the parameter

Output Example

{"SIMPLE_RETURN":{"RESPONSE":{"DATETIME":"string","TEXT":"string","ITEM_LIST":{}}}}

Get VM Scan Summary

Retrieve a summary of vulnerability scans from Qualys Vulnerability Scanner by specifying the action type and preferred output format.

Endpoint

URL: api/2.0/fo/scan/vm/summary

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the Get VM Scan Summary action
parameters.output_format	string	Required	Parameters for the Get VM Scan Summary action
parameters.scan_reference	string	Optional	Parameters for the Get VM Scan Summary action
parameters.scan_datetime_since	string	Optional	Parameters for the Get VM Scan Summary action
parameters.scan_datetime_until	string	Optional	Parameters for the Get VM Scan Summary action
parameters.include_scan_input	number	Optional	Parameters for the Get VM Scan Summary action
parameters.include_scan_details	number	Optional	Parameters for the Get VM Scan Summary action
parameters.include_hosts_summary	number	Optional	Parameters for the Get VM Scan Summary action
parameters.include_detections_summary	number	Optional	Parameters for the Get VM Scan Summary action
parameters.include_hosts_summary_categories	string	Optional	Parameters for the Get VM Scan Summary action

Input Example

{"parameters":{"action":"list","output_format":"xml","scan_reference":"scan/987654321.98765","scan_datetime_since":"2020-10-01T09:30:48Z","scan_datetime_until":"2020-10-01T09:30:48Z","include_scan_input":0,"include_scan_details":0,"include_hosts_summary":0,"include_detections_summary":0,"include_hosts_summary_categories":"scanned, excluded, cancelled"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
SCAN_SUMMARY_OUTPUT	object	Output field: SCAN_SUMMARY_OUTPUT
SCAN_SUMMARY_OUTPUT.RESPONSE	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE
SCAN_SUMMARY_OUTPUT.RESPONSE.DATETIME	string	Time value
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_REFERENCE	string	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_REFERENCE
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_INPUT	object	Input data for the action
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_DETAILS	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_DETAILS
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_RESULTS	object	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 28 Mar 2023 04:00:03 GMT","Server":"Apache","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, private, must-revalidate, post-check=0, pre-check=0","Pragma":"no-cache","X-Powered-By":"Qualys:USPOD3:438b7047-7854-5181-8116-979356194b02:8217759d-8170-731e...

Host Detection List

Retrieve the latest vulnerability data for hosts from Qualys Vulnerability Scanner using specified parameters and action inputs.

Endpoint

URL: /api/2.0/fo/asset/host/vm/detection/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Specify action=list to list host detection. This parameter is required.
parameters.linux_hostname	number	Optional	Specify 1 to view the hostname in the XML output of the Host List Detection API request. Else, the hostname is not displayed in the XML output. By default this parameter is set to 0.
parameters.echo_request	number	Optional	Specify 1 to view input parameters in the XML output. When unspecified, parameters are not included in the XML output.
parameters.show_asset_id	number	Optional	When set to 1, we show the asset ID of the scanned hosts in the output. The default value is 0. When set to 0, we do not show the asset id information for the scanned hosts.
parameters.show_results	number	Optional	When not specified, results are included in the output. Specify show_results=0 to exclude the results. If you exclude the results, CSV will have an empty Results column, and XML will not contain the Results tag.
parameters.show_reopened_info	number	Optional	When not specified, reopened info for reopened vulnerabilities is not included in the output. Specify show_reopened_info=1 to include reopened info i.e. first/last reopened date and times reopened.
parameters.arf_kernel_filter	number	Optional	Identify vulnerabilities found on running or non-running Linux kernels. When unspecified, vulnerabilities are not filtered based on kernel activity. 0 = no filter (AFFECT_RUNNING_KERNEL appears for kernel related vulnerabilities); 1 = exclude non-exploitable kernel vulnerabilities found on non-running kernels; 2 = only include non-exploitable kernel vulnerabilities (non-running kernels); 3 = only include exploitable kernel vulnerabilities (running kernels); 4 = only include kernel related vulnerabilities. Note: active_kernels_only is deprecated; use arf_kernel_filter instead.
parameters.arf_service_filter	number	Optional	Identify vulnerabilities found on running or non-running ports/services. When unspecified, vulnerabilities are not filtered based on running ports/services. 0 = no filter; 1 = exclude exploitable service vulnerabilities (running ports/services); 2 = only include exploitable service vulnerabilities (running ports/services); 3 = only include non-exploitable service vulnerabilities (non-running ports/services); 4 = only include service related vulnerabilities.
parameters.arf_config_filter	number	Optional	Identify vulnerabilities that may or may not be exploitable due to the current host configuration. When unspecified, vulnerabilities are not filtered based on host configuration. 0 = no filter; 1 = exclude vulnerabilities exploitable due to host configuration; 2 = only include config related vulnerabilities that are exploitable; 3 = only include config related vulnerabilities that are not exploitable; 4 = only include config related vulnerabilities.
parameters.active_kernels_only	number	Optional	(Deprecated - use arf_kernel_filter instead) Identify vulnerabilities related to running and non-running kernels in the AFFECT_RUNNING_KERNEL tag. 0 = no filter; 1 = exclude vulnerabilities found on non-running Linux kernels; 2 = only include vulnerabilities found on non-running Linux kernels; 3 = only include vulnerabilities found on running Linux kernels.
parameters.output_format	string	Optional	Specifies the format of the host detection list output. When not specified, the output format is XML. XML (default); CSV - structured in HEADER_CSV, BODY_CSV and FOOTER_CSV sections; CSV_NO_METADATA - CSV with no header/body/footer sections and no truncation info; CSV_NO_METADATA_MS_EXCEL - CSV with no metadata and MS Excel string length restrictions; CSV_MS_EXCEL - CSV with MS Excel string length restrictions.
parameters.suppress_duplicated_data_from_csv	number	Optional	By default or when set to 0, host details are repeated in each line of detection information in the CSV output. When set to 1, host details are suppressed in each detection line. Must be specified with output_format=CSV or output_format=CSV_NO_METADATA.
parameters.truncation_limit	number	Optional	Specifies the maximum number of host records processed per request. When not specified, the truncation limit is 1000 host records. Specify a value less than the default (1-999) or greater than the default (1001-1000000). Specify 0 for no truncation limit.
parameters.max_days_since_detection_updated	number	Optional	Show only detections whose detection status changed since the maximum number of days you specify. For detections that never changed, the value is applied to the last detection date. Only one of detection_updated_since or max_days_since_detection_updated may be specified in the same request.
parameters.detection_updated_since	string	Optional	Show only detections whose detection status changed after a certain date and time. Valid date format: YYYY-MM-DD[THH:MM:SSZ] (UTC/GMT), like "2017-02-15" or "2017-02-15T23:15:00Z". Only one of detection_updated_since or max_days_since_detection_updated may be specified in the same request.
parameters.detection_updated_before	string	Optional	Show only detections whose detection status changed before a certain date and time. Valid date format: YYYY-MM-DD[THH:MM:SSZ] (UTC/GMT), like "2017-02-15" or "2017-02-15T23:15:00Z".
parameters.detection_processed_before	string	Optional	Show detections with vulnerability scan results processed before a certain date and time. Specify the date in YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like "2016-09-12" or "2016-09-12T23:15:00Z".
parameters.detection_processed_after	string	Optional	Show detections with vulnerability scan results processed after a certain date and time. Specify the date in YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like "2016-09-12" or "2016-09-12T23:15:00Z".
parameters.detection_last_tested_since	string	Optional	Show only detections that were last tested on or after a certain date and time. Valid date format: YYYY-MM-DD[THH:MM:SSZ] (UTC/GMT). Cannot be specified in the same request as detection_last_tested_since_days.
parameters.detection_last_tested_since_days	number	Optional	Show only detections that were last tested within the number of days you specify (for example, tested in the past 10 days). Cannot be specified in the same request as detection_last_tested_since.
parameters.detection_last_tested_before	string	Optional	Show only detections that were last tested before a certain date and time. Valid date format: YYYY-MM-DD[THH:MM:SSZ] (UTC/GMT). Cannot be specified in the same request as detection_last_tested_before_days.
parameters.detection_last_tested_before_days	number	Optional	Show only detections that were last tested before the number of days you specify (for example, tested more than 30 days ago). Cannot be specified in the same request as detection_last_tested_before.
parameters.ids	string	Optional	Show only certain host IDs/ranges. One or more host IDs/ranges may be specified. Multiple entries are comma separated. A host ID range is specified with a hyphen (for example: 190-400). Valid host IDs are required.

Input Example

{"parameters":{"action":"list","linux_hostname":0,"echo_request":0,"show_asset_id":0,"show_results":1,"show_reopened_info":0,"arf_kernel_filter":0,"arf_service_filter":0,"arf_config_filter":0,"active_kernels_only":0,"output_format":"XML","suppress_duplicated_data_from_csv":0,"truncation_limit":1000,"max_days_since_detection_updated":30,"detection_updated_since":"2024-01-01T00:00:00Z","detection_updated_before":"2024-12-31T23:59:59Z","detection_processed_before":"2024-12-31T23:59:59Z","detection_processed_after":"2024-01-01T00:00:00Z","detection_last_tested_since":"2024-01-01T00:00:00Z","detection_last_tested_since_days":30,"detection_last_tested_before":"2024-12-31T23:59:59Z","detection_last_tested_before_days":30,"ids":"190-400","id_min":1,"id_max":100000,"ips":"10.10.10.1-10.10.10.100","ipv6":"2001:db8::1","ag_ids":"386941-386945","ag_titles":"My+First+Asset+Group,Another+Asset+Group","network_ids":"10,20","vm_scan_since":"2024-01-01T00:00:00Z","no_vm_scan_since":"2024-01-01T00:00:00Z","max_days_since_last_vm_scan":30,"vm_processed_before":"2024-12-31T23:59:59Z","vm_processed_after":"2024-01-01T00:00:00Z","vm_scan_date_before":"2024-12-31T23:59:59Z","vm_scan_date_after":"2024-01-01T00:00:00Z","vm_auth_scan_date_before":"2024-12-31T23:59:59Z","vm_auth_scan_date_after":"2024-01-01T00:00:00Z","status":"New,Active,Re-Opened,Fixed","compliance_enabled":0,"os_pattern":"%5EWindows","qids":"68518-68522","severities":"1-5","show_igs":0,"include_search_list_titles":"My+Search+List","exclude_search_list_titles":"Excluded+Search+List","include_search_list_ids":"10-15","exclude_search_list_ids":"40-42","filter_superseded_qids":0,"use_tags":0,"tag_set_by":"id","tag_include_selector":"any","tag_exclude_selector":"any","tag_set_include":"12345,12346","tag_set_exclude":"12347","show_tags":0,"show_qds":1,"qds_min":1,"qds_max":100,"show_qds_factors":1,"host_metadata":"all","host_metadata_fields":"instance-type","show_cloud_tags":0,"cloud_tag_fields":"SomeTag6:AY_ec2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
HOST_LIST_VM_DETECTION_OUTPUT	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.DATETIME	string	Time value
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST	array	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.ID	string	Unique identifier
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.IP	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.IP
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.TRACKING_METHOD	string	HTTP method to use
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.OS	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.OS
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DNS_DATA	object	Response data
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.NETBIOS	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.NETBIOS
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.LAST_SCAN_DATETIME	string	Time value
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.LAST_VM_SCANNED_DATE	string	Date value
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.LAST_VM_SCANNED_DURATION	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.LAST_VM_SCANNED_DURATION
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DETECTION_LIST	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.DETECTION_LIST
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING	object	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.CODE	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.CODE
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.TEXT	string	Output field: HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.TEXT
HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.URL	string	URL endpoint for the request

Output Example

{"status_code":200,"reason":"OK","json_body":{"HOST_LIST_VM_DETECTION_OUTPUT":{"RESPONSE":{}}}}

KnowledgeBase Download

Download the latest vulnerability data from the Qualys KnowledgeBase using specified action parameters.

Endpoint

URL: /api/2.0/fo/knowledge_base/vuln/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Specify action to list and download the knowledgebase. Must be "list".
parameters.echo_request	number	Optional	Specify 1 to include input parameters in the XML output. Default is not included.
parameters.details	string	Optional	Show the requested amount of information for each vulnerability- Basic (default), All, or None.
parameters.ids	number	Optional	Filter to include only vulnerabilities with specified QID numbers.
parameters.id_min	number	Optional	Filter to show only vulnerabilities with QID >= specified value.
parameters.id_max	number	Optional	Filter to show only vulnerabilities with QID <= specified value.
parameters.is_patchable	number	Optional	1 for patchable, 0 for not patchable, unspecified for all.
parameters.last_modified_after	string	Optional	Filter for vulnerabilities last modified after this date (YYYY-MM-DD[THH:MM:SSZ]).
parameters.last_modified_before	string	Optional	Filter for vulnerabilities last modified before this date (YYYY-MM-DD[THH:MM:SSZ]).
parameters.last_modified_by_user_after	string	Optional	Filter for vulnerabilities last modified by a user after this date.
parameters.last_modified_by_user_before	string	Optional	Filter for vulnerabilities last modified by a user before this date.
parameters.last_modified_by_service_after	string	Optional	Filter for vulnerabilities last modified by the service after this date.
parameters.last_modified_by_service_before	string	Optional	Filter for vulnerabilities last modified by the service before this date.
parameters.published_after	string	Optional	Filter for vulnerabilities published after this date.
parameters.published_before	string	Optional	Filter for vulnerabilities published before this date.
parameters.discovery_method	string	Optional	Filter for vulnerabilities by discovery method.
parameters.discovery_auth_types	string	Optional	Filter for vulnerabilities with specified authentication types (comma-separated).
parameters.show_pci_reasons	number	Optional	1 to include PCI reasons in output.
parameters.show_supported_modules_info	number	Optional	1 to include supported modules info in output.
parameters.show_disabled_flag	number	Optional	1 to include the disabled flag for each vulnerability.
parameters.show_qid_change_log	number	Optional	1 to include QID changes for each vulnerability.
parameters.code_modified_after	string	Optional	Show only QIDs modified after this date (YYYY-MM-DD[THH:MM:SSZ]).
parameters.code_modified_before	string	Optional	Show only QIDs modified before this date (YYYY-MM-DD[THH:MM:SSZ]).

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","echo_request":123,"details":"Basic","ids":123,"id_min":123,"id_max":123,"is_patchable":123,"last_modified_after":"string","last_modified_before":"string","last_modified_by_user_after":"string","last_modified_by_user_before":"string","last_modified_by_service_after":"string","last_modified_by_service_before":"string","published_after":"string","published_before":"string","discovery_method":"string","discovery_auth_types":"string","show_pci_reasons":123,"show_supported_modules_info":123,"show_disabled_flag":123,"show_qid_change_log":123,"code_modified_after":"string","code_modified_before":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Output field: file
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","file":{"file":"dfgfdfd34r","file_name":"report_output.csv"}}

Launch Compliance Scan

Initiate a compliance scan in Qualys Vulnerability Scanner using specified parameters and action settings to assess system compliance.

Endpoint

URL: api/2.0/fo/scan/compliance/

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the Launch Compliance Scan action
parameters.scan_title	string	Optional	Parameters for the Launch Compliance Scan action
parameters.option_id	string	Optional	Parameters for the Launch Compliance Scan action
parameters.option_title	string	Optional	Parameters for the Launch Compliance Scan action
parameters.iscanner_id	string	Optional	Parameters for the Launch Compliance Scan action
parameters.iscanner_name	string	Optional	Parameters for the Launch Compliance Scan action
parameters.priority	string	Optional	Parameters for the Launch Compliance Scan action
parameters.ip	string	Optional	Parameters for the Launch Compliance Scan action
parameters.asset_group_ids	string	Optional	Parameters for the Launch Compliance Scan action
parameters.asset_groups	string	Optional	Parameters for the Launch Compliance Scan action
parameters.exclude_ip_per_scan	string	Optional	Parameters for the Launch Compliance Scan action
parameters.default_scanner	string	Optional	Parameters for the Launch Compliance Scan action
parameters.scanners_in_ag	string	Optional	Parameters for the Launch Compliance Scan action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","scan_title":"string","option_id":"string","option_title":"string","iscanner_id":"string","iscanner_name":"Example Name","priority":"string","ip":"string","asset_group_ids":"string","asset_groups":"string","exclude_ip_per_scan":"string","default_scanner":"string","scanners_in_ag":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT
SIMPLE_RETURN.RESPONSE.ITEM_LIST	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM	array	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY	string	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE	string	Value for the parameter

Output Example

{"SIMPLE_RETURN":{"RESPONSE":{"DATETIME":"string","TEXT":"string","ITEM_LIST":{}}}}

Launch VM Scan

Initiate a vulnerability management scan in Qualys Vulnerability Scanner with specified parameters and retrieve the resulting scan status.

Endpoint

URL: /api/2.0/fo/scan/

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
data_body	object	Required	Response data
data_body.action	string	Required	Specify action (list, create, delete, update).
data_body.echo_request	number	Optional	Specify 1 to view (echo) input parameters in the XML output. By default these are not included.
data_body.scan_title	string	Optional	The scan title. This can be a maximum of 2000 characters (ascii).
data_body.target_from	string	Optional	Specify "assets" (the default) when your scan target will include IP addresses/ranges and/or asset groups. Specify "tags" when your scan target will include asset tags.
data_body.ip	string	Optional	The IP addresses to be scanned. You may enter individual IP addresses and/or ranges. Multiple entries are comma separated. One of these parameters is required ip,asset_groups or asset_group_ids.ip is valid only when target_from=assets is specified.
data_body.asset_groups	string	Optional	The titles of asset groups containing the hosts to be scanned. Multiple titles are comma separated. One of these parameters is required ip, asset_groups or asset_group_ids, asset_groups is valid only when target_from=assets is specified. These parameters are mutually exclusive and cannot bespecified in the same request asset_groups and asset_group_ids.
data_body.asset_group_ids	string	Optional	The IDs of asset groups containing the hosts to be scanned. Multiple IDs are comma separated. One of these parameters is required ip, asset_groups or asset_group_ids. asset_group_ids is valid only when target_from=assets is specified. These parameters are mutually exclusive and cannot be specified in the same request asset_groups and asset_group_ids.
data_body.exclude_ip_per_scan	string	Optional	The IP addresses to be excluded from the scan when the scan target is specified as IP addresses (not asset tags). You may enter individual IP addresses and/or ranges. Multiple entries are comma separated. exclude_ip_per_scan is valid only when target_from=assets is specified.
data_body.tag_include_selector	string	Optional	Select "any" (the default) to include hosts that match at least one of the selected tags. Select "all" to include hosts that match all of the selected tags. tag_include_selector is valid only when target_from=tags isspecified.
data_body.tag_exclude_selector	string	Optional	Select "any" (the default) to exclude hosts that match at least one of the selected tags. Select "all" to exclude hosts that match all of the selected tags. tag_exclude_selector is valid only when target_from=tags isspecified.
data_body.tag_set_by	string	Optional	Specify "id" (the default) to select a tag set by providing tag IDs. Specify "name" to select a tag set by providing tag names. tag_set_by is valid only when target_from=tags is specified.
data_body.tag_set_include	string	Optional	Specify a tag set to include. Hosts that match these tags will be included. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated. tag_set_include is valid only when target_from=tags is specified.
data_body.tag_set_exclude	string	Optional	Specify a tag set to exclude. Hosts that match these tags will be excluded. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated. tag_set_exclude is valid only when target_from=tags is specified.
data_body.use_ip_nt_range_tags_include	number	Optional	Specify “0” (the default) to select from all tags (tags with any tag rule). Specify “1” to scan all IP addresses defined in tag selection. When this is specified, only tags with the dynamic IP address rule called “IP address in Network Range(s)” can be selected. use_ip_nt_range_tags_include is valid only when target_from=tags is specified.
data_body.use_ip_nt_range_tags_exclude	number	Optional	Specify “0” (the default) to select from all tags (tags with any tag rule). Specify “1” to exclude all IP addresses defined in tag selection. When this is specified, only tags with the dynamic IP address rule called “IP address in Network Range(s)” can be selected. use_ip_nt_range_tags_exclude is valid only when target_from=tags is specified.
data_body.use_ip_nt_range_tags	number	Optional	Specify 0 (the default) to select from all tags (tags with any tag rule). Specify 1 to scan all IP addresses defined in tags. When this is specified, only tags with the dynamic IP address rule called "IP address in Network Range(s)" can be selected. This parameter has been replaced by use_ip_nt_range_tags_include and use_ip_nt_range_tags_exclude parameters. The use_ip_nt_range_tag parameter is still supported. use_ip_nt_range_tags is valid only when target_from=tags is specified.
data_body.iscanner_id	string	Optional	The IDs of the scanner appliances to be used. Multiple entries are comma separated. For an Express Lite user, Internal Scanning must be enabled in the user's account. One of these parameters must also be specified in a request iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. These parameters are mutually exclusive and cannot be specified in the same request iscanner_id and iscanner_name.
data_body.iscanner_name	string	Optional	The friendly names of the scanner appliances to be used or "External" for external scanners. Multiple entries are comma separated. For an Express Lite user, Internal Scanning must be enabled in the user's account. One of these parameters must be specified in a request for an internal scan iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. These parameters are mutually exclusive and cannot be specified in the same request iscanner_id and iscanner_name.
data_body.default_scanner	number	Optional	Specify 1 to use the default scanner in each target asset group. For an Express Lite user, Internal Scanning must be enabled in the user's account. One of these parameters must be specified in a request for an internal scan iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. default_scanner is valid when the scan target is specified using one of these parameters asset_groups, asset_group_ids.
data_body.scanners_in_ag	number	Optional	Groups scanner appliances. Appliances in each asset group are tasked with scanning the IPs in the group. By default up to 5 appliances per group will be used and this can be configured for your account (please contact your Account Manager or Support). For an Express Lite user, Internal Scanning must be enabled in the user's account. One of these parameters must be specified in a request for an internal scan iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. scanners_in_ag is valid when the scan target is specified using one of these parameters asset_groups, asset_group_ids.
data_body.scanners_in_tagset	number	Optional	Specify 1 to distribute the scan to scanner appliances that match the asset tags specified for the scan target. One of these parameters must be specified in a request for an internal scan iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. scanners_in_tagset is valid when the target_from=tags is specified.
data_body.scanners_in_network	number	Optional	Specify 1 to distribute the scan to all scanner appliances in the network.

Input Example

{"headers":{"X-Requested-With":"string"},"data_body":{"action":"launch","echo_request":123,"scan_title":"string","target_from":"assets","ip":"string","asset_groups":"string","asset_group_ids":"string","exclude_ip_per_scan":"string","tag_include_selector":"any","tag_exclude_selector":"any","tag_set_by":"id","tag_set_include":"string","tag_set_exclude":"string","use_ip_nt_range_tags_include":123,"use_ip_nt_range_tags_exclude":123,"use_ip_nt_range_tags":123,"iscanner_id":"string","iscanner_name":"Example Name","default_scanner":1,"scanners_in_ag":123,"scanners_in_tagset":123,"scanners_in_network":123,"option_title":"string","option_id":123,"priority":123,"connector_name":"Example Name","ec2_endpoint":"string","ec2_instance_ids":"string","ip_network_id":123,"runtime_http_header":"string","scan_type":"certview","fqdn":"string","client_id":123,"client_name":"Example Name","include_agent_targets":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT
SIMPLE_RETURN.RESPONSE.ITEM_LIST	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM	array	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY	string	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE	string	Value for the parameter

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{"SIMPLE_RETURN":{"RESPONSE":{}}}}

Launch VM Scan on EC2 Assets

Initiate a vulnerability scan on Amazon EC2 assets using Qualys and return detailed scan status based on the provided configuration.

Endpoint

URL: /api/2.0/fo/scan/

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
data_body	object	Required	Response data
data_body.action	string	Required	Specify action (list, create, delete, update).
data_body.echo_request	number	Optional	Specify 1 to view (echo) input parameters in the XML output. By default these are not included.
data_body.scan_title	string	Optional	The scan title. This can be a maximum of 2000 characters (ascii).
data_body.target_from	string	Optional	Specify "assets" (the default) when your scan target will include IP addresses/ranges and/or asset groups. Specify "tags" when your scan target will include asset tags.
data_body.ip	string	Optional	The IP addresses to be scanned. You may enter individual IP addresses and/or ranges. Multiple entries are comma separated. One of these parameters is required ip,asset_groups or asset_group_ids.ip is valid only when target_from=assets is specified.
data_body.asset_groups	string	Optional	The titles of asset groups containing the hosts to be scanned. Multiple titles are comma separated. One of these parameters is required ip, asset_groups or asset_group_ids, asset_groups is valid only when target_from=assets is specified. These parameters are mutually exclusive and cannot bespecified in the same request asset_groups and asset_group_ids.
data_body.asset_group_ids	string	Optional	The IDs of asset groups containing the hosts to be scanned. Multiple IDs are comma separated. One of these parameters is required ip, asset_groups or asset_group_ids. asset_group_ids is valid only when target_from=assets is specified. These parameters are mutually exclusive and cannot be specified in the same request asset_groups and asset_group_ids.
data_body.exclude_ip_per_scan	string	Optional	The IP addresses to be excluded from the scan when the scan target is specified as IP addresses (not asset tags). You may enter individual IP addresses and/or ranges. Multiple entries are comma separated. exclude_ip_per_scan is valid only when target_from=assets is specified.
data_body.tag_include_selector	string	Optional	Select "any" (the default) to include hosts that match at least one of the selected tags. Select "all" to include hosts that match all of the selected tags. tag_include_selector is valid only when target_from=tags isspecified.
data_body.tag_exclude_selector	string	Optional	Select "any" (the default) to exclude hosts that match at least one of the selected tags. Select "all" to exclude hosts that match all of the selected tags. tag_exclude_selector is valid only when target_from=tags isspecified.
data_body.tag_set_by	string	Optional	Specify "id" (the default) to select a tag set by providing tag IDs. Specify "name" to select a tag set by providing tag names. tag_set_by is valid only when target_from=tags is specified.
data_body.tag_set_include	string	Optional	Specify a tag set to include. Hosts that match these tags will be included. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated. tag_set_include is valid only when target_from=tags is specified.
data_body.tag_set_exclude	string	Optional	Specify a tag set to exclude. Hosts that match these tags will be excluded. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated. tag_set_exclude is valid only when target_from=tags is specified.
data_body.use_ip_nt_range_tags_include	number	Optional	Specify “0” (the default) to select from all tags (tags with any tag rule). Specify “1” to scan all IP addresses defined in tag selection. When this is specified, only tags with the dynamic IP address rule called “IP address in Network Range(s)” can be selected. use_ip_nt_range_tags_include is valid only when target_from=tags is specified.
data_body.use_ip_nt_range_tags_exclude	number	Optional	Specify “0” (the default) to select from all tags (tags with any tag rule). Specify “1” to exclude all IP addresses defined in tag selection. When this is specified, only tags with the dynamic IP address rule called “IP address in Network Range(s)” can be selected. use_ip_nt_range_tags_exclude is valid only when target_from=tags is specified.
data_body.use_ip_nt_range_tags	number	Optional	Specify 0 (the default) to select from all tags (tags with any tag rule). Specify 1 to scan all IP addresses defined in tags. When this is specified, only tags with the dynamic IP address rule called "IP address in Network Range(s)" can be selected. This parameter has been replaced by use_ip_nt_range_tags_include and use_ip_nt_range_tags_exclude parameters. The use_ip_nt_range_tag parameter is still supported. use_ip_nt_range_tags is valid only when target_from=tags is specified.
data_body.iscanner_id	string	Optional	The IDs of the scanner appliances to be used. Multiple entries are comma separated. For an Express Lite user, Internal Scanning must be enabled in the user's account. One of these parameters must also be specified in a request iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. These parameters are mutually exclusive and cannot be specified in the same request iscanner_id and iscanner_name.
data_body.iscanner_name	string	Optional	The friendly names of the scanner appliances to be used or "External" for external scanners. Multiple entries are comma separated. For an Express Lite user, Internal Scanning must be enabled in the user's account. One of these parameters must be specified in a request for an internal scan iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. These parameters are mutually exclusive and cannot be specified in the same request iscanner_id and iscanner_name.
data_body.default_scanner	number	Optional	Specify 1 to use the default scanner in each target asset group. For an Express Lite user, Internal Scanning must be enabled in the user's account. One of these parameters must be specified in a request for an internal scan iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. default_scanner is valid when the scan target is specified using one of these parameters asset_groups, asset_group_ids.
data_body.scanners_in_ag	number	Optional	Groups scanner appliances. Appliances in each asset group are tasked with scanning the IPs in the group. By default up to 5 appliances per group will be used and this can be configured for your account (please contact your Account Manager or Support). For an Express Lite user, Internal Scanning must be enabled in the user's account. One of these parameters must be specified in a request for an internal scan iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. scanners_in_ag is valid when the scan target is specified using one of these parameters asset_groups, asset_group_ids.
data_body.scanners_in_tagset	number	Optional	Specify 1 to distribute the scan to scanner appliances that match the asset tags specified for the scan target. One of these parameters must be specified in a request for an internal scan iscanner_name, iscanner_id, default_scanner, scanners_in_ag, scanners_in_tagset. When none of these are specified, External scanners are used. scanners_in_tagset is valid when the target_from=tags is specified.
data_body.scanners_in_network	number	Optional	Specify 1 to distribute the scan to all scanner appliances in the network.

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT
SIMPLE_RETURN.RESPONSE.ITEM_LIST	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM	array	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY	string	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE	string	Value for the parameter

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{"SIMPLE_RETURN":{"RESPONSE":{}}}}

List Asset Groups

Retrieve a list of asset groups from Qualys Vulnerability Scanner using the specified action parameter.

Endpoint

URL: api/2.0/fo/asset/group/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List Asset Groups action
parameters.ids	string	Optional	Parameters for the List Asset Groups action
parameters.id_min	string	Optional	Parameters for the List Asset Groups action
parameters.id_max	string	Optional	Parameters for the List Asset Groups action
parameters.network_ids	string	Optional	Parameters for the List Asset Groups action
parameters.unit_id	string	Optional	Parameters for the List Asset Groups action
parameters.user_id	string	Optional	Parameters for the List Asset Groups action
parameters.title	string	Optional	Parameters for the List Asset Groups action
parameters.truncation_limit	string	Optional	Parameters for the List Asset Groups action
parameters.show_attributes	string	Optional	Parameters for the List Asset Groups action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","ids":"string","id_min":"string","id_max":"string","network_ids":"string","unit_id":"string","user_id":"string","title":"string","truncation_limit":"string","show_attributes":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ASSET_GROUP_LIST_OUTPUT	object	Output field: ASSET_GROUP_LIST_OUTPUT
ASSET_GROUP_LIST_OUTPUT.RESPONSE	object	Output field: ASSET_GROUP_LIST_OUTPUT.RESPONSE
ASSET_GROUP_LIST_OUTPUT.RESPONSE.DATETIME	string	Time value
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST	object	Output field: ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP	array	Output field: ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.ID	string	Unique identifier
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.TITLE	string	Output field: ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.TITLE
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.LAST_UPDATE	string	Date value
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.BUSINESS_IMPACT	string	Output field: ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.BUSINESS_IMPACT
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.IP_SET	object	Output field: ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.IP_SET
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.DOMAIN_LIST	object	Output field: ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.DOMAIN_LIST
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.OWNER_USER_NAME	string	Name of the resource
ASSET_GROUP_LIST_OUTPUT.RESPONSE.ASSET_GROUP_LIST.ASSET_GROUP.OWNER_USER_ID	string	Unique identifier

Output Example

{"ASSET_GROUP_LIST_OUTPUT":{"RESPONSE":{"DATETIME":"string","ASSET_GROUP_LIST":{}}}}

List Compliance Policy

Retrieve a list of compliance policies from Qualys Vulnerability Scanner based on the specified action parameter.

Endpoint

URL: api/2.0/fo/compliance/policy/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List Compliance Policy action
parameters.details	string	Optional	Parameters for the List Compliance Policy action
parameters.ids	string	Optional	Parameters for the List Compliance Policy action
parameters.id_min	string	Optional	Parameters for the List Compliance Policy action
parameters.id_max	string	Optional	Parameters for the List Compliance Policy action
parameters.updated_after_datetime	string	Optional	Parameters for the List Compliance Policy action
parameters.created_after_datetime	string	Optional	Parameters for the List Compliance Policy action

Input Example

Output

Output Example

{"POLICY_LIST_OUTPUT":{"RESPONSE":{"DATETIME":"string","POLICY_LIST":{},"GLOSSARY":{}}}}

List Compliance Posture Information

Retrieve compliance posture details for hosts, including IDs and attributes, from your Qualys account using specified parameters.

Endpoint

URL: /api/2.0/fo/compliance/posture/info

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.type	object	Optional	Parameters for the List Compliance Posture Information action
parameters.action	string	Required	Specify action to list posture compliance Information.
parameters.echo_request	number	Optional	Specify 1 to view (echo) input parameters in the XML output. By default these are not included.
parameters.policy_id	number	Optional	Show compliance posture info records for a specified policy. A valid policy ID is required. The parameters policy_id and policy_ids cannot be specified in the same request.
parameters.policy_ids	string	Optional	(policy_id or policy_ids is required) Show compliance posture info records for multiple policies - up to 10 policies may be requested. Provide a comma-separated list of valid policy IDs.
parameters.control_ids	string	Optional	Show only compliance posture info records for controls which have certain control IDs and/or ranges.
parameters.output_format	string	Optional	The output format.
parameters.details	string	Optional	Show a certain amount of information for each compliance posture info record.
parameters.hide_evidence	number	Optional	Set to 1 to hide the evidence information in the output.
parameters.include_dp_name	string	Optional	Show the name and ID for each data point in the XML output.
parameters.show_remediation_info	number	Optional	Set to 1 to show remediation information in the output.
parameters.cause_of_failure	number	Optional	Set to 1 to display the cause of failure for Directory Integrity Monitoring UDCs.
parameters.truncation_limit	number	Optional	Specify the number of posture info records returned per request. Set to 0 for no truncation.
parameters.ips	string	Optional	Show only compliance posture info records for hosts with certain IP addresses/ranges.
parameters.host_ids	string	Optional	Show only compliance posture info records for hosts with certain host IDs and/or ID ranges.
parameters.asset_group_ids	string	Optional	Show only hosts in certain asset groups.
parameters.filter_hosts	number	Optional	Improve performance by skipping tag resolution service.
parameters.ids	string	Optional	Show only compliance posture info records for certain posture IDs and/or ID ranges.
parameters.id_min	number	Optional	Show posture info records with minimum ID value.
parameters.id_max	number	Optional	Show posture info records with maximum ID value.
parameters.status_changes_since	string	Optional	Show records with status changes since specified datetime.
parameters.evaluation_date	string	Optional	Show records with evaluation date >= specified datetime.
parameters.status	string	Optional	Show records with specified posture status.

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"type":{},"action":"list","echo_request":123,"policy_id":123,"policy_ids":"string","control_ids":"string","output_format":"xml","details":"string","hide_evidence":123,"include_dp_name":"Example Name","show_remediation_info":123,"cause_of_failure":123,"truncation_limit":123,"ips":"string","host_ids":"string","asset_group_ids":"string","filter_hosts":123,"ids":"string","id_min":123,"id_max":123,"status_changes_since":"active","evaluation_date":"string","status":"active","criticality_labels":"string","criticality_values":"string","tag_set_by":"string","tag_include_selector":"string","tag_exclude_selector":"string","tag_set_include":"string","tag_set_exclude":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":{}}

List IPs

Retrieve a list of IP addresses from Qualys Vulnerability Scanner using specified parameters such as 'ips' and 'action'.

Endpoint

URL: api/2.0/fo/asset/ip/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List IPs action
parameters.ips	string	Required	Parameters for the List IPs action
parameters.compliance_enabled	string	Optional	Parameters for the List IPs action
parameters.certview_enabled	string	Optional	Parameters for the List IPs action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","ips":"string","compliance_enabled":"string","certview_enabled":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
IP_LIST_OUTPUT	object	Output field: IP_LIST_OUTPUT
IP_LIST_OUTPUT.RESPONSE	object	Output field: IP_LIST_OUTPUT.RESPONSE
IP_LIST_OUTPUT.RESPONSE.DATETIME	string	Time value
IP_LIST_OUTPUT.RESPONSE.IP_SET	object	Output field: IP_LIST_OUTPUT.RESPONSE.IP_SET
IP_LIST_OUTPUT.RESPONSE.IP_SET.IP	array	Output field: IP_LIST_OUTPUT.RESPONSE.IP_SET.IP
IP_LIST_OUTPUT.RESPONSE.IP_SET.IP_RANGE	array	Output field: IP_LIST_OUTPUT.RESPONSE.IP_SET.IP_RANGE

Output Example

{"IP_LIST_OUTPUT":{"RESPONSE":{"DATETIME":"string","IP_SET":{}}}}

List Networks

Retrieve a list of networks from Qualys Vulnerability Scanner based on the specified action parameter.

Endpoint

URL: api/2.0/fo/network/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List Networks action
parameters.ids	string	Optional	Parameters for the List Networks action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","ids":"string"}}

List Reports

Retrieve various report types, including scorecard reports, from a Qualys account by specifying the desired action parameter.

Endpoint

URL: /api/2.0/fo/report/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Specify action to list reports.
parameters.echo_request	number	Optional	Specify 1 to view (echo) input parameters in the XML output. By default these are not included.
parameters.id	number	Optional	Specifies a report ID of a report that is saved in the Report Share storage space. When specified, information on the selected report will be included in the XML output.
parameters.state	string	Optional	Specifies that reports with a certain state will be included in the XML output. By default, all states are included.
parameters.user_login	number	Optional	Specifies a user login ID. This parameter is used to restrict the XML output to reports launched by the specified user login ID.
parameters.expires_before_datetime	string	Optional	Specifies the date and time (optional) when reports will expire in the future. Only reports that expire before this date/time will be included in the XML output. The date/time is specified in YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like "2007-07-01" or "2007-01-25T23:12:00Z".
parameters.client_id	number	Optional	ID assigned to the client (Consultant subscription only). Parameter client_id or client_name may be specified for the same request.
parameters.client_name	string	Optional	Name of the client (Consultant subscription only). Parameter client_id or client_name may be specified for the same request.

Input Example

{"parameters":{"action":"list","echo_request":0,"id":232123,"state":"Running","user_login":21331,"expires_before_datetime":"2007-01-25T23:12:00Z","client_id":54312435,"client_name":"test"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response	object	Output field: response
response.reports	array	List of reports
response.datetime	string	Datetime of the request

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

List Restricted IPs

Retrieve a list of restricted IP addresses from Qualys Vulnerability Scanner based on the specified action parameter.

Endpoint

URL: api/2.0/fo/setup/restricted_ips/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List Restricted IPs action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
RESTRICTED_IPS_OUTPUT	object	Output field: RESTRICTED_IPS_OUTPUT
RESTRICTED_IPS_OUTPUT.RESPONSE	object	Output field: RESTRICTED_IPS_OUTPUT.RESPONSE
RESTRICTED_IPS_OUTPUT.RESPONSE.DATETIME	string	Time value
RESTRICTED_IPS_OUTPUT.RESPONSE.STATUS	string	Status value

Output Example

{"RESTRICTED_IPS_OUTPUT":{"RESPONSE":{"DATETIME":"string","STATUS":"active"}}}

List SCAP Policy

Retrieve a list of SCAP policies from Qualys Vulnerability Scanner for compliance assessments using the specified action parameter.

Endpoint

URL: api/2.0/fo/compliance/fdcc_policy/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List SCAP Policy action
parameters.details	string	Optional	Parameters for the List SCAP Policy action
parameters.ids	string	Optional	Parameters for the List SCAP Policy action
parameters.id_min	string	Optional	Parameters for the List SCAP Policy action
parameters.id_max	string	Optional	Parameters for the List SCAP Policy action
parameters.updated_after_datetime	string	Optional	Parameters for the List SCAP Policy action
parameters.created_after_datetime	string	Optional	Parameters for the List SCAP Policy action

Input Example

List SCAP Scans

Retrieve a list of SCAP scans from Qualys Vulnerability Scanner based on specified action parameters.

Endpoint

URL: api/2.0/fo/scan/scap/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List SCAP Scans action
parameters.scan_ref	string	Optional	Parameters for the List SCAP Scans action
parameters.scan_id	string	Optional	Parameters for the List SCAP Scans action
parameters.state	string	Optional	Parameters for the List SCAP Scans action
parameters.processed	string	Optional	Parameters for the List SCAP Scans action
parameters.type	string	Optional	Parameters for the List SCAP Scans action
parameters.target	string	Optional	Parameters for the List SCAP Scans action
parameters.user_login	string	Optional	Parameters for the List SCAP Scans action
parameters.launched_after_datetime	string	Optional	Parameters for the List SCAP Scans action
parameters.launched_before_datetime	string	Optional	Parameters for the List SCAP Scans action
parameters.client_id	string	Optional	Parameters for the List SCAP Scans action
parameters.client_name	string	Optional	Parameters for the List SCAP Scans action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","scan_ref":"string","scan_id":"string","state":"string","processed":"string","type":"string","target":"string","user_login":"string","launched_after_datetime":"string","launched_before_datetime":"string","client_id":"string","client_name":"Example Name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SCAN_LIST_OUTPUT	object	Output field: SCAN_LIST_OUTPUT
SCAN_LIST_OUTPUT.RESPONSE	object	Output field: SCAN_LIST_OUTPUT.RESPONSE
SCAN_LIST_OUTPUT.RESPONSE.DATETIME	string	Time value
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST	object	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN	object	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.ID	string	Unique identifier
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.REF	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.REF
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TYPE	string	Type of the resource
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TITLE	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TITLE
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.POLICY	object	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.POLICY
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.USER_LOGIN	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.USER_LOGIN
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.LAUNCH_DATETIME	string	Time value
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.STATUS	object	Status value
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TARGET	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TARGET

Output Example

{"SCAN_LIST_OUTPUT":{"RESPONSE":{"DATETIME":"string","SCAN_LIST":{}}}}

List Virtual Hosts

Retrieve a list of virtual hosts from Qualys Vulnerability Scanner based on the specified action parameter.

Endpoint

URL: api/2.0/fo/asset/vhost/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List Virtual Hosts action
parameters.ip	string	Optional	Parameters for the List Virtual Hosts action
parameters.port	string	Optional	Parameters for the List Virtual Hosts action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"action":"string","ip":"string","port":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
VIRTUAL_HOST_LIST_OUTPUT	object	Output field: VIRTUAL_HOST_LIST_OUTPUT
VIRTUAL_HOST_LIST_OUTPUT.RESPONSE	object	Output field: VIRTUAL_HOST_LIST_OUTPUT.RESPONSE
VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.DATETIME	string	Time value
VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST	object	Output field: VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST
VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST.VIRTUAL_HOST	object	Output field: VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST.VIRTUAL_HOST
VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST.VIRTUAL_HOST.IP	string	Output field: VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST.VIRTUAL_HOST.IP
VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST.VIRTUAL_HOST.PORT	string	Output field: VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST.VIRTUAL_HOST.PORT
VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST.VIRTUAL_HOST.FQDN	string	Output field: VIRTUAL_HOST_LIST_OUTPUT.RESPONSE.VIRTUAL_HOST_LIST.VIRTUAL_HOST.FQDN

Output Example

{"VIRTUAL_HOST_LIST_OUTPUT":{"RESPONSE":{"DATETIME":"string","VIRTUAL_HOST_LIST":{}}}}

List VM scans

Retrieve a list of vulnerability management scans from the past 30 days in Qualys Vulnerability Scanner using the required 'action' parameter.

Endpoint

URL: api/2.0/fo/scan/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the List VM scans action
parameters.echo_request	number	Optional	Parameters for the List VM scans action
parameters.scan_ref	string	Optional	Parameters for the List VM scans action
parameters.scan_id	string	Optional	Parameters for the List VM scans action
parameters.state	string	Optional	Parameters for the List VM scans action
parameters.processed	number	Optional	Parameters for the List VM scans action
parameters.type	string	Optional	Parameters for the List VM scans action
parameters.target	string	Optional	Parameters for the List VM scans action
parameters.user_login	string	Optional	Parameters for the List VM scans action
parameters.launched_after_datetime	string	Optional	Parameters for the List VM scans action
parameters.launched_before_datetime	string	Optional	Parameters for the List VM scans action
parameters.client_id	string	Optional	Parameters for the List VM scans action
parameters.client_name	string	Optional	Parameters for the List VM scans action
parameters.show_ags	number	Optional	Parameters for the List VM scans action
parameters.show_op	number	Optional	Parameters for the List VM scans action
parameters.show_status	number	Optional	Parameters for the List VM scans action
parameters.show_last	number	Optional	Parameters for the List VM scans action
parameters.pci_only	number	Optional	Parameters for the List VM scans action
parameters.ignore_target	number	Optional	Parameters for the List VM scans action

Input Example

{"parameters":{"action":"list","echo_request":0,"scan_ref":"scan/987659876.19876","scan_id":"scan id","state":"Running, Paused, Canceled, Finished, Error, Queued","processed":0,"type":"On-Demand","target":"10.10.10.1-10.10.10.2","user_login":"demouser","launched_after_datetime":"2017-01-25T23:12:00Z","launched_before_datetime":"2017-01-25T23:12:00Z","client_id":"client id","client_name":"client name","show_ags":0,"show_op":0,"show_status":0,"show_last":0,"pci_only":0,"ignore_target":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SCAN_LIST_OUTPUT	object	Output field: SCAN_LIST_OUTPUT
SCAN_LIST_OUTPUT.RESPONSE	object	Output field: SCAN_LIST_OUTPUT.RESPONSE
SCAN_LIST_OUTPUT.RESPONSE.DATETIME	string	Time value
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST	object	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN	array	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.REF	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.REF
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TYPE	string	Type of the resource
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TITLE	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TITLE
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.USER_LOGIN	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.USER_LOGIN
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.LAUNCH_DATETIME	string	Time value
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.DURATION	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.DURATION
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.PROCESSING_PRIORITY	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.PROCESSING_PRIORITY
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.PROCESSED	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.PROCESSED
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.STATUS	object	Status value
SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TARGET	string	Output field: SCAN_LIST_OUTPUT.RESPONSE.SCAN_LIST.SCAN.TARGET

Output Example

List VM Scans by Post Method

Retrieve recent vulnerability management scans from Qualys within the last 30 days using the POST method. Requires a data_body input for scan parameters.

Endpoint

URL: api/2.0/fo/scan/

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
data_body	object	Required	Response data
data_body.action	string	Required	A flag used to make a request for a scan list.
data_body.echo_request	number	Optional	Specify 1 to view (echo) input parameters in the XML output. By default these are not included.
data_body.scan_ref	string	Optional	Show only a scan with a certain scan reference code. For a vulnerability scan, format is scan/987659876.19876. For a compliance scan format is compliance/98765456.12345. For a SCAP scan format is qscap/987659999.22222.
data_body.scan_id	string	Optional	Show only a scan with a certain compliance scan ID.
data_body.state	string	Optional	Show only scans with one or more scan states. Multiple states are comma separated. A valid value is Running, Paused, Canceled, Finished, Error, Queued (scan job is waiting to be distributed to scanners), or Loading (scanners are finished and scan results are being loaded onto the platform).
data_body.processed	number	Optional	Specify 0 to show only scans that are not processed. Specify 1 to show only scans that have been processed. When not specified, the scan list output is not filtered based on the processed status.
data_body.type	string	Optional	Show only a certain scan type. By default, the scan list is not restricted to a certain scan type. A valid value is On-Demand, Scheduled, or API.
data_body.target	string	Optional	Show only one or more target IP addresses. By default, the scan list includes all scans on all IP addresses. Multiple IP addresses and/or ranges may be entered. Multiple entries are comma separated. You may enter an IP address range using the hyphen (-) to separate the start and end IP address, as in 10.10.10.1-10.10.10.2.
data_body.user_login	string	Optional	Show only a certain user login. The user login identifies a user who launched scans. By default, the scan list is not restricted to scans launched by a particular user. Enter the login name for a valid Qualys user account.
data_body.launched_after_datetime	string	Optional	Show only scans launched after a certain date and time (optional). The date/time is specified in YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like "2017-07-01" or "2017-01-25T23:12:00Z". When launched_after_datetime and launched_before_datetime are unspecified, the service selects scans launched within the past 30 days. A date/time in the future returns an empty scans list.
data_body.launched_before_datetime	string	Optional	Show only scans launched before a certain date and time (optional). The date/time is specified in YYYY-MM-DD[THH:MM:SSZ] format (UTC/GMT), like "2017-07-01" or "2017-01-25T23:12:00Z". When launched_after_datetime and launched_before_datetime are unspecified, the service selects scans launched within the past 30 days. A date/time in the future returns a list of all scans (not limited to scans launched within the past 30 days).
data_body.client_id	string	Optional	Id assigned to the client (Consultant type subscription only). Parameter client_id or client_name may be specified for the same request.
data_body.client_name	string	Optional	Name of the client (Consultant type subscription only). Parameter client_id or client_name may be specified for the same request.
data_body.show_ags	number	Optional	Specify 1 to show asset group information for each scan in the XML output. By default, asset group information is not shown.
data_body.show_op	number	Optional	Specify 1 to show option profile information for each scan in the XML output. By default, option profile information is not shown.
data_body.show_status	number	Optional	Specify 0 to not show scan status for each scan in the XML output. By default, scan status is shown.
data_body.show_last	number	Optional	Specify 1 to show only the most recent scan (which meets all other search filters in the request) in the XML output. By default, all scans are shown in XML output.
data_body.pci_only	number	Optional	Specify 1 to show only external PCI scans in the XML output. External PCI scans are vulnerability scans run with the option profile "Payment Card Industry (PCI) Options". When pci_only=1 is specified, the XML output will not include other types of scans run with other option profiles.
data_body.ignore_target	number	Optional	Specify 1 to hide target information from the scan list. Specify 0 to display the target information.

Input Example

{"data_body":{"action":"list","echo_request":0,"scan_ref":"scan/987659876.19876","scan_id":"","state":"Running","processed":0,"type":"On-Demand","target":"10.10.10.1-10.10.10.2","user_login":"demouser","launched_after_datetime":"2017-01-25T23:12:00Z","launched_before_datetime":"2017-01-25T23:12:00Z","client_id":"","client_name":"","show_ags":0,"show_op":0,"show_status":0,"show_last":0,"pci_only":0,"ignore_target":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SCAN_LIST_OUTPUT	object	Output field: SCAN_LIST_OUTPUT
SCAN_LIST_OUTPUT.RESPONSE	object	Output field: SCAN_LIST_OUTPUT.RESPONSE
SCAN_LIST_OUTPUT.RESPONSE.DATETIME	string	Time value

Output Example

Manage VM Scans

Manage vulnerability scans in Qualys by starting, stopping, or pausing scans using the specified scan reference and action parameters.

Endpoint

URL: api/2.0/fo/scan/

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.action	string	Required	Parameters for the Manage VM Scans action
parameters.echo_request	number	Optional	Parameters for the Manage VM Scans action
parameters.scan_ref	string	Required	Parameters for the Manage VM Scans action
parameters.ips	string	Optional	Parameters for the Manage VM Scans action
parameters.mode	string	Optional	Parameters for the Manage VM Scans action
parameters.output_format	string	Optional	Parameters for the Manage VM Scans action
parameters.client_id	string	Optional	Parameters for the Manage VM Scans action
parameters.client_name	string	Optional	Parameters for the Manage VM Scans action

Input Example

{"parameters":{"action":"fetch","echo_request":0,"scan_ref":"987659876.19876","ips":"10.10.10.1-10.10.10.20, 10.10.10.3","mode":"brief","output_format":"json","client_id":"test","client_name":"John"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 30 Mar 2023 07:21:33 GMT","Server":"Apache","X-XSS-Protection":"1; mode=block","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, private, must-revalidate, post-check=0, pre-check=0","Pragma":"no-cache","X-Powered-By":"Qualys:USPOD3:438b7047-7854-5181-8116-979356194b02:8217759d-8170-731e...

Patch List

Retrieve a list of applicable patches for a specified host in Qualys Vulnerability Scanner using the provided host_id.

Endpoint

URL: api/2.0/fo/asset/patch/index.php

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
parameters.host_id	string	Required	Parameters for the Patch List action

Input Example

{"headers":{"X-Requested-With":"string"},"parameters":{"host_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
PATCH_LIST_OUTPUT	object	Output field: PATCH_LIST_OUTPUT
PATCH_LIST_OUTPUT.RESPONSE	object	Output field: PATCH_LIST_OUTPUT.RESPONSE
PATCH_LIST_OUTPUT.RESPONSE.SUBSCRIPTION_ID	string	Unique identifier
PATCH_LIST_OUTPUT.RESPONSE.HOST_ID	string	Unique identifier
PATCH_LIST_OUTPUT.RESPONSE.IP	string	Output field: PATCH_LIST_OUTPUT.RESPONSE.IP
PATCH_LIST_OUTPUT.RESPONSE.DNS	string	Output field: PATCH_LIST_OUTPUT.RESPONSE.DNS
PATCH_LIST_OUTPUT.RESPONSE.NETBIOS	string	Output field: PATCH_LIST_OUTPUT.RESPONSE.NETBIOS
PATCH_LIST_OUTPUT.RESPONSE.OS	string	Output field: PATCH_LIST_OUTPUT.RESPONSE.OS
PATCH_LIST_OUTPUT.RESPONSE.OS_CPE	object	Output field: PATCH_LIST_OUTPUT.RESPONSE.OS_CPE
PATCH_LIST_OUTPUT.RESPONSE.NETWORK	string	Output field: PATCH_LIST_OUTPUT.RESPONSE.NETWORK
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST	object	Output field: PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO	object	Output field: PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.DETECTION_QIDS	object	Unique identifier
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_QID	object	Unique identifier
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_SEVERITY	string	Output field: PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_SEVERITY
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_TITLE	string	Output field: PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_TITLE
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_VENDOR_ID	string	Unique identifier
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_RELEASE_DATE	string	Date value
PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_LINKS	object	Output field: PATCH_LIST_OUTPUT.RESPONSE.PATCH_INFO_LIST.PATCH_INFO.PATCH_LINKS

Output Example

{"PATCH_LIST_OUTPUT":{"RESPONSE":{"SUBSCRIPTION_ID":"string","HOST_ID":"string","IP":"string","DNS":"string","NETBIOS":"string","OS":"string","OS_CPE":{},"NETWORK":"string","PATCH_INFO_LIST":{}}}}

Update Azure Internal Scan

Update an existing internal Azure scan job in Qualys Vulnerability Scanner for unresolved targets using the specified data body.

Endpoint

URL: /api/2.0/fo/scan/cloud/internal/job/

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
data_body	object	Required	Response data
data_body.action	string	Required	Specify update to make changes to an existing scan job.
data_body.id	string	Required	The ID of the scan schedule you want to update.
data_body.module	string	Optional	Specify vm for a vulnerability scan.
data_body.cloud_provider	string	Optional	Specify azure for an Azure internal scan. The cloud_provider value cannot be changed during an update request.
data_body.cloud_service	string	Optional	Specify vm (Azure virtual machine) for an Azure internal scan. The cloud_service value cannot be changed during an update request.
data_body.connector_name	string	Optional	The name of the connector to be used. We check if the specified connector_name exists for your Qualys subscription. If the specified connector name does not exists in your Qualys subscription, then the API request returns an error message - Invalid connector_name provided. One of these parameters must be specified in the request conector_name or connector_uuid. These are mutually exclusive and cannot be specified in the same request.
data_body.connector_uuid	string	Optional	The ID of the connector to be used. If the specified connector name does not exists in your Qualys subscription, then the API request returns an error message - Invalid connector_uuid provided. One of these parameters must be specified in the request conector_name or connector_uuid. These are mutually exclusive and cannot be specified in the same request.
data_body.scan_title	string	Optional	The scan title to create.
data_body.active	number	Optional	Specify 1 to create an active schedule. Specify 0 to create an inactive schedule.
data_body.option_title	string	Optional	The title of the option profile to be used. One of these parameters must be specified in the request option_title or option_id. These are mutually exclusive and cannot be specified in the same request.
data_body.option_id	number	Optional	The ID of the option profile to be used. One of these parameters must be specified in a request option_title or option_id. These are mutually exclusive and cannot be specified in the same request.
data_body.priority	number	Optional	Specify a value of 0 - 9 to set a processing priority level for the scan. When not specified, a value of 0 (no priority) is used. Valid values are 0 = No Priority (the default), 1 = Emergency, 2 = Ultimate, 3 = Critical, 4 = Major, 5 = High, 6 = Standard, 7 = Medium, 8 = Minor, 9 = Low.
data_body.iscanner_id	string	Optional	The IDs of the scanner appliances to be used. Multiple entries are comma separated. These parameters cannot be specified in the same request iscanner_id and iscanner_name.
data_body.iscanner_name	string	Optional	The friendly names of the scanner appliances to be used. Multiple entries are comma separated. These parameters cannot be specified in the same request iscanner_id and iscanner_name.
data_body.platform_type	string	Optional	Select the platform type as either location or virtual network.
data_body.region_code	string	Optional	The Azure region code. Valid values are ap-northeast-1, ap-southeast-1, ap-southeast-2, ap-east-1, eu-west-1, eu-north-1, asa-east-1, us-east-1, us-west-1, us-west-2, me-south-1, eu-south-1, and af-south-1. This parameter is mandatory when the platform type is set to location.
data_body.virtual_network_id	string	Optional	Provide the Id of the Azure virtual network. This parameter is mandatory when the platform type is set to virtual network.
data_body.tag_include_selector	string	Optional	Select any (the default) to include hosts that match at least one of the selected tags. Select all to include hosts that match all of the selected tags.
data_body.tag_exclude_selector	string	Optional	Select any (the default) to exclude hosts that match at least one of the selected tags. Select all to exclude hosts that match all of the selected tags.
data_body.tag_set_by	string	Optional	Specify “id” (the default) to select a tag set by providing tag IDs. Specify “name” to select a tag set by providing tag names. We will check if the tag ids or tag names are valid.
data_body.tag_set_include	string	Optional	Specify a tag set to include. Hosts that match these tags will be included. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated.
data_body.tag_set_exclude	string	Optional	Specify a tag set to exclude. Hosts that match these tags will be excluded. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated.

Input Example

{"headers":{"X-Requested-With":"string"},"data_body":{"action":"update","id":"12345678-1234-1234-1234-123456789abc","module":"vm","cloud_provider":"azure","cloud_service":"vm","connector_name":"Example Name","connector_uuid":"string","scan_title":"string","active":123,"option_title":"string","option_id":123,"priority":123,"iscanner_id":"string","iscanner_name":"Example Name","platform_type":"string","region_code":"string","virtual_network_id":"string","tag_include_selector":"any","tag_exclude_selector":"any","tag_set_by":"id","tag_set_include":"string","tag_set_exclude":"string","cloud_resource_ids":"string","schedule":"string","occurrence":"string","frequency_days":123,"frequency_weeks":123,"weekdays":"string","frequency_months":123,"day_of_month":123,"day_of_week":123,"week_of_month":"string","start_date":"string","start_hour":123,"start_minute":123,"time_zone_code":"string","observe_dst":"string","recurrence":123,"end_after":123,"end_after_mins":123,"pause_after_hours":123,"pause_after_mins":123,"resume_in_days":"string","resume_in_hours":123,"set_start_time":123,"before_notify":123,"before_notify_unit":"string","before_notify_time":123,"before_notify_message":"string","after_notify":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT
SIMPLE_RETURN.RESPONSE.ITEM_LIST	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY	string	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE	string	Value for the parameter

Output Example

Update Cloud Perimeter Scan

Update an existing cloud perimeter scan in Qualys Vulnerability Scanner by targeting unresolved assets with the provided data body.

Endpoint

URL: /api/2.0/fo/scan/cloud/perimeter/job/

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
data_body	object	Required	Response data
data_body.action	string	Required	Specify "create" to configure a new cloud perimeter scan job.
data_body.id	string	Required	The ID of the scan schedule you want to update.
data_body.module	string	Optional	Specify "vm" for a vulnerability scan and "pc" for a compliance scan. Required for Create request.
data_body.cloud_provider	string	Optional	Specify "azure" for an Azure scan. Specify "aws" for an AWS EC2 scan. Specify "gcp" for a GCP scan. The cloud_provider value cannot be changed during an update request. When cloud_provider=azure, the following parameters cannot be specified in the same request platform_type, region_code, vpc_id, include_micro_nano_instances, include_lb_from_connector. These parameters only apply when cloud_provider=aws is specified.
data_body.cloud_service	string	Optional	Specify "vm" (Azure virtual machine) for an Azure scan. Specify "ec2" for an AWS EC2 scan. Specify "compute_engine" for a GCP scan. The cloud_service value cannot be changed during an update request.
data_body.connector_name	string	Optional	The name of the connector to be used. One of these parameters must be specified in the request conector_name or connector_uuid. These are mutually exclusive and cannot be specified in the same request.
data_body.connector_uuid	string	Optional	The ID of the connector to be used. One of these parameters must be specified in the request conector_name or connector_uuid. These are mutually exclusive and cannot be specified in the same request.
data_body.scan_title	string	Optional	The scan title. When not specified the default scan title is "AWS EC2 Perimeter Scan ".
data_body.active	number	Optional	Specify "1" to create an active schedule. Specify "0" to create an inactive schedule.
data_body.option_title	string	Optional	The title of the option profile to be used. One of these parameters must be specified in the request option_title or option_id. These are mutually exclusive and cannot be specified in the same request.
data_body.option_id	number	Optional	The ID of the option profile to be used. One of these parameters must be specified in a request option_title or option_id. These are mutually exclusive and cannot be specified in the same request.
data_body.priority	number	Optional	Specify a value of 0 - 9 to set a processing priority level for the scan. When not specified, a value of 0 (no priority) is used. Valid values are 0 = No Priority (the default), 1 = Emergency, 2 = Ultimate, 3 = Critical, 4 = Major, 5 = High, 6 = Standard, 7 = Medium, 8 = Minor, 9 = Low.
data_body.iscanner_id	string	Optional	The IDs of the scanner appliances to be used. Specify "0" for external scanners. Multiple entries are comma separated. These parameters cannot be specified in the same request iscanner_id and iscanner_name. Optional, only valid when your account is configured to allow internal scanners.
data_body.iscanner_name	string	Optional	The friendly names of the scanner appliances to be used or "External" for external scanners. Multiple entries are comma separated. These parameters cannot be specified in the same request iscanner_id and iscanner_name. Optional, only valid when your account is configured to allow internal scanners.
data_body.platform_type	string	Optional	The platform type. Valid values are classic, vpc_peered or selected_vpc.
data_body.region_code	string	Optional	The EC2 region code. Valid values are ap-northeast-1, ap-southeast-1, ap-southeast-2, ap-east-1, eu-west-1, eu-north-1, asa-east-1, us-east-1, us-west-1, us-west-2, me-south-1, eu-south-1, and af-south-1. One of these parameters must be specified in the request region_code or vpc_id. These are mutually exclusive and cannot be specified in the same request.
data_body.vpc_id	string	Optional	The ID of the Virtual Private Cloud (VPC) zone. The ID value must start with vpc-*. We will check if the specified vpc_id exists for the selected connector. One of these parameters must be specified in the request region_code or vpc_id. These are mutually exclusive and cannot be specified in the same request.
data_body.include_micro_nano_instances	number	Optional	Specify 1 to include EC2 assets with instance types t2.nano, t3.nano, t1.micro and m1.small in the scan job. By default, this parameter value is set to 0. Note that these instance types must be activated for your account so that we can include them in the scan. Warning - AWS EC2 assets with instance types t2.nano, t3.nano, t1.micro and m1.small have very limited CPU. When scanning these instance types we recommend you choose an option profile with Light port scanning and no authentication. Alternatively, use Qualys Cloud Agent to perform the equivalent of authenticated scanning for the least performance impact for these instance types.
data_body.tag_include_selector	string	Optional	Select “any” (the default) to include hosts that match at least one of the selected tags. Select “all” to include hosts that match all of the selected tags.
data_body.tag_exclude_selector	string	Optional	Select “any” (the default) to exclude hosts that match at least one of the selected tags. Select “all” to exclude hosts that match all of the selected tags.
data_body.tag_set_by	string	Optional	Specify “id” (the default) to select a tag set by providing tag IDs. Specify “name” to select a tag set by providing tag names. We will check if the tag ids or tag names are valid.
data_body.tag_set_include	string	Optional	Specify a tag set to include. Hosts that match these tags will be included. You identify the tag set by providing tag name or IDs. Multiple entries are comma separated.

Input Example

{"headers":{"X-Requested-With":"string"},"data_body":{"action":"create","id":"12345678-1234-1234-1234-123456789abc","module":"string","cloud_provider":"string","cloud_service":"string","connector_name":"Example Name","connector_uuid":"string","scan_title":"string","active":123,"option_title":"string","option_id":123,"priority":123,"iscanner_id":"string","iscanner_name":"Example Name","platform_type":"string","region_code":"string","vpc_id":"string","include_micro_nano_instances":123,"tag_include_selector":"any","tag_exclude_selector":"any","tag_set_by":"id","tag_set_include":"string","tag_set_exclude":"string","include_lb_from_connector":123,"elb_dns":"string","schedule":"string","occurrence":"string","frequency_days":123,"frequency_weeks":123,"weekdays":"string","frequency_months":123,"day_of_month":123,"day_of_week":123,"week_of_month":"string","start_date":"string","start_hour":123,"start_minute":123,"time_zone_code":"string","observe_dst":"string","recurrence":123,"end_after":123,"end_after_mins":123,"pause_after_hours":123,"pause_after_mins":123,"resume_in_days":"string","resume_in_hours":123,"set_start_time":123,"before_notify":123,"before_notify_unit":"string","before_notify_time":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SIMPLE_RETURN	object	Output field: SIMPLE_RETURN
SIMPLE_RETURN.RESPONSE	object	Output field: SIMPLE_RETURN.RESPONSE
SIMPLE_RETURN.RESPONSE.DATETIME	string	Time value
SIMPLE_RETURN.RESPONSE.TEXT	string	Output field: SIMPLE_RETURN.RESPONSE.TEXT
SIMPLE_RETURN.RESPONSE.ITEM_LIST	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM	object	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY	string	Output field: SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.KEY
SIMPLE_RETURN.RESPONSE.ITEM_LIST.ITEM.VALUE	string	Value for the parameter

Output Example

VM Scan Summary by Post Method

Generate a summary report of scanned or unscanned hosts in Qualys Vulnerability Scanner, including scan status reasons, using the POST method with a required data body.

Endpoint

URL: /api/2.0/fo/scan/vm/summary/

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Optional	HTTP headers for the request
headers.X-Requested-With	string	Optional	Value for the X-Requested-With HTTP header required by Qualys APIs.
data_body	object	Required	Response data
data_body.action	string	Required	The list action is required.
data_body.output_format	string	Optional	The only supported output format at this time is XML.
data_body.scan_reference	string	Optional	Specifies a unique scan reference ID. Use this option to include scan summary information for a single scan only. For VM scans, the scan reference has the format scan/987654321.98765. One of these parameters must be specified in the request scan_datetime_since or scan_reference. You cannot specify scan_reference in the same request as scan_datetime_since and scan_datetime_until.
data_body.scan_datetime_since	string	Optional	Include scans started since a certain date. The date must be less than or equal to today’s date. Specify the date in GMT timezone in RFC 3339 format yyyy-mm-ddThh-mm-ssZ. Example 2020-10-01T09:30:48Z. One of these parameters must be specified in the request scan_datetime_since or scan_reference. You cannot specify scan_datetime_since in the same request as scan_reference.
data_body.scan_datetime_until	string	Optional	Include scans started up to a certain date. The date must be more than or equal to scan_datetime_since, and less than or equal to today’s date. Specify the date in GMT timezone in RFC 3339 format yyyy-mm-ddThh-mm-ssZ. Example 2020-10-01T09:30:48Z. The parameter scan_datetime_until can only be specified when scan_datetime_since is also specified. You cannot specify scan_datetime_until in the same request as scan_reference.
data_body.include_scan_input	number	Optional	By default, scan input information is included in the XML output in the <SCAN_INPUT> block. Specify include_scan_input=0 if you don’t want this entire block to appear in the output. Scan input information includes the scan title, user login (for user who launched the scan), whether or not the scan was scheduled, scan target, network, option profile, etc.
data_body.include_scan_details	number	Optional	By default, scan details are included in the XML output in the <SCAN_DETAILS> block. Specify include_scan_details=0 if you don’t want this entire block to appear in the output. Scan details include the scan status, launch date/time, and scan duration.
data_body.include_hosts_summary	number	Optional	By default, hosts summary information is included in the XML output in the block under <SCAN_RESULTS>. Specify include_hosts_summary=0 if you don’t want the block to appear in the output. The hosts summary shows the total number of hosts scanned, and lists the IP addresses, DNS hostnames and NetBIOS hostnames in the scan.
data_body.include_detections_summary	number	Optional	By default, detections summary information is included in the XML output in the block under <SCAN_RESULTS>. Specify include_detections_summary=0 if you don’t want the block to appear in the output. The detections summary includes the total number of detections, and the number of detections by severity for confirmed, potential and information gathered.
data_body.include_hosts_summary_categories	string	Optional	When unspecified, all categories are included in the XML output. To filter the categories, provide a comma-separated list of the categories to include in the output. Possible values are scanned, excluded, cancelled, unresolved, duplicate, not_vulnerable, dead, aborted, blocked, failed_slice, exceeded_scan_duration. See "Host Summary Categories" below for more information on each category. Each category appears a block inside <SCAN_RESULTS> . If a category is filtered out, the respective category block does not appear in the output.

Input Example

{"data_body":{"action":"list","output_format":"xml","scan_reference":"scan/987654321.98765","scan_datetime_since":"2020-10-01T09:30:48Z","scan_datetime_until":"2020-10-01T09:30:48Z","include_scan_input":0,"include_scan_details":0,"include_hosts_summary":0,"include_detections_summary":0,"include_hosts_summary_categories":"scanned, excluded, cancelled, unresolved, duplicate"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
SCAN_SUMMARY_OUTPUT	object	Output field: SCAN_SUMMARY_OUTPUT
SCAN_SUMMARY_OUTPUT.RESPONSE	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE
SCAN_SUMMARY_OUTPUT.RESPONSE.DATETIME	string	Time value
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_REFERENCE	string	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_REFERENCE
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_INPUT	object	Input data for the action
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_DETAILS	object	Output field: SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_DETAILS
SCAN_SUMMARY_OUTPUT.RESPONSE.SCAN_SUMMARY_LIST.SCAN_SUMMARY.SCAN_RESULTS	object	Result of the operation

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{"SCAN_SUMMARY_OUTPUT":{"RESPONSE":{}}}}

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-store, no-cache, private, must-revalidate, post-check=0, pre-check=0
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-RAY	HTTP response header: CF-RAY	91e8b57438dd4087-BOM
Connection	HTTP response header: Connection	Keep-Alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
content-length	The length of the response body in bytes	140
Content-Security-Policy	HTTP response header: Content-Security-Policy	default-src 'self' .qualys.com .qualys.ca .qualys.eu .qualys.it .qualys.in .qualys.ae .qualys.co.uk .qualys.com.au .qualysksa.com .qualys.sg *.qualys.us;
Content-Type	The media type of the resource	text/html; charset=UTF-8
Date	The date and time at which the message was originated	Tue, 28 Mar 2023 04:00:03 GMT
Expires	The date/time after which the response is considered stale	Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive	HTTP response header: Keep-Alive	timeout=300, max=133
Pragma	HTTP response header: Pragma	no-cache
Server	Information about the software used by the origin server	Apache
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
X-Concurrency-Limit-Limit	HTTP response header: X-Concurrency-Limit-Limit	2
X-Concurrency-Limit-Running	HTTP response header: X-Concurrency-Limit-Running	0
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	SAMEORIGIN
X-Powered-By	HTTP response header: X-Powered-By	Qualys:USPOD3:19c2b0e7-3e70-e163-833e-64144bbbf8b3:730c59a6-aa5f-e469-81f8-0cd5e186bb2a
X-RateLimit-Limit	The number of requests allowed in the current rate limit window	300
X-RateLimit-Remaining	The number of requests remaining in the current rate limit window	275
X-RateLimit-ToWait-Sec	HTTP response header: X-RateLimit-ToWait-Sec	0
X-RateLimit-Window-Sec	HTTP response header: X-RateLimit-Window-Sec	3600
X-XSS-Protection	HTTP response header: X-XSS-Protection	1; mode=block