--- title: Qualys API Integration on Truto slug: qualys category: Security canonical: "https://truto.one/integrations/detail/qualys/" --- # Qualys API Integration on Truto **Category:** Security **Status:** Beta ## MCP-ready AI tools Truto exposes 373 tools for Qualys that AI agents can call directly. - **list_all_qualys_activity_logs** — Export the user activity log for a subscription to CSV format. - **create_a_qualys_appliance_replacement** — Using the Replace Scanner Appliance API , Managers and Unit Managers can replace a scanner appliance with a new one. Tell us the name of the appliance you want to replace and the one you want to use. Good to Know - You can replace one scanner appliance at a time. - Do not replace a scanner appliance while scans (using the appliance) are in progress. - The old scanner and the new scanner must be in the same network, if applicable. - You can only replace an EC2 scanner with another EC2 scanner - **list_all_qualys_appliances** — List scanner appliances (all types such as physical, virtual, offline, etc) in the user's account. This API is available to Express Lite users when Internal Scanning is enabled in the user's account. - **create_a_qualys_appliance** — Add a virtual scanner appliance to the user's account. - **update_a_qualys_appliance_by_id** — Use these APIs to update a virtual scanner appliance in the user's account. You can add tags, remove and reset tags for your scanner appliances. Manage VLANs | Manage Static Routes The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_appliance_by_id** — Delete a virtual scanner appliance in the user's account. Deletion results in the following actions: The scanner will be removed from associated asset groups, The scheduled scans using this scanner will be deactivated. Is your virtual scanner running scans? If yes it’s not possible to delete it. We recommend you check to be sure the virtual scanner you want to delete is not running scans. The id is sent as the id parameter (ID of the record.). - **create_a_qualys_asset_activation** — Activate one asset (by ID) for the given modules (module=QWEB_VM, QWEB_PC, …). - **get_single_qualys_asset_data_connector_by_id** — Returns a single asset data connector by ID. - **update_a_qualys_asset_data_connector_by_id** — Updates writable fields and collections. Only the name and tags can be modified. Using the NOT EQUALS operator for updating connectors could result in accidental update of unknown connectors without any warning. To prevent accidental updates of unknown connectors, we do not support NOT EQUALS operator for update actions. - **qualys_asset_data_connectors_search** — Returns a list of asset data connectors that match the provided criteria. - **qualys_asset_data_connectors_lookup_count** — Returns the number of asset data connectors that match the provided criteria. - **delete_a_qualys_asset_data_connector_by_id** — Delete one or more asset data connectors. Using the NOT EQUALS operator for deleting connectors could result in accidental deletion of unknown connectors without any warning. To prevent accidental deletion of unknown connectors, we do not support NOT EQUALS operator for delete actions. - **qualys_asset_data_connectors_execute** — Run an asset data connector now. - **qualys_asset_data_connectors_bulk_update** — Update every connector matching the filters (only the documented writable fields; NOT EQUALS is not supported for updates). - **qualys_asset_data_connectors_bulk_delete** — Delete every connector matching the filters (NOT EQUALS is not supported for deletes). - **qualys_asset_data_connectors_bulk_execute** — Run every connector matching the filters now. - **list_all_qualys_asset_groups** — List asset groups in the user's account. Paginated by Qualys truncation (truncation_limit records per page, next page via id_min); Truto follows the WARNING URL automatically. - **create_a_qualys_asset_group** — Add a new asset group in the user's account. - **update_a_qualys_asset_group_by_id** — Edit an asset group present in the user's account. The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_asset_group_by_id** — Delete an asset group present in the user's account. By deleting an asset group any scheduled scans using the asset group will be deactivated. The id is sent as the id parameter (ID of the record.). - **create_a_qualys_asset_search_report** — Launch reports in the user's account. The Report Share feature must be enabled in the user's subscription. - **get_single_qualys_asset_by_id** — Returns a single asset by ID. - **update_a_qualys_asset_by_id** — Update fields for an asset and collections of assets. Only the name and tags can be modified. Using the NOT EQUALS operator for updating assets could result in an accidental update of unknown assets without any warning. To prevent accidental updates of unknown assets, we do not support the NOT EQUALS operator for update actions. - **qualys_assets_bulk_update** — Update fields for an asset and collections of assets. Only the name and tags can be modified. Using the NOT EQUALS operator for updating assets could result in an accidental update of unknown assets without any warning. To prevent accidental updates of unknown assets, we do not support the NOT EQUALS operator for update actions. - **qualys_assets_search** — Returns a list of assets matching the provided criteria. Assets are returned when they are visible to the user (i.e. in the user’s scope). - **qualys_assets_lookup_count** — Returns the number of assets that match the provided criteria. A host asset is counted when the asset is visible to the user (i.e. in the user’s scope). - **delete_a_qualys_asset_by_id** — Delete one or more assets. Using the NOT EQUALS operator for deleting assets could result in accidental deletion of unknown assets without any warning. To prevent accidental deletion of unknown assets, we do not support NOT EQUALS operator for delete actions. - **qualys_assets_bulk_delete** — Delete one or more assets. Using the NOT EQUALS operator for deleting assets could result in accidental deletion of unknown assets without any warning. To prevent accidental deletion of unknown assets, we do not support NOT EQUALS operator for delete actions. - **qualys_assets_activate** — Activate one or more assets to make them available in your account for scanning and reporting. You’ll want to activate newly created hosts to make them available in the Vulnerability Management (VM) module, Policy Compliance (PC) module, Security Configuration Assessment (SCA) module, or CertView module. - **list_all_qualys_auth_records** — List all authentication records visible to the user for all technologies (i.e. Windows, Unix, Docker, etc). A maximum of 1,000 authentication records can be processed per request. If the requested list identifies more than 1,000 authentication records, then the XML output includes the element and instructions for making another request for the next batch of records. - **list_all_qualys_auth_records_by_type** — List authentication records visible to the user for a specific technology (i.e. Unix, Windows, Docker, Sybase etc). A maximum of 1,000 authentication records can be processed per request. If the requested list identifies more than 1,000 authentication records, then the XML output includes the element and instructions for making another request for the next batch of records. - **create_a_qualys_auth_records_by_type** — Create a scan authentication record of the given technology (unix, windows, oracle, mysql, …). Body fields depend on the record type; the schema lists the union of the documented fields of all record types (see the record-type pages for which apply). - **update_a_qualys_auth_records_by_type_by_id** — Update a scan authentication record of the given technology (unix, windows, oracle, mysql, …). Body fields depend on the record type; the schema lists the union of the documented fields of all record types (see the record-type pages for which apply). id = authentication record ID (ids). - **delete_a_qualys_auth_records_by_type_by_id** — Delete a vault in the user's account. {technology} will reflect the record type, i.e. Windows, Unix, Docker, etc. The id is sent as the ids parameter (ID of the authentication record (several comma separated are accepted).). - **create_a_qualys_auth_token** — Get a JSON Web Token (JWT) for the Qualys API gateway (CSAM/GAV, EASM, PCAS, PCRS) using the connected username and password. The token is valid for 4 hours; Truto calls this at connect time and every 3 hours and stores it as jwt_token. - **get_single_qualys_aws_base_account_by_id** — Get the Qualys AWS base account details (global, GovCloud and China account IDs to trust in the IAM role of an AWS connector) by id. - **qualys_aws_base_accounts_search** — Search the Qualys AWS base account details (global, GovCloud and China account IDs) of connectors by name or id. - **get_single_qualys_aws_connector_by_id** — Returns a single AWS connector by ID. - **create_a_qualys_aws_connector** — Creates an AWS asset data connector. disabled (boolean) is used to disable an EC2 connector. This parameter can be set for a “create” or “update” request. When set to “true” the connector is disabled and will not run. - If a single connector is run and it is disabled an error is returned. - If multiple connectors are run and all are disabled an error is returned. - If multiple connectors are run and some are disabled, only connectors that are enabled will run. - **update_a_qualys_aws_connector_by_id** — Updates writable fields and collections. Using the NOT EQUALS operator for updating AWS connectors could result in accidental update of unknown AWS connectors without any warning. To prevent accidental updates of unknown AWS connectors, we do not support NOT EQUALS operator for update actions. - **qualys_aws_connectors_search** — Returns a list of AWS connectors that match the provided criteria. - **qualys_aws_connectors_lookup_count** — Returns the number of AWS connectors that match the provided criteria. - **delete_a_qualys_aws_connector_by_id** — Delete one or more AWS connectors. Using the NOT EQUALS operator for deleting AWS connectors could result in accidental deletion of AWS connectors without any warning. To prevent accidental deletion of unknown AWS connectors, we do not support NOT EQUALS operator for delete actions. - **qualys_aws_connectors_bulk_update** — Update every connector matching the filters (only the documented writable fields; NOT EQUALS is not supported for updates). - **qualys_aws_connectors_bulk_delete** — Delete every connector matching the filters (NOT EQUALS is not supported for deletes). - **create_a_qualys_aws_connectors_v_3** — Specify the connector details such as arn, externalId, and so on and create a new connector in the Connectors application. - **update_a_qualys_aws_connectors_v_3_by_id** — You can update only those connectors that created in the Connector application. Specify the connector ID and you can then update details of the specified connector. Using the NOT EQUALS operator for updating AWS connectors could result in accidental update of unknown AWS connectors without any warning. To prevent accidental updates of unknown AWS connectors, we do not support NOT EQUALS operator for update actions. - **delete_a_qualys_aws_connectors_v_3_by_id** — Delete one or more AWS connectors from the Connectors application. Using the NOT EQUALS operator for deleting AWS connectors could result in accidental deletion of AWS connectors without any warning. To prevent accidental deletion of unknown AWS connectors, we do not support NOT EQUALS operator for delete actions. - **qualys_aws_connectors_v_3_execute** — Run an AWS connector (3.0) now. - **qualys_aws_connectors_v_3_search** — Returns a list of AWS connectors in the user's account that match the provided criteria. Narrow down your search results using the parameters listed below. - **get_single_qualys_aws_connectors_v_3_by_id** — We will now deprecate the old CloudView API endpoint for ’Get AWS connector Info’ and an alternative API will be introduced in the Asset Management application. You can select whether the ’Get AWS Connector Info’ API applies to AssetView and/or CloudView in the Connector application. - **qualys_aws_connectors_v_3_bulk_update** — Update every connector matching the filters (only the documented writable fields; NOT EQUALS is not supported for updates). - **qualys_aws_connectors_v_3_bulk_delete** — Delete every connector matching the filters (NOT EQUALS is not supported for deletes). - **qualys_aws_connectors_v_3_bulk_execute** — Run every connector matching the filters now. - **qualys_aws_connectors_v_3_lookup_cloudformation_template** — Returns a AWS CloudFormation template based on AI or CI/CSA capability. - **get_single_qualys_azure_connector_by_id** — Returns a single Azure connector by ID. - **create_a_qualys_azure_connector** — Creates Azure asset data connector. - **update_a_qualys_azure_connector_by_id** — Updates writable fields and collections. Using the NOT EQUALS operator for updating Azure connectors could result in accidental update of unknown Azure connectors without any warning. To prevent accidental updates of unknown Azure connectors, we do not support NOT EQUALS operator for update actions. - **qualys_azure_connectors_search** — Returns a list of Azure connectors that match the provided criteria. - **delete_a_qualys_azure_connector_by_id** — Delete one or more Azure connectors. Using the NOT EQUALS operator for deleting Azure connectors could result in accidental deletion of Azure connectors without any warning. To prevent accidental deletion of unknown Azure connectors, we do not support NOT EQUALS operator for delete actions. - **qualys_azure_connectors_bulk_update** — Update every connector matching the filters (only the documented writable fields; NOT EQUALS is not supported for updates). - **qualys_azure_connectors_bulk_delete** — Delete every connector matching the filters (NOT EQUALS is not supported for deletes). - **qualys_azure_connectors_v_3_bulk_update** — Update every connector matching the filters (only the documented writable fields; NOT EQUALS is not supported for updates). - **qualys_azure_connectors_v_3_bulk_delete** — Delete every connector matching the filters (NOT EQUALS is not supported for deletes). - **qualys_azure_connectors_v_3_bulk_execute** — Run every connector matching the filters now. - **create_a_qualys_azure_connectors_v_3** — Specify the connector details such as application Id, authenticationKey, description, directoryId, name, and subscription Id of your Azure account and create a new connector in the Connectors application. - **update_a_qualys_azure_connectors_v_3_by_id** — Specify the connector ID and the details of the connector that you would want to update in the request. Your connector details get updated. Using the NOT EQUALS operator for updating Azure connectors could result in accidental update of unknown Azure connectors without any warning. To prevent accidental updates of unknown Azure connectors, we do not support NOT EQUALS operator for update actions. - **delete_a_qualys_azure_connectors_v_3_by_id** — Delete one or more Azure connectors. Using the NOT EQUALS operator for deleting Azure connectors could result in accidental deletion of Azure connectors without any warning. To prevent accidental deletion of unknown Azure connectors, we do not support NOT EQUALS operator for delete actions. - **qualys_azure_connectors_v_3_execute** — Run an Azure connector (3.0) now. - **qualys_azure_connectors_v_3_search** — Returns a list of Azure connectors that match the provided criteria. - **get_single_qualys_azure_connectors_v_3_by_id** — View details for a connector which is in the user’s scope. Specify the connector ID and fetch the details of the connector. - **list_all_qualys_certificates** — List certificates discovered in the user's account. By default, all certificates in the user account are included. Optional input parameters support filtering the list by certificate, date, and host criteria, and control how much detail is returned for each certificate. We recommend using the new Certificate View module to manage certificates. Qualys is in the process of transitioning certificate management capabilities from Asset/Certificates to Certificate View to provide enhanced functionality. Refer to the Certificate View API User Guide for details. - **create_a_qualys_cloud_internal_scan** — You can create/update the following internal instance based scans Azure internal scan job through Azure Internal Scan API even if no scan targets are resolved from the provided details. At the time of the scan, if no scan targets are resolved from the provided details, the scan cannot launch, and we add the error to the Activity log and Run history of the scheduled scan job. Azure internal scans are available for only VM modules. Google Cloud Platform (GCP) scan job for assets in the GCP cloud - **update_a_qualys_cloud_internal_scan_by_id** — You can create/update the following internal instance based scans Azure internal scan job through Azure Internal Scan API even if no scan targets are resolved from the provided details. At the time of the scan, if no scan targets are resolved from the provided details, the scan cannot launch, and we add the error to the Activity log and Run history of the scheduled scan job. Azure internal scans are available for only VM modules. Google Cloud Platform (GCP) scan job for assets in the GCP cloud The id is sent as the id parameter (ID of the record.). - **create_a_qualys_cloud_perimeter_scan** — We allow you to create/update a cloud perimeter scan job through Cloud Perimeter Scan API even if no scan targets are resolved from the provided details. At the time of scan, if no scan targets are resolved from the provided details, the scan will not be launched, and we add the error in the Activity log and Run history of the schedule scan job. You can now reset the scheduled scan's pause/cancel and recurrence scheduling settings for cloud perimeter scans. - **update_a_qualys_cloud_perimeter_scan_by_id** — We allow you to create/update a cloud perimeter scan job through Cloud Perimeter Scan API even if no scan targets are resolved from the provided details. At the time of scan, if no scan targets are resolved from the provided details, the scan will not be launched, and we add the error in the Activity log and Run history of the schedule scan job. You can now reset the scheduled scan's pause/cancel and recurrence scheduling settings for cloud perimeter scans. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_compliance_controls** — View a list of compliance controls which are visible to the user. The user has the ability to select the amount of additional information to include for each control in the output. By default, this basic control information is included: the control ID, the control category, the control sub-category, the control statement, and a list of technologies. Using the Qualys user interface, it’s possible to customize the list of frameworks at the subscription level. Under PC, go to Policies > Setup > Frameworks to customize the frameworks list. If the frameworks list is customized for your subscription, then the customized list of frameworks will appear in the controls list output returned by a contr… - **list_all_qualys_compliance_exceptions** — List exceptions visible to the user. This API is supported using PC. Paginated by Qualys truncation (truncation_limit records per page, next page via exception_number_min); Truto follows the WARNING URL automatically. - **create_a_qualys_compliance_exception** — Create an exception. By default the expiry date matches the creation date. This API is supported using PC. - **qualys_compliance_exceptions_bulk_update** — Update one or more exceptions. All the actions you take are logged in the exception history with your name and a time stamp for when the action took place. This API is supported using PC. - **qualys_compliance_exceptions_bulk_delete** — Delete one or more exceptions. This API is supported using PC. - **list_all_qualys_compliance_policies** — View a list of compliance policies visible to the user. By default, the compliance policy list output shows all compliance policies in the subscription. Optional input parameters allow you to set filters to restrict the policy list output to policies with certain compliance policy IDs. Maximum Policies per API Request A maximum of 1,000 compliance policy records can be processed per request. If the - **create_a_qualys_compliance_policy** — Import a compliance policy, defined in an XML file, into your account. We’ll include all the service-provided controls from your XML file. You have the option to also include userdefined controls. - **qualys_compliance_policies_merge** — Merge controls from an exported policy XML into an existing compliance policy (id = target policy ID); the policy XML is sent as the xml_file / request body as documented. - **create_a_qualys_compliance_policy_asset_group** — Add asset groups to a compliance policy. - **update_a_qualys_compliance_policy_asset_group_by_id** — Replace the asset groups of a compliance policy (id = policy ID). - **delete_a_qualys_compliance_policy_asset_group_by_id** — Remove asset groups from a compliance policy (id = policy ID). - **create_a_qualys_compliance_policy_asset_tag** — Add asset tags to a compliance policy. - **update_a_qualys_compliance_policy_asset_tag_by_id** — Replace the asset tags of a compliance policy (id = policy ID). - **delete_a_qualys_compliance_policy_asset_tag_by_id** — Remove asset tags from a compliance policy (id = policy ID). - **get_single_qualys_compliance_policy_export_by_id** — Use the parameter action=export to export compliance policies. Your account must have the Policy Audit/Policy Compliance application enabled in order to export policies using this API. Export compliance policies from your account to an XML file. Service provided controls are exported and you can choose to also export user defined controls. The output also includes an appendix with human readable look-ups for control descriptions, giving you explanation on the various aspects of control description and evaluation. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_compliance_postures** — List current compliance posture data (info records) for hosts within the user’s account. Each compliance posture info record includes a compliance posture ID and other attributes. This API is supported using PC. Refer to Posture data - Info Record to view each compliance posture info record in the output The user has the ability to select the amount of information to include in the posture information output. By default, basic posture information is included: the posture ID, host ID, control ID, technology ID, technology instance (when applicable), and the compliance status. If an exception has been created, this full exception information is also included: the exception assignee and status,… - **get_single_qualys_compliance_scan_result_by_id** — Download the results of a compliance (PC) scan (id = scan reference). - **list_all_qualys_compliance_scan_schedules** — Required/Optional Specify action to list compliance scan schedules. echo_request={0|1} - **create_a_qualys_compliance_scan_schedule** — Create a new compliance scan schedule in the user's account. - **update_a_qualys_compliance_scan_schedule_by_id** — Update compliance scan schedule in the user's account. The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_compliance_scan_schedule_by_id** — Delete compliance scan schedule in the user's account. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_compliance_scans** — This API is used to list PC scans in the user's account. By default scans launched in the past 30 days are listed. - **create_a_qualys_compliance_scan** — This API is used to launch PC scans in the user's account. - **qualys_compliance_scans_cancel** — Stop a compliance (PC) scan that is in progress. - **qualys_compliance_scans_pause** — Pause a compliance (PC) scan that is in progress. - **qualys_compliance_scans_resume** — Resume a paused compliance (PC) scan. - **delete_a_qualys_compliance_scan_by_id** — Delete a compliance (PC) scan (id = scan reference, e.g. compliance/1234567890.12345). - **qualys_connector_errors_search** — Get the list of errors encountered when executing a connector in the connector application. - **list_all_qualys_containerized_appliances** — List the containerized scanner appliance in your account. - **create_a_qualys_containerized_appliance** — Create a new containerized scanner appliance in your account. - **update_a_qualys_containerized_appliance_by_id** — Update the containerized scanner appliance details in your account. The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_containerized_appliance_by_id** — Delete the containerized scanner appliance in your account. The id is sent as the id parameter (ID of the record.). - **qualys_csam_asset_business_metadata_bulk_update** — Import asset business metadata as per the input criteria in the request body. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_csam_asset_ids** — Use the this API to retrieve asset IDs without fetching complete asset details. You can retrieve the IDs of all assets in your inventory or apply filters to retrieve only the IDs of assets that match your criteria. The API returns up to 9,950 asset IDs in a single request. After retrieving the asset IDs, use the Get Host Details of All Assets API to fetch complete details for the selected assets. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_csam_asset_software_components** — This API helps you to get the list of software components for a specific assetId discovered from the SwCA scan. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_csam_assets_lookup_count** — Filter the events list by providing a filter in json and xml format. Make sure your filter criteria is provided in xml/json format in the request body. If you don’t provide filter parameter, it will show details of all the assets. For more information on supported operators, refer Supported Operators . For example (json): Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_csam_asset_by_id** — Get details of a specific asset by providing an asset ID. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the assetId parameter (Qualys asset ID.). - **list_all_qualys_csam_assets** — Get details of all assets that satisfy the filter criteria to include or exclude specified fields. If you don’t provide a filter parameter, it will show details of all the assets. Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_csam_business_app** — Import business app metadata as per input criteria in the request body Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_csam_cpe_cves** — This API is supported only for CSAM Trial and Full (Paid). - The API response time varies based on the number of software and operating Systems installed on the assets. It might take up to approximately 15 to 25 minutes, as fetching the vulnerability data generates a significant load on the system. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_csam_domains** — Provide the value UNRESOLVED_DOMAINS. If this value is not provided, the unresolved domains are fetched by default. Ensure to enter the value in capital letters only. domainFilterType Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_csam_domains_lookup_count** — Provide the value UNRESOLVED_DOMAINS. If this value is not provided, this field fetches the unresolved domains by default. Ensure to enter the value in capital letters only. domainFilterType Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_csam_report_file_by_id** — Provide the name of the report that you want to download. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the reportName parameter (Name of the CSAM report to download.). - **create_a_qualys_csam_report** — Name of the report to be created. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_csam_software_components** — Get List of All Software Components Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_csam_third_party_asset** — This API is used to import Third-Party assets into your CSAM account. It is introduced only for the Third-Party asset source - Webhook. Before You Begin Before importing the Third-Party assets, create the "businessAppId" using the 2.0/upsert/am/businessapp/metadata API. The values mentioned in the "identityAttributes" list except "qualysAssetId", "instanceUuid", and "instanceUuidSource" must be the same as mentioned in the "coreAttributes" list. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_current_user_passwords_reset** — This API simplifies password management by enabling users to update their existing passwords to a new one of their choice. This enhancement strengthens security practices and offers a more seamless user experience by integrating password management directly into existing workflows. When any user logs in to their subscription and changes their login password, the password can be changed only three times in an hour. If there is an attempt to exceed this limit, an error message is returned in the API response. - **list_all_qualys_custom_vulns** — List the vulnerabilities you customised in the KnowledgeBase. - **qualys_custom_vulns_bulk_update** — Customise a KnowledgeBase vulnerability (severity, threat/impact/solution comments, disable) for one or more QIDs. - **qualys_custom_vulns_reset** — Reset customised KnowledgeBase vulnerabilities back to the Qualys defaults. - **qualys_cyberscope_reports_lookup_scan_results** — Create a Cyberscope report using scan results for a particular SCAP scan in the user’s account. This report is supported using PC/SCAP. - **qualys_cyberscope_reports_lookup_policy_results** — Create a Cyberscope report using scan results data saved for a particular SCAP policy in the user’s account. This report is supported using PC/SCAP. The service uses automatic SCAP policy data for a selected policy and reports this in the datapoint . The services uses the evidence data for the special rule "security_patches_up_to_date" and reports this in the datapoint . - **qualys_cyberscope_reports_lookup_global_results** — Create a Cyberscope report using scan results data saved for a particular SCAP policy in the user’s account. This report is supported using PC/SCAP. The service uses SCAP scan data for all the SCAP policies in the subscription and reports this in the datapoint . This datapoint will include multiple Benchmark Data sections, one for each policy. Also the service uses the automatic VM data for applicable IPs (IPs in SCAP policies) and reports this in the datapoint . - **list_all_qualys_deleted_tickets** — View deleted tickets in the user’s account. This function may be run by Managers. The functionality provided allows for real-time integration with third-party applications. Basic HTTP authentication is required. Session based authentication is not supported using this API. The XML results returned by the ticket_list_deleted.php function identifies deleted tickets by ticket number and deletion date/time. Truncation - A maximum of 1,000 deleted tickets can be returned from a single ticket_list_deleted.php request. If this maximum is reached, the function returns a “Truncated after 1,000 records” message at the end of the XML report with the last ticket number included. - **list_all_qualys_domains** — List asset domains in the user account. Basic HTTP authentication is required. Session based authentication is not supported using this API. Permissions - Managers can view all domains in subscription. Unit Managers can view domains in user's business unit. Scanners, Readers can view domains in their own account. - **create_a_qualys_domain** — Add domains and related netblocks in the subscription. The domains defined may be used as targets for network scans (maps). Basic HTTP authentication is required. Session based authentication is not supported using this API. Permissions - Manager user role is required. - **qualys_domains_bulk_update** — Update existing domains and related netblocks in the subscription. The domains defined may be used as targets for network scans (maps). Basic HTTP authentication is required. Session based authentication is not supported using this API. Permissions - Manager user role is required. - **qualys_domains_bulk_delete** — Delete existing domains and related netblocks in the subscription. The domains defined may be used as targets for network scans (maps). Basic HTTP authentication is required. Session based authentication is not supported using this API. Permissions - Manager user role is required. - **list_all_qualys_dynamic_search_lists** — List dynamic search lists and manage them (create, update, delete). - **create_a_qualys_dynamic_search_list** — List dynamic search lists and manage them (create, update, delete). - **update_a_qualys_dynamic_search_list_by_id** — List dynamic search lists and manage them (create, update, delete). The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_dynamic_search_list_by_id** — List dynamic search lists and manage them (create, update, delete). The id is sent as the id parameter (ID of the record.). - **qualys_easm_organizations_lookup_count** — Input Filter Parameters Input Filter Parameters Filter Parameter List of filter conditions used to refine search results. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_easm_organizations** — Input Filter Parameters Input Filter Parameters Filter Parameter List of filter conditions used to refine search results. Calls the Qualys API gateway with the JWT obtained at connect time. - **update_a_qualys_easm_profile_patch_by_id** — Patch (partially update) an EASM profile; only the fields sent are changed (id = profile name). Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_easm_profile_status_by_id** — Provide the profile name to get the discovery status of an individual profile. Note that if you don’t provide the profile name, you get the discovery status of all profiles. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the profileName parameter (Name of the EASM profile.). - **list_all_qualys_easm_profiles** — Provide the page number. If the page number is not provided, page no 0 is fetched by default. You can get the data for a maximum of 20 profiles. But if you want to get the data for more than 20 profiles, you need to provide the pagination query parameter, which is pageNumber=Numericvalue. Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_easm_profile** — Provide the profile name in the API request body defaultProfile Calls the Qualys API gateway with the JWT obtained at connect time. - **update_a_qualys_easm_profile_by_id** — pathParameter Provide the EASM profile name. excludeCDNAssets Calls the Qualys API gateway with the JWT obtained at connect time. - **delete_a_qualys_easm_profile_by_id** — Provide the EASM profile name. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the profileName parameter (Name of the EASM profile.). - **qualys_easm_profiles_activate** — pathParameter Provide the EASM profile name. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_easm_scan_vulns** — asset.assetId Provide the asset Id for which you want to get the list of vulnerabilities. vulnerabilities.disabled Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_easm_vulns** — Character Limit asset.assetId Provide the asset Id for which you want to get the list of vulnerabilities. asset.ipaddress Provide the IP address of the asset for which you want to get the list of vulnerabilities. vulnerability.cveId Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_eula_acceptance** — Allows Qualys users to complete the registration process and accept the Qualys End User License Agreement (EULA) on behalf of their customers. This API provides programmatic acceptance of the Qualys EULA. This API does not support session based authentication. The Qualys End User Licence Agreement (EULA) must be accepted with basic authentication. Once accepted, msp and VM, PA/PC APIs from V2.0 onwards work with JWT token authentication. Otherwise, it returns an ACCESS DENIED error. - **list_all_qualys_excluded_host_history** — Excluded Hosts Change History View change history for excluded hosts in the user’s subscription. History record IDs in the XML output are listed in decreasing order. - **list_all_qualys_excluded_hosts** — Show the excluded host list for the user's account. Hosts in your excluded host list will not be scanned. - **create_a_qualys_excluded_host** — Add hosts (IPs) to your excluded host list. Hosts in your excluded host list will not be scanned. - **qualys_excluded_hosts_bulk_delete** — Remove hosts from your excluded hosts list. You can choose to remove certain hosts (IPs) or all hosts from your excluded hosts list. - **qualys_excluded_hosts_bulk_delete_all** — Remove all excluded hosts (optionally only those of the given network_id). - **list_all_qualys_framework_asset_groups** — List available asset groups with their names and IDs. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_framework_asset_tags** — List available asset tags with their names and IDs. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_framework_benchmarks** — List available benchmarks with their names and IDs. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_framework_controls_search** — Configure (resolve) the controls of a compliance framework for the chosen technologies; the output sections feed pcas_policies.create. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_framework_technologies** — List available technologies for a particular category. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_frameworks** — List available frameworks with their names and IDs. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_gcp_connectors_v_3_bulk_update** — Update every connector matching the filters (only the documented writable fields; NOT EQUALS is not supported for updates). - **qualys_gcp_connectors_v_3_bulk_delete** — Delete every connector matching the filters (NOT EQUALS is not supported for deletes). - **qualys_gcp_connectors_v_3_bulk_execute** — Run every connector matching the filters now. - **create_a_qualys_gcp_connectors_v_3** — Specify the connector details such as name, description, polling frequency, project ID and upload the configuration (JSON) file and create a new connector in the Connectors application. - **update_a_qualys_gcp_connectors_v_3_by_id** — Specify the connector ID and the details to be updated to update details of the specified connector. - **delete_a_qualys_gcp_connectors_v_3_by_id** — We will now deprecate the API endpoint to delete one or more GCP connectors from the CloudView application and introduce an alternative API in the Asset Management application. - **qualys_gcp_connectors_v_3_execute** — Run a GCP connector (3.0) now. - **qualys_gcp_connectors_v_3_search** — We will now deprecate the API endpoint to return a list of GCP connectors that match the provided criteria from the CloudView application and introduce an alternative in the Asset Management application. - **get_single_qualys_gcp_connectors_v_3_by_id** — We will now deprecate the old CloudView API endpoint for ’Get GCP connector Info’ and an alternative API will be introduced in the Asset Management application. You can select whether the ’Get GCP Connector Info’ API applies to AssetView and/or CloudView in the Connector application. - **create_a_qualys_global_scan_configuration** — Once you enable cloud perimeter scan for your connector, you need to provide scan configuration for the cloud perimeter scan. You can either choose to provide custom scan configuration or specify global scan configuration settings to be used. You can create global scan configuration to be used for the cloud perimeter scan. If the custom scan configuration is not specified for the cloud perimeter scan, then the global scan configuration is used. - **qualys_global_scan_configurations_bulk_update** — Once you enable cloud perimeter scan for your connector, you need to provide scan configuration for the cloud perimeter scan. You can either choose to provide custom scan configuration or specify global scan configuration settings to be used. You can create global scan configuration to be used for the cloud perimeter scan. If the custom scan configuration is not specified for the cloud perimeter scan, then the global scan configuration is used. - **qualys_global_scan_configurations_search** — Use the API to search for the global scan configuration. You need not provide any input parameters. - **create_a_qualys_host_asset_activation** — Activate one host asset (by ID) for the given modules (module=QWEB_VM, QWEB_PC, …). - **get_single_qualys_host_asset_by_id** — Returns a single host asset by ID. This API returns additional EC2 metadata of Amazon EC2 hosts when inventoried using the Qualys EC2 Connector. - **create_a_qualys_host_asset** — Create one or more host assets using writable fields and collections. It is a good idea to attach tags that will make new assets visible to the current user if that user does not have permission to see all assets. Otherwise users will not be able to see or modify the new assets until an administrator or process attaches the appropriate tags to them. What's next? After you've created host assets you need to activate them to make them available for scanning and reporting. - **update_a_qualys_host_asset_by_id** — Update fields for a host asset and collections of host assets. Using the NOT EQUALS operator for updating host assets could result in accidental update of unknown hosts assets without any warning. To prevent accidental updates of unknown host assets, we do not support NOT EQUALS operator for update actions. - **qualys_host_assets_bulk_update** — Update fields for a host asset and collections of host assets. Using the NOT EQUALS operator for updating host assets could result in accidental update of unknown hosts assets without any warning. To prevent accidental updates of unknown host assets, we do not support NOT EQUALS operator for update actions. - **qualys_host_assets_search** — Returns a list of host assets matching the provided criteria. Assets are returned when they are visible to the user (i.e. in the user’s scope). - **qualys_host_assets_lookup_count** — Returns the number of host assets that match the provided criteria. A host asset is counted when the asset is visible to the user (i.e. it is in the user’s scope). - **delete_a_qualys_host_asset_by_id** — Delete one or more host assets. Using the NOT EQUALS operator for deleting host assets could result in accidental deletion of unknown host assets without any warning. To prevent accidental deletion of unknown host assets, we do not support NOT EQUALS operator for delete actions. - **qualys_host_assets_bulk_delete** — Delete one or more host assets. Using the NOT EQUALS operator for deleting host assets could result in accidental deletion of unknown host assets without any warning. To prevent accidental deletion of unknown host assets, we do not support NOT EQUALS operator for delete actions. - **qualys_host_assets_activate** — Activate one or more assets to make them available in your account for scanning and reporting. You’ll want to activate newly created hosts to make them available in the Vulnerability Management (VM) module and/or the Policy Compliance (PC) module. - **list_all_qualys_host_detections** — Download a list of hosts with the hosts latest vulnerability data, based on the host based scan data available in the user’s account. This data brings a lot of value to customers because they provide the latest complete vulnerability status for the hosts (NEW, ACTIVE, FIXED, REOPENED) and history information. The Host List VM Detection API also shows the Qualys Detection Score (QDS) for each detection record in the API output and allows users to filter the output based on the QDS. Paginated by Qualys truncation (truncation_limit records per page, next page via id_min); Truto follows the WARNING URL automatically. - **get_single_qualys_host_instance_vuln_by_id** — Returns a single host instance vulnerability data by ID. - **qualys_host_instance_vulns_search** — Returns a list of host instance vulnerabilities that match the provided criteria. These vulnerabilities are returned when the hosts are visible to the user (i.e. in the user’s scope). - **qualys_host_instance_vulns_lookup_count** — Returns the number of host instance vulnerabilities that match the provided criteria. A host instance vulnerability is counted when the asset visible to the user (i.e. it is in the user’s scope). - **list_all_qualys_host_ips** — List IP addresses in the user account. By default, all hosts in the user account are included. Optional input parameters support filtering the list by IP addresses and host tracking method. - **create_a_qualys_host_ip** — Add IP addresses to the user's subscription. Once added they are available for scanning and reporting. - **qualys_host_ips_bulk_update** — Update IP addresses in the user's subscription. Good to Know - Host attributes you can update include tracking method (IP, DNS, NETBIOS), owner, user-defined fields (ud1, ud2, ud3), and comments. - You cannot update an IP to use tracking method EC2 or AGENT. Also, if an IP is already tracked by EC2 or AGENT, you cannot change the tracking method to something else. We will skip the tracking method update in these cases. - You can update multiple IPs/ranges in the same request. The host attribute changes will apply to all IPs included in the action. - **list_all_qualys_host_patches** — The Patch API lets you view the list of all superseding patches for detection on specific host. For the host, the Patch Info List provides information such as detection QID, patch QID, patch severity, patch title, patch vendor ID, patch release date, and patch links. User permissions - Managers and Unit Managers can fetch the patch list on assets in their own business unit. Scanners and Readers fetch the patch list on assets in their own account. - **list_all_qualys_hosts** — Download a list of scanned hosts in the user’s account. By default, all scanned hosts in the user account are included and basic information about each host is provided. Hosts in the XML output are sorted by host ID in ascending order. The output of the Host List API is paginated. By default, a maximum of 1,000 host records are returned per request. You can customize the page size (i.e. the number of host records) by using the parameter “truncation_limit=10000” for instance. In this case the results will be return with pages of 10,000 host records. Paginated by Qualys truncation (truncation_limit records per page, next page via id_min); Truto follows the WARNING URL automatically. - **qualys_hosts_bulk_update** — Here you can filter host assets based on input parameters and then you can update host attributes using new update parameters (new_tracking_method, new_owner, new_ud1, new_ud2, new_ud3, and new_comment). Good to Know Good to Know - With host update API, you can update host attributes like tracking method (IP, DNS, NETBIOS), owner, user defined fields (ud1, ud2, ud3), and comments. - You cannot update an IP to use tracking method EC2 or AGENT. Also, if an IP is already tracked by EC2 or AGENT, you cannot change the tracking method to something else. We will skip the tracking method update in these cases. - **qualys_hosts_bulk_delete** — Purge hosts in your account to remove the assessment data associated with them. Purging hosts will remove host based data in the user’s account (scan results will not be removed). Purged host information will not appear in new reports generated by users. One or both types of host data is removed, based on the user’s API request: vulnerability data and compliance data. - **create_a_qualys_ignored_vulnerability** — Ignore vulnerabilities (QIDs) on hosts; tickets for them are closed/ignored. - **qualys_ignored_vulnerabilities_restore** — Restore (un-ignore) previously ignored vulnerabilities (QIDs) on hosts. - **list_all_qualys_ipv_6_mappings** — List IPv6 mapping records in the user's account. Each mapping record associates one IPv6 address in your network with one IPv4 address in the special mapping range 0.0.0.1-0.254.255.255.. A maximum of 5,000 IPv6 mapping records will be processed per request, unless the truncation_limit input parameter is specified. If the requested list identifies more than 5,000 records or the number of records specified using truncation_limit, then the XML output includes the element and instructions for making another request for the next batch of records. Paginated by Qualys truncation (truncation_limit records per page, next page via id_min); Truto follows the WARNING URL automatically. - **create_a_qualys_ipv_6_mapping** — Add IPv6 mapping records to the user's subscription. Each mapping record associates one IPv6 address in your network with one IPv4 address in the special mapping range 0.0.0.1-0.254.255.255. A maximum of 10,000 mapping records can be added per API request. - **qualys_ipv_6_mappings_bulk_delete** — Remove IPv6 mapping records from the user's subscription. - **list_all_qualys_knowledge_base_vulns** — Download vulnerability data from the Qualys KnowledgeBase. Authorized users have permission to use this API. Please contact Qualys Support or your Sales Representative if you would like to obtain authorization for your subscription. - **list_all_qualys_library_labels** — Using this API, you can list all library label details (ID and name) that are currently supported. Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_library_policy** — Import a library policy into your account (creates a new compliance policy). Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_library_policies** — Using this API, you can list all policies associated with a specific label ID. The response displays details such as the policy ID, title, version, and date. The results are filtered based on the specified label and technology. Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_library_policy_by_id** — Using this API, you can get the details about a specific library policy using policy ID or the title of the policy. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the policyId parameter (ID of the policy.). - **list_all_qualys_library_technologies** — Using this API, you can list all technology IDs and names associated with the label ID. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_mandate_asset_groups** — With this API, you can get a list of asset groups associated to a subscription. This API to run the user subscription must be AGMS enabled. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_mandate_asset_tags** — With this API, you can get a hierarchical list of asset tags for the subscription. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_mandate_policies** — With this API, you can get a list of all active policies associated for a subscription. Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_mandate_report_file_by_id** — With this API, you can download the compliance framework report in HTML format. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the reportDataId parameter (ID of the generated report (from the create call).). - **list_all_qualys_mandate_report_sources** — With this API, you can get all available asset source options for report creation. Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_mandate_report** — With this API, you can create a new mandate report. Maximum 3 mandate IDs and 10 policies can be selected for generating the compliance framework report. Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_mandate_report_by_id** — With this API, you can get the generation status of compliance framework reports. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the reportDataId parameter (ID of the generated report (from the create call).). - **list_all_qualys_mandates** — With this API, you can get a list of preferred compliance frameworks configured for a subscription, including the count of top-level requirements for each mandate. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_map_domains** — List asset domains in the user account. Basic HTTP authentication is required. Session based authentication is not supported using this API. - **create_a_qualys_map_domain** — Add and edit domains and related netblocks in the subscription. The domains defined may be used as targets for network scans (maps). Basic HTTP authentication is required. Session based authentication is not supported using this API. - **qualys_map_domains_bulk_update** — Edit the netblock / network of an existing map domain (identified by domain name). - **create_a_qualys_map_report_template** — Create a map report template in the user's account. - **qualys_map_report_templates_bulk_update** — Update a map report template from an XML template document (template_id = the template to update). - **delete_a_qualys_map_report_template_by_id** — Delete a map report template in the user's account. The id is sent as the template_id parameter (ID of the report template.). - **get_single_qualys_map_report_template_by_id** — Export a map report template to XML format. The id is sent as the template_id parameter (ID of the report template.). - **list_all_qualys_map_reports** — List map reports saved in the user’s account. Each entry in the map report list identifies a saved map report for a specific domain. There is a separate saved map report for each domain in the map target. Basic HTTP authentication is required. Session based authentication is not supported using this API. - **get_single_qualys_map_report_by_id** — Download a saved map in the user’s account, when the map has the scan status “Finished”. Each saved map report identifies map results for a specific domain. If you issue a map request for multiple domains using the map-2.php API, there is a separate saved map report for each domain in the map target. Basic HTTP authentication is required. Session based authentication is not supported using this API. The id is sent as the ref parameter (Map reference, e.g. map/987659876.19876.). - **delete_a_qualys_map_report_by_id** — Delete a previously saved network map or scan report, when the scan status is “Finished”. Basic HTTP authentication is required. Session based authentication is not supported using this API. The id is sent as the ref parameter (Map reference, e.g. map/987659876.19876.). - **create_a_qualys_map** — Launch a Qualys network map for one or more domains, initiating network discovery. The map target may include asset groups and the default scanner option may be enabled for distributed mapping across multiple scanner appliances. A map request for multiple domains issued using the map-2.php API, runs one map at a time, one domain at a time. If you cancel a running map for a domain using the scan_cancel.php function and there are multiple domains in the map target, the service cancels the maps for any remaining, undiscovered domains in the same map target. - **qualys_middleware_assets_activate** — We now support the Middleware Asset API that helps you list, activate, or deactivate middleware assets. The list functionality supports filtering by IP address, such as, hostname, operating system, and middleware technology, providing capabilities similar to the Middleware Assets tab in the Policy Audit application. Only users with the Manager role can activate, deactivate, and list middleware asset assessments. - **qualys_middleware_assets_deactivate** — We now support the Middleware Asset API that helps you list, activate, or deactivate middleware assets. The list functionality supports filtering by IP address, such as, hostname, operating system, and middleware technology, providing capabilities similar to the Middleware Assets tab in the Policy Audit application. Only users with the Manager role can activate, deactivate, and list middleware asset assessments. - **list_all_qualys_middleware_assets** — List middleware assets (hosts with middleware technologies) and their activation status; filter by ips, hostname, os, middleware_technology, status. Paginated by Qualys truncation (truncation_limit records per page, next page via id_min); Truto follows the WARNING URL automatically. - **list_all_qualys_networks** — List custom networks in your account. - **create_a_qualys_network** — Create a new custom network. - **update_a_qualys_network_by_id** — Change the name for a network. The id is sent as the id parameter (ID of the record.). - **qualys_networks_assign** — Assign a scanner appliance to a network. When the network support feature is enabled for your subscription, scanner appliances are assigned to networks. Each appliance can be assigned to 1 network only. - **list_all_qualys_option_profiles** — Export option profiles (all types) as XML. Filter with option_profile_id / option_profile_type. - **create_a_qualys_option_profile** — Import all option profiles defined in input XML file to the user's account. Manager role is required. When calling the Import Option Profile API the user needs to pass the proper XML with Content-Type XML. This will create option profiles in that user’s subscription. All validations are applied as in the Qualys portal UI while creating option profiles using the API. Validations and Constraints: The Option Profile DTD file is used to validate a generated/exported Option Profile XML file. - **create_a_qualys_patch_report_template** — Create a patch report template in the user's account. - **qualys_patch_report_templates_bulk_update** — Update a patch report template from an XML template document (template_id = the template to update). - **delete_a_qualys_patch_report_template_by_id** — Delete a patch report template in the user's account. The id is sent as the template_id parameter (ID of the report template.). - **get_single_qualys_patch_report_template_by_id** — Export a patch report template to XML format. The id is sent as the template_id parameter (ID of the report template.). - **list_all_qualys_pc_option_profiles** — List PC option profiles for compliance scans (using SCA or PC) in the user's account. Note : The list PC option profiles API is available as part of one of the following subscription combinations only: - PC and API add-on - PC, SCA, and API add-on - VMDR, SCA, and API add-on - **create_a_qualys_pc_option_profile** — Create a PC option profile for compliance scans (using SCA or PC) in the user's account. - **update_a_qualys_pc_option_profile_by_id** — Update a PC option profile for compliance scans (using SCA or PC) in the user's account. The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_pc_option_profile_by_id** — Delete a PC option profile for compliance scans in the user's account. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_pcas_control_evaluations** — With this API, you can list evaluation fields for technology associated with a specified control within a policy section. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_pcas_control_evaluations_bulk_update** — Update the evaluation condition / remediation of a control technology in a policy section. Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_pcas_control_technology** — With this API, you can add new technologies for a specific control within the policy section. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_pcas_control_technologies** — With this API, you can list technologies associated with a specific control within the policy section. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_pcas_control_technologies_bulk_delete** — Remove a technology from a control in a policy section (policyId + sectionNumber + controlId + technologyId). Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_pcas_policy_by_id** — With this API, you can export compliance policies in JSON format. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the policyId parameter (ID of the policy.). - **qualys_pcas_policies_bulk_update** — Update a compliance policy (title, cover page, active state); policyId identifies the policy. Calls the Qualys API gateway with the JWT obtained at connect time. - **delete_a_qualys_pcas_policy_by_id** — With this API, you can delete compliance policies and its postures. All details such as its exceptions and its posture are deleted. - The delete method can be executed by the Manager and Auditor users only. - Only one policy can be deleted at a time. Calls the Qualys API gateway with the JWT obtained at connect time. The id is sent as the policyId parameter (ID of the policy.). - **create_a_qualys_pcas_policy** — Create a compliance policy from a compliance framework (sections come from the framework_controls.search output). Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_pcas_policies_lock** — Lock (isLocked=true) or unlock (isLocked=false) a compliance policy. Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_pcas_policy_control** — With this API, you can add controls within a section of a compliance policy. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_pcas_policy_controls** — With this API, you can get the details of a specified control within a specified section of a compliance policy. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_pcas_policy_controls_bulk_update** — Update a control within a section of a compliance policy (policyId + sectionNumber + controlId). Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_pcas_policy_controls_bulk_delete** — Delete a control from a section of a compliance policy (policyId + sectionNumber + controlId). Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_pcas_policy_section** — With this API, you can add sections within a compliance policy. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_pcas_policy_sections** — With this API, you can list the details of a particular section within a compliance policy. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_pcas_policy_sections_bulk_update** — Rename a section of a compliance policy (policyId + sectionNumber). Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_pcas_policy_sections_bulk_delete** — Delete sections of a compliance policy (policyId + sectionNumber). Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_pcas_policy_technology** — With this API, you can add technologies within a compliance policy. When you add new technologies to the policy, the existing technologies within the policy remain Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_pcas_policy_technologies** — With this API, you can get all technologies associated with a compliance policy. Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_pcas_policy_technologies_bulk_delete** — Remove a technology from a compliance policy (policyId + technologyId). Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_pci_option_profiles** — List PCI option profiles in the user's account. - **create_a_qualys_pci_option_profile** — Create a PCI option profile in the user's account. - **update_a_qualys_pci_option_profile_by_id** — Update a PCI option profile in the user's account. The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_pci_option_profile_by_id** — Delete a PCI option profile in the user's account. The id is sent as the id parameter (ID of the record.). - **create_a_qualys_pci_report_template** — Create a PCI scan report template in the user's account. - **qualys_pci_report_templates_bulk_update** — Update a PCI report template from an XML template document (template_id = the template to update). - **delete_a_qualys_pci_report_template_by_id** — Delete a PCI scan report template in the user's account. The id is sent as the template_id parameter (ID of the report template.). - **get_single_qualys_pci_report_template_by_id** — Export a PCI scan report template to XML format. The id is sent as the template_id parameter (ID of the report template.). - **get_single_qualys_pci_scan_share_by_id** — Get the share status of a PCI scan that has been already shared with PCI merchant account. The id is sent as the scan_ref parameter (Scan reference, e.g. scan/1234567890.12345.). - **create_a_qualys_pci_scan_share** — Share (export) a finished PCI scan to Qualys PCI Merchant where you can generate reports required to prove your PCI compliance. The PCI Merchant account to be used must be already defined as a PCI account link using the Qualys user interface - **update_a_qualys_physical_appliance_by_id** — This API is used to update physical scanner appliances in the user's account. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_portal_versions** — Get the Qualys portal (QPS) and module versions of your platform. - **list_all_qualys_posture_host_ids** — The V5.0, V4.0, and V3.0 APIs is designed to fetch only PA/PC Asset data. To retrieve both PA/PC and SCA Asset data, continue using API Versions V1.0 or V2.0. If you want to enable V5.0, V4.0, or V3.0 to support SCA Asset data, contact your Technical Account Manager (TAM). This new version (/pcrs/5.0/posture/hostids) of this API enables to resolve hostIDs : With posture modified (failed or passed ) on or after the specified date. For all the policies or specific policies in your subscription without any limit on the number of policies. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_posture_policies** — List all policy IDs as per the last evaluation date specified. Calls the Qualys API gateway with the JWT obtained at connect time. - **create_a_qualys_posture_report_template** — Create a new compliance report template for the authenticated subscription. All roles (Reader, Scanner, Manager, Auditor, Unit Manager) are permitted to create templates. Calls the Qualys API gateway with the JWT obtained at connect time. - **update_a_qualys_posture_report_template_by_id** — Update an existing compliance report template for the authenticated subscription. All roles (Reader, Scanner, Manager, Auditor, Unit Manager) are permitted to create templates. The template type cannot be changed when updating a report template. Calls the Qualys API gateway with the JWT obtained at connect time. - **list_all_qualys_posture_report_templates** — Lists all compliance report templates visible to the subscription. Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_posture_report_template_by_id** — Retrieves details of a single report template, including all settings. Calls the Qualys API gateway with the JWT obtained at connect time. - **delete_a_qualys_posture_report_template_by_id** — Delete one or more report templates (id = a template ID, or several comma separated). Calls the Qualys API gateway with the JWT obtained at connect time. - **qualys_postures_search** — Get Posture Info Calls the Qualys API gateway with the JWT obtained at connect time. - **get_single_qualys_report_file_by_id** — Download a saved report in the user’s account. You can download all report types (map, scan, patch, authentication, scorecard, remediation, compliance). This option is available when the Report Share feature is enabled in the user’s subscription. You can also view risk scores to Host Based Scan Reports, including TruRisk score, Asset Criticality Score (ACS) and Qualys Detection Score (QDS). These values appear in all report formats, including XML and CSV. You can download reports from the UI or fetch reports using the API. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_report_templates** — List report templates in the user's account. A report template ID is returned for each template. The list includes templates for all report types. (This API does not support session authentication.) Example - List Report Templates Example - List Report Templates - **list_all_qualys_reports** — List reports in the user's account. The report list output includes all report types, including scorecard reports. You can generate a scan based report for a paused scan. The report still reflects all data processed prior to the pause. - **create_a_qualys_report** — Launch reports in the user's account. The Report Share feature must be enabled in the user's subscription. When a report is launched, the report is run in the background, and the report generation processing does not timeout until the report has completed. - **qualys_reports_cancel** — Cancel a running report in the user's account. - **delete_a_qualys_report_by_id** — Delete a report in the user's account. This option is available when the Report Share feature is enabled in the user’s subscription. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_restricted_ips** — Manage and update the list of restricted IPs within the user's subscription. Managers only have permission to perform these actions using this API. - **create_a_qualys_restricted_ip** — Manage and update the list of restricted IPs within the user's subscription. Managers only have permission to perform these actions using this API. - **qualys_restricted_ips_bulk_update** — Replace the whole restricted IPs list with the given IPs. - **qualys_restricted_ips_bulk_delete** — Remove the given IPs from the restricted IPs list. - **qualys_restricted_ips_bulk_delete_all** — Clear (remove all IPs from) the restricted IPs list. - **qualys_restricted_ips_activate** — Turn the restricted IPs feature on (enable=1) or off (enable=0) for the subscription. - **list_all_qualys_running_maps** — List maps and scans that are currently running in the user's account. If you're interested in listing scans only (not maps), we recommend using List Scans API (/api/2.0/fo/scan/) instead. Basic HTTP authentication is required. Session based authentication is not supported using this API. - **qualys_running_maps_cancel** — Cancel a map in progress in the user's account. It’s not possible to cancel a map when it has the scan status “Loading”. Basic HTTP authentication is required. Session based authentication is not supported using this API. - **create_a_qualys_scan_report_template** — Create a scan report template in the user's account. Support for Vulnerability Tags in scan report templates is available on request. Contact Qualys Support or your Technical Account Manager (TAM) to enable it for your account. - **qualys_scan_report_templates_bulk_update** — Update a scan report template from an XML template document (template_id = the template to update). - **delete_a_qualys_scan_report_template_by_id** — Delete a scan report template in the user's account. The id is sent as the template_id parameter (ID of the report template.). - **get_single_qualys_scan_report_template_by_id** — Export a scan report template to XML format. Support for Vulnerability Tags in scan report templates is available on request. Contact Qualys Support or your Technical Account Manager (TAM) to enable it for your account. The id is sent as the template_id parameter (ID of the report template.). - **get_single_qualys_scan_result_by_id** — Download the results of a VM scan whose status is Finished, Canceled, Paused or Error (id = scan reference). Output is CSV by default; set output_format=json or json_extended for JSON. - **list_all_qualys_scan_schedule_runs** — List the last N runs (scan references and statuses) of one or more scheduled scans (schedule_scan_ids, schedule_executions_count). - **list_all_qualys_scan_schedule_statuses** — Get only the latest execution status of one or more scheduled scans (schedule name, launch date, scan reference, next launch, status message). - **list_all_qualys_scan_schedules** — December 2025 December 2026 December 2025 December 2026 December 2025 December 2026 - **create_a_qualys_scan_schedule** — Create a new scan schedule in the users account. Good to Know A validation message displays during schedule scan from both the VM and PCI portals. If the asset group or FQDN contains DNS entries exceeding 4000 characters, users are notified before the scan is initiated. This proactive check prevents scan sharing failures and improves user experience. - **update_a_qualys_scan_schedule_by_id** — Update scan schedule in the user's account. During an update request you must specify target_from=assets when fqdn is specified in the same request. This is true for vulnerability scans and CertView type vulnerability scans. When fqdn is not specified during an update request for a scheduled scan that already has fqdn defined, we will keep the existing value. The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_scan_schedule_by_id** — Delete scan schedule in the user's account. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_scan_statistics** — List details about vulnerability scans and assets that are waiting to be processed. - **list_all_qualys_scan_summaries** — This is the original VM Scan Summary API for identifying hosts that were not scanned and why. We recommend you try the new improved VM Scan Summary API which has more filter options and enhanced output content. See VM Scan Summary . - **list_all_qualys_scanner_details** — The new Scanner Details API helps you identify the scanner used to scan a particular IP address at a given time. This is supported for vulnerability scans only. This new API is especially useful when you’re scanning a large number of IPs using a pool of scanners and you’re not sure which scanner was used to scan a particular host. The XML output will show the IP address scanned with the scan reference number, scan date, the scanner identifier (external scanner or scanner appliance name), scanner type (extranet or appliance) and scanner software versions. - **list_all_qualys_scans** — List VM scans in the user's account. By default scans launched in the past 30 days are listed. - When the Unit Manager runs the API for the scan list, the count differs from what appears on the Scan List page in the UI ( Scans > Scans ). This discrepancy occurs due to the in-scope scan list enabled by default in the API and the Show in Scope Scan List option disabled in the VM UI. - You can generate a scan based report for a paused scan. The report still reflects all data processed prior to the pause. - **create_a_qualys_scan** — Launch a VM scan in the user's account. Good to Know The Launch Scan API is asynchronous. When you make a request to launch a scan using this API, the service will return a scan reference ID right away and the call will quit without waiting for the complete scan results. When you launch a VM scan using the API, we check to see if the IPs in the scan target are available to the user making the scan request. To determine this, we check that each IP is in the subscription, in the VM license, and in the user’s assigned scope. If any IP in the target is not available to the user, then it will be skipped from the scan job. - **qualys_scans_cancel** — Stop a VM scan that is in progress. - **qualys_scans_pause** — Pause a VM scan that is in progress. - **qualys_scans_resume** — Resume (restart) a paused VM scan. - **delete_a_qualys_scan_by_id** — Delete a VM scan (id = scan reference, e.g. scan/1234567890.12345). - **get_single_qualys_scap_arf_report_by_id** — Create a SCAP scan report in Asset Reporting Format (ARF). This report is supported using PC/SCAP. The id is sent as the scan_id parameter (ID of the SCAP scan.). - **list_all_qualys_scap_policies** — View a list of SCAP policies visible to the user. Optional input parameters support filtering the policy list output. Maximum Policies per API Request A maximum of 1,000 SCAP policy records can be processed per request. If the requested list identifies more than 1,000 policies, then the XML output includes the element and instructions for making another request for the next batch of policy records. - **list_all_qualys_scap_scans** — List SCAP Scans This API is used to list SCAP scans in the user's account. By default scans launched in the past 30 days are listed. - **list_all_qualys_scheduled_reports** — List scheduled reports in your account. - **qualys_scheduled_reports_start** — Launch existing scheduled report in user's account now. - **list_all_qualys_scheduled_scans_and_maps** — List scheduled scan and map tasks (API v1). type=scan (default), map or all; active=yes|no. - **create_a_qualys_scheduled_scans_and_map** — Add a scheduled scan or map task (API v1 scheduled_scans.php add_task=yes): title, target, occurrence (daily/weekly/monthly) and start time. - **delete_a_qualys_scheduled_scans_and_map_by_id** — Remove a scheduled scan or map task (API v1 scheduled_scans.php drop_task=yes); saved reports of the task remain. The id is sent as the task_id parameter. - **create_a_qualys_scorecard_report** — Launch a vulnerability scorecard report in the user’s Report Share. It is not possible to launch any compliance scorecard reports or WAS scorecard reports using this API at this time. When a scorecard report is launched, the report is run in the background, and the report generation processing does not timeout until the report has completed. - **list_all_qualys_static_search_lists** — List static search lists and manage them (create, update, delete). - **create_a_qualys_static_search_list** — List static search lists and manage them (create, update, delete). - **update_a_qualys_static_search_list_by_id** — List static search lists and manage them (create, update, delete). The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_static_search_list_by_id** — List static search lists and manage them (create, update, delete). The id is sent as the id parameter (ID of the record.). - **qualys_tagged_users_search** — Get information on users along with their tags to the authorized user. Currently, we support three actions for the users: search, count, and get details of a user. - **qualys_tagged_users_lookup_count** — Get information on users along with their tags to the authorized user. Currently, we support three actions for the users: search, count, and get details of a user. - **get_single_qualys_tagged_user_by_id** — Get information on users along with their tags to the authorized user. Currently, we support three actions for the users: search, count, and get details of a user. - **create_a_qualys_tag** — Create a new tag and possibly child tags. - **update_a_qualys_tag_by_id** — Update fields for a tag and collections of tags. - **qualys_tags_bulk_update** — Update fields for a tag and collections of tags. - **qualys_tags_search** — Returns a list of tags that match the provided criteria. - **qualys_tags_lookup_count** — Count all the children of a tag. - **delete_a_qualys_tag_by_id** — Delete one or more tags. To prevent accidental deletion of unknown tags, we do not support NOT EQUALS operator for delete actions. - **qualys_tags_bulk_delete** — Delete one or more tags. To prevent accidental deletion of unknown tags, we do not support NOT EQUALS operator for delete actions. - **get_single_qualys_tag_by_id** — Returns a single tag by ID. - **list_all_qualys_ticket_details** — View remediation ticket information from the user’s account that can be integrated with third-party applications. Only remediation tickets that the user has permission to view are returned in the resulting ticket information report. Basic HTTP authentication is required. Session based authentication is not supported using this API. Qualys recommends that you run the get_tickets.php function two times a day, so that ticket updates due to the latest scan results and user productivity are made available in the ticket information reports. - **list_all_qualys_tickets** — View a list of selected tickets which the API user has permission to access. Truncation - A maximum of 1,000 tickets can be returned from a single request. If this maximum is reached, the function returns a “Truncated after 1,000 records” message at the end of the XML output with the last ticket number included. Using an account with more than 1,000 tickets (or potentially more than 1,000 tickets), it is recommended that you write a script that makes multiple ticket_list.php requests until all tickets have been retrieved. - **qualys_tickets_bulk_update** — Edit selected tickets in the subscription to update ticket state, change the assignee, and add comments. Edit remediation tickets in the user’s account. Multiple tickets can be edited at one time in bulk. Many ticket parameters are supported for selecting what tickets you’d like to edit. Basic HTTP authentication is required. Session based authentication is not supported using this API. Ticket limit - A maximum of 20,000 tickets can be edited in one ticket_edit.php request. It’s recommended best practice that you choose to schedule batch updates to occur when ticket processing will least impact user productivity. If the ticket_edit.php request identifies more than 20,000 tickets to be edited… - **qualys_tickets_bulk_delete** — Delete remediation tickets in the user’s account.Multiple tickets can be deleted at one time in bulk. Many ticket parameters are supported for selecting what tickets you’d like to edit. Basic HTTP authentication is required. Session based authentication is not supported using this API. Ticket limit - Deleting tickets can be a time intensive task, especially when batch deleting many tickets. A maximum of 20,000 tickets can be deleted in one ticket_delete.php request. It’s recommended best practice that you choose to schedule batch updates to occur when ticket processing will least impact user productivity. If the ticket_delete.php request identifies more than 20,000 tickets to be edited, then… - **list_all_qualys_time_zones** — List the time zone codes accepted by users.create / users.update (time_zone_code). - **list_all_qualys_users** — View the users in the subscription. XML responses provide details about each user such as the user’s login ID, account info, assigned asset groups, and permissions. Session-based authentication is not supported using this API. When the API request is made by a Manager or Unit Manager, the last login date for each user is provided in the XML results. This is the most recent date and time the user logged into the service. For a Manager, the last login date appears for all users in the subscription. For a Unit Manager, the last login date appears for all users in the Unit Manager’s same business unit. - **create_a_qualys_user** — Add a user account to the API user's subscription. This API does not support session based authentication. - **update_a_qualys_user_by_id** — Edit a user account already defined in the API user's subscription. This API does not support session based authentication. Using this API you can edit and clear parameters. Learn more The id is sent as the login parameter (Login (user name) of the user to edit.). - **qualys_users_activate** — Activate a user account in the API user's subscription. Note new accounts are activated by default after the user completes the account activation process (registration) by logging into the service for the first time. This API does not support session based authentication. - **qualys_users_deactivate** — Deactivate a user account in the API user's subscription. This API does not support session based authentication. - **qualys_users_reset** — Reset the password of a user (or your own); Qualys emails the new password unless email=0. - **list_all_qualys_vaults** — The Authentication Vault API (resource /api/2.0/fo/vault/) allows you to list authentication vaults in your account. List authentication vaults in your account. - **create_a_qualys_vault** — Create a vault in the user's account. - **update_a_qualys_vault_by_id** — Update a vault in the user's account. The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_vault_by_id** — Delete a vault in the user's account. The id is sent as the id parameter (ID of the record.). - **get_single_qualys_vault_by_id** — View settings for a vault in the user's account. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_vcenter_esxi_mappings** — List, import and purge vCenter - ESXi mapping records. Paginated by Qualys truncation (truncation_limit records per page, next page via id_min); Truto follows the WARNING URL automatically. - **create_a_qualys_vcenter_esxi_mapping** — Import vCenter-to-ESXi host mapping records from CSV or XML data. - **qualys_vcenter_esxi_mappings_bulk_delete** — Purge vCenter-to-ESXi host mapping records given as CSV or XML data. - **list_all_qualys_vendor_references** — This API lists vendor IDs and names related to vulnerabilities in the KnowledgeBase. This vendor information can be used to define dynamic search lists. All users except Auditors have permission to run this API. - **list_all_qualys_vendors** — This API lists vendor IDs and names related to vulnerabilities in the KnowledgeBase. This vendor information can be used to define dynamic search lists. All users except Auditors have permission to run this API. - **create_a_qualys_virtual_host_fqdn** — Add FQDNs to an existing virtual host (ip + port). - **qualys_virtual_host_fqdns_bulk_delete** — Remove FQDNs from an existing virtual host (ip + port). - **list_all_qualys_virtual_hosts** — List virtual hosts in the user's account. By default, all virtual hosts in the user's account are included. - **create_a_qualys_virtual_host** — Create, update and delete virtual hosts in the user account. A virtual host must have at least one FQDN. You can add multiple FQDNs to each virtual host if you like. One subscription can have a maximum of 5000 virtual hosts. The total limit of all the FQDNs, including commas, must be less than 4000 bytes per virtual host. - **qualys_virtual_hosts_bulk_update** — Update the FQDNs of the virtual host identified by ip + port (+ network_id). - **qualys_virtual_hosts_bulk_delete** — Delete the virtual host identified by ip + port (+ network_id). - **list_all_qualys_vm_option_profiles** — List VM option profiles in the user's account. - **create_a_qualys_vm_option_profile** — Create a VM option profile in the user's account. - **update_a_qualys_vm_option_profile_by_id** — Update a VM option profile in the user's account. The id is sent as the id parameter (ID of the record.). - **delete_a_qualys_vm_option_profile_by_id** — Delete a VM option profile in the user's account. The id is sent as the id parameter (ID of the record.). - **list_all_qualys_vm_scan_summaries** — This API can be used as an alternative to the original Scan Summary API. It’s easier to use, has more filter options and enhanced output content. This API helps you to identify hosts that were scanned or not scanned and why. You can choose to get a scan summary for a particular scan by specifying the scan reference ID or for all scans launched since a certain date/time or within a date range. This API will return details for all scans. Note, however, that the output will not include the block if the scan did not return results for some reason. - **list_all_qualys_vulnerability_scores** — Download Qualys Vulnerability Score (QVS) information from the Vulnerability KnowledgeBase for one or more CVE IDs based on certain criteria. The API output is in JSON format. The Qualys Vulnerability Score (QVS) is a Qualys-assigned score to a vulnerability based on multiple factors associated with the CVE, such as CVSS, EPSS and external threat indicators like active exploitation, exploit code maturity and much more. ## How it works 1. **Link your customer's Qualys account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app. 2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request. 3. **Call Truto's API to reach Qualys.** The Proxy API is a 1-to-1 mapping of the Qualys API. 4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field. ## Use cases - **Embed CAASM-grade asset visibility** — Let your users connect Qualys to pull their full IT asset inventory — IPs, OS details, installed software, and discovered cloud assets — directly into your asset management or security platform without building your own discovery layer. - **Power vulnerability-driven remediation workflows** — Ingest host detections, QIDs, and Qualys Detection Scores so your ITSM, patch management, or SOAR product can turn critical vulnerabilities into actionable tickets and trigger re-scans once fixes ship. - **Automate GRC evidence collection** — Pull Qualys compliance postures, policy pass/fail results, and mandate reports to automatically generate audit evidence for SOC2, ISO 27001, and PCI-DSS inside your compliance automation product. - **Orchestrate scans from CI/CD and cloud deployments** — Allow your DevSecOps or cloud security product to launch Qualys VM or compliance scans on demand when new assets are deployed, and configure AWS, Azure, or GCP connectors programmatically as customers onboard new cloud accounts. - **Enrich SIEM and threat intel pipelines** — Sync the Qualys Knowledge Base and live host detections into your SIEM or risk platform so analysts can correlate Qualys findings with other telemetry and prioritize by TruRisk scoring. ## What you can build - **Continuous asset sync** — Keep a live mirror of your customer's Qualys CSAM and host inventory, including software components, domains, and EASM-discovered external assets. - **Vulnerability detection feed** — Stream NEW, ACTIVE, FIXED, and REOPENED host detections with QDS scoring into your platform to drive dashboards, alerts, and SLAs. - **On-demand scan triggering** — Expose a UI or API in your product that lets users launch VM, compliance, or map scans against specific IPs or asset groups and retrieve results when complete. - **Two-way ticket and exception sync** — Pull Qualys tickets and compliance exceptions, update their status in bulk, and reflect remediation activity from your ITSM back into Qualys. - **Cloud connector provisioning** — Let users create and manage Qualys AWS, Azure, and GCP v3 connectors from inside your product — including fetching the CloudFormation template for AWS onboarding. - **Compliance posture reporting** — Build audit-ready views by pulling posture results, policy controls, mandate reports, and SCAP scan data mapped to frameworks your customers care about. ## FAQs ### How do end users authenticate their Qualys account? Qualys uses username/password credentials tied to a specific platform POD (US1, US2, EU1, etc.). Truto handles credential capture, token generation via the auth token endpoint, and routing requests to the correct regional base URL for each connected account. ### Which Qualys modules are covered by the available tools? The inventory spans VMDR (hosts, detections, scans, knowledge base), CSAM and EASM (asset and external attack surface), Policy Compliance (postures, policies, controls, mandates), PCI, SCAP, Cloud Connectors (AWS/Azure/GCP including v3), and admin objects like users, tags, asset groups, networks, and appliances. ### How fresh is the vulnerability and asset data? Freshness depends on your customer's Qualys scan cadence and agent check-in intervals — Qualys itself updates detections as scans complete. Truto can poll list_all_qualys_host_detections and CSAM endpoints on a schedule you define to keep your product in sync. ### Can we trigger scans and remediation actions, or is it read-only? Both. In addition to read endpoints, the integration supports create/update/delete for scans, scan schedules, tickets (bulk update and delete), compliance exceptions, ignored vulnerabilities, asset groups, tags, cloud connectors, and more — enabling true bi-directional workflows. ### How are Qualys pagination, rate limits, and concurrency handled? Qualys enforces per-subscription concurrency and rate limits that vary by subscription tier, and uses cursor/offset-based pagination that differs across its VM, CSAM, and PC APIs. Truto normalizes pagination and manages retries and throttling so you don't have to implement API-specific logic. ### Can we support customers across different Qualys platform regions? Yes. Each connected account specifies its Qualys POD, and Truto routes API calls to the correct regional endpoint automatically, so a single integration works for customers on US, EU, India, or other Qualys platforms. ### What if we need an endpoint that isn't in the current tool list? Truto can add Qualys endpoints on request. If your use case needs a specific resource not listed, we can extend the integration without you writing or maintaining the API client code.