You can track API usage by a user without the need to provide user credentials such as the username and password.
API usage can be tracked using the X-Powered-By HTTP header which includes a unique ID generated for each subscription and a unique ID generated for each user. Once enabled, the X-Powered-By HTTP header is returned for each API request made by a user. The X-Powered-By HTTP header will be returned for both valid and invalid requests. However, it will not be returned if an invalid URL is hit or when user authentication fails.
Contact Qualys Support to get the X-Powered-By HTTP header enabled.
The X-Powered-By header is returned in the following format:
X-Powered-By: Qualys:<POD_ID>:<SUB_UUID>:<USER_UUID>
Where,
- POD_ID is the shared POD or a PCP. Shared POD is USPOD1, USPOD2, etc.
- SUB_UUID is the unique ID generated for the subscription
- USER_UUID is the unique ID generated for the user. You can use the USER_UUID to track API usage per user.
Sample X-Powered-By header
Here are sample outputs showing the X-Powered-By HTTP header.
Sample output for VM, PC
Sample output for other Qualys apps