Custom Assessment and Remediation Release 2.6 API

July 29, 2025

Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

New APIs to Manage Script Schedules

In this release, we have introduced the following new APIs that enable you to manage and automate your script schedules:

Search Schedules API
Get Schedule API
Update Schedule API
Delete Schedule API
Activate Schedule API
Deactivate Schedule API

New API: Search Schedules API

New or Updated API	New
API Endpoint	/sm/v1/scheduler/search
Method	POST
DTD or XSD changes	Not Applicable

This API is used to fetch the details of all the schedules.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
startAt	Optional	String	Provide the start date and time for filtering schedules.
endAt	Optional	String	Provide the end date and time for filtering schedules.
pageSize	Optional	Number	Provide the number of records you want to fetch per page.
pageNumber	Optional	Number	Provide the page number of the specific page you want to fetch. You can use this parameter together with pageSize to paginate a large number of records.
filter	Optional	String	Provide a filter to narrow down the search results.
sort	Optional	String	Provide the sorting order for the results. For example, `[{"created.dateTime":"desc"}]` sorts the results by creation date and time in descending order.

Sample: Fetch the list of schedulesSample: Fetch the list of schedules

API Request

curl -X POST
'<qualys_base_url>/sm/v1/scheduler/search'
-H 'Content-Type: application/json'
-H 'Authorization: Bearer {{authToken}}'
-d '{
  "startAt": "2025-05-26T11:47:56.810Z",
  "endAt": "2025-06-25T18:29:59.999Z",
  "pageSize": 50,
  "pageNumber": 0,
  "filter": "",
  "sort": "[{\"created.dateTime\":\"desc\"}]"
}

Response

{
  "body": {
    "totalCount": 3,
    "list": [
      {
        "id": "ff7c906f-394d-4e9...",
        "customerUuid": "74c1bcdd-9bbb...",
        "title": "Sample title",
        "description": "Sample description",
        "status": "ACTIVE",
        "startTime": "16:20:00",
        "startDate": "2025-06-11",
        "endDate": null,
        "scheduleType": "ONE_TIME",
        "monthlyScheduleType": null,
        "hourlyInterval": null,
        "daysOfWeek": null,
        "recurrenceDate": null,
        "recurrenceDay": null,
        "recurrenceMonth": null,
        "recurrenceWeekDay": null,
        "created": {
          "dateTime": 1749478026579,
          "user": {
            "id": "ddf20f3a-cfd3-6fd...",
            "name": "User name"
          }
        },
        "updated": {
          "dateTime": 1750851386130,
          "user": {
            "id": "ddf20f3a-cfd3-6fd4...",
            "name": "User name",
            "userName": "sample_username"
          }
        },
        "lastExecutionDateTime": 0,
        "nextExecutionDateTime": 0,
        "assets": null,
        "excludedAssets": null,
        "assetTags": [
          {
            "id": 1701,
            "UUId": "f1adce83-5cbe...."
          },
          {
            "id": 3085,
            "UUId": "3695da6c-7130-4a..."
          }
        ],
        "scripts": [
          {
            "id": 228,
            "title": "Sample Title",
            "platform": "WINDOWS",
            "language": {
              "id": 201,
              "name": "PowerShell-Command"
            },
            "params": []
          }
        ],
        "cronExpression": "00 20 16 11 06 ? 2025",
        "executionPolicyBypassEnabled": true,
        "allTagsForAssetsEnabled": false,
        "rebootAfterScriptExecution": false,
        "rebootDelayInSeconds": 0,
        "rebootDelayTimeUnit": null,
        "shareScriptResultWithFim": false
      },
      {
        "id": "1228b42a-c8cc....",
        "customerUuid": "74xxxxxx-9xxx-e9....",
        "title": "Sample Title",
        "description": "Sample description",
        "status": "ACTIVE",
        "startTime": "09:52:00",
        "startDate": "2025-06-09",
        "endDate": null,
        "scheduleType": "ONE_TIME",
        "monthlyScheduleType": null,
        "hourlyInterval": null,
        "daysOfWeek": null,
        "recurrenceDate": null,
        "recurrenceDay": null,
        "recurrenceMonth": null,
        "recurrenceWeekDay": null,
        "created": {
          "dateTime": 1749461837962,
          "user": {
            "id": "ddf20f3a-cfd3-6fd...",
            "name": "User name"
          }
        },
        "updated": {
          "dateTime": 1749461837962,
          "user": {
            "id": "ddf20f3a-cfd3-6f...",
            "name": "User name"
          }
        },
        "lastExecutionDateTime": 1749462720649,
        "nextExecutionDateTime": 0,
        "assets": [
          {
            "id": 44496319,
            "tags": null,
            "UUId": "2dabc804-fcea-4e..."
          },
          {
            "id": 49526617,
            "tags": null,
            "UUId": "7bb9c14f-ccd0-49d..."
          }
        ],
        "excludedAssets": null,
        "assetTags": null,
        "scripts": [
          {
            "id": 235820,
            "title": "Control ID Remediation",
            "platform": "WINDOWS",
            "language": {
              "id": 4,
              "name": "PowerShell-Script"
            },
            "params": []
          }
        ],
        "cronExpression": "00 52 09 09 06 ? 2025",
        "executionPolicyBypassEnabled": true,
        "allTagsForAssetsEnabled": false,
        "rebootAfterScriptExecution": false,
        "rebootDelayInSeconds": 0,
        "rebootDelayTimeUnit": null,
        "shareScriptResultWithFim": false
      },
      {
        "id": "d2db575b-9d32-4d8f....",
        "customerUuid": "74c1bcdd-9bb....",
        "title": "Sample title",
        "description": "Sample description",
        "status": "INACTIVE",
        "startTime": "06:05:00",
        "startDate": "2025-05-27",
        "endDate": null,
        "scheduleType": "ONE_TIME",
        "monthlyScheduleType": null,
        "hourlyInterval": null,
        "daysOfWeek": null,
        "recurrenceDate": null,
        "recurrenceDay": null,
        "recurrenceMonth": null,
        "recurrenceWeekDay": null,
        "created": {
          "dateTime": 1748324967997,
          "user": {
            "id": "ddf20f3a-cfd3-6fd....",
            "name": "User name"
          }
        },
        "updated": {
          "dateTime": 1748518315558,
          "user": {
            "id": "ddf20f3a-cfd3-6....",
            "name": "Name",
            "userName": "User name"
          }
        },
        "lastExecutionDateTime": 1748424711837,
        "nextExecutionDateTime": 0,
        "assets": [
          {
            "id": 4449,
            "tags": null,
            "UUId": "2dabc804-fce...."
          },
          {
            "id": 4952,
            "tags": null,
            "UUId": "7bb9c14f-ccd...."
          }
        ],
        "excludedAssets": null,
        "assetTags": null,
        "scripts": [
          {
            "id": 235,
            "title": "Sample title",
            "platform": "WINDOWS",
            "language": {
              "id": 4,
              "name": "PowerShell-Script"
            },
            "params": []
          }
        ],
        "cronExpression": "00 05 06 27 05 ? 2025",
        "executionPolicyBypassEnabled": true,
        "allTagsForAssetsEnabled": false,
        "rebootAfterScriptExecution": false,
        "rebootDelayInSeconds": 0,
        "rebootDelayTimeUnit": null,
        "shareScriptResultWithFim": true
      }
    ]
  }
}

New API: Get Schedule API

New or Updated API	New
API Endpoint	/sm/v1/scheduler/{id}
Method	GET
DTD or XSD changes	Not Applicable

This API is used to fetch the script schedule using the schedule ID.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
id	Mandatory	String	Provide the schedule ID in the URL.

Sample: Fetch details of a scheduleSample: Fetch details of a schedule

API Request

curl -X GET
'<qualys_base_url>/sm/v1/scheduler/123'
-H 'Content-Type: application/json'
-H 'Authorization: Bearer {{authToken}}'

Response

{
    "body": {
        "id": "ff7c906f-394d-4e9b....",
        "customerUuid": "74c1bcdd-9bbb-e9....",
        "title": "Sample title",
        "description": "Sample description",
        "status": "ACTIVE",
        "startTime": "16:20:00",
        "startDate": "2025-06-11",
        "endDate": null,
        "scheduleType": "ONE_TIME",
        "monthlyScheduleType": null,
        "hourlyInterval": null,
        "daysOfWeek": null,
        "recurrenceDate": null,
        "recurrenceDay": null,
        "recurrenceMonth": null,
        "recurrenceWeekDay": null,
        "created": {
            "dateTime": 1749478026579,
            "user": {
                "id": "ddf20f3a-cfd3-6fd4...",
                "name": "User name"
            }
        },
        "updated": {
            "dateTime": 1750851386130,
            "user": {
                "id": "ddf20f3a-cfd3-6fd4...",
                "name": "Patrick",
                "userName": "username"
            }
        },
        "lastExecutionDateTime": 0,
        "nextExecutionDateTime": 0,
        "assets": null,
        "excludedAssets": null,
        "assetTags": [
            
            {
                "id": 47668263,
                "UUId": "6130ed10-e64f-40a6..."
            },
            {
                "id": 28902062,
                "UUId": "3dff19c9-e7cc-4e4..."
            },
            {
                "id": 31486542,
                "UUId": "d0a3ff1f-d7d8-4ef..."
            }
        ],
        "scripts": [
            {
                "id": 228837,
                "title": "Sample Script",
                "platform": "WINDOWS",
                "language": {
                    "id": 201,
                    "name": "PowerShell-Command"
                },
                "params": []
            }
        ],
        "cronExpression": "00 20 16 11 06 ? 2025",
        "executionPolicyBypassEnabled": true,
        "allTagsForAssetsEnabled": false,
        "rebootAfterScriptExecution": false,
        "rebootDelayInSeconds": 0,
        "rebootDelayTimeUnit": null,
        "shareScriptResultWithFim": false
    }
}

New API: Update Schedule API

New or Updated API	New
API Endpoint	/sm/v1/scheduler/{id}
Method	POST
DTD or XSD changes	Not Applicable

This API is used to update an existing schedule.

Input ParametersInput Parameters

Parameter		Mandatory/ Optional	Data Type	Description
activate		Optional	Boolean	Provide `true` to activate the schedule or `false` to keep it inactive.
assetTags		Optional	List	Provide a list of specific asset tag IDs and UUIDs to include in the schedule.
assets		Optional	List	Provide a list of specific asset IDs and UUIDs to include in the schedule.
description		Optional	String	Provide a description of the schedule.
excludedAssets		Optional	List	Specify a list of assets to exclude from the scheduled script execution.
scripts		Mandatory	List	Include details of the scripts to execute with the schedule.
	id	Mandatory	Long	Provide the ID of the script to be scheduled for execution.
	title	Mandatory	String	Provide the title of the script to be executed.
	params	Optional	List	Provide the list of script parameters. It is mandatory in the case of a parameterized script.
title		Mandatory	String	Provide a title for the schedule.
user		Optional	List	Provide details of the user who is scheduling the script.
allTagsForAssetsEnabled		Optional	Boolean	Provide `true` if all tags for that asset are enabled; otherwise, `false`.
rebootAfterScriptExecution		Optional	Boolean	Provide `true` or `false` to reboot the asset after the script execution.
rebootDelayInSeconds		Optional	Number	Specify the time in seconds after which the asset should reboot.
rebootDelayTimeUnit		Optional	String	Specify the time unit for the reboot delay. Accepted values: hours minutes seconds
startDate		Mandatory	Integer	Provide the start date for the schedule.
startTime		Mandatory	Integer	Provide the start time for the schedule.
scheduleType		Mandatory	String	Provide the schedule type. Accepted values: ONE_TIME RECURRING
executionPolicy BypassEnabled		Optional	Boolean	Provide `true` to bypass the PowerShell execution policy on Windows hosts and run scripts regardless of the policy. If `false`, CAR follows the host’s execution policy. This parameter is applicable only for Windows PowerShell script execution.
shareScriptResultWithFim		Optional	Boolean	Provide `true` or `false` to share the script output with File Integrity Monitoring (FIM).

Sample: Update the scheduleSample: Update the schedule

API Request

curl -X POST
'<qualys_base_url>/sm/v1/scheduler/124'
-H 'Content-Type: application/json'
-H 'Authorization: Bearer {{authToken}}'
-d '{
  "activate": true,
  "assetTags": [
    { "UUId": "7bb9c14f-ccd0-49d6...",
      "id": 49526479
    }
],
  "assets": [
    {
      "UUId": "7bb9c14f-ccd0-49d6...",
      "id": 49526617
    }
  ],
  "description": "Sample_description",
  "excludedAssets": [],
  "scripts": [
    {
      "id": 236773,
      "title": "Sample title",
      "params": [
        {
          "key": "xXXxXXXx",
          "value": "SGV5IEhpaSAhISBT....",
          "mandatory": false
        }
      ]
    }
  ],
  "title": "Sample title",
  "user": {
    "id": "ddf20f3a-cfd3-6fd4...",
    "name": "John"
  },
  "allTagsForAssetsEnabled": false,
  "rebootAfterScriptExecution": false,
  "rebootDelayInSeconds": null,
  "rebootDelayTimeUnit": null,
  "startDate": "2025-06-25",
  "startTime": "13:37:00",
  "scheduleType": "ONE_TIME",
  "executionPolicyBypassEnabled": true,
  "shareScriptResultWithFim": false
}'

Response

{
    "errorCode": "0",
    "message": "Scheduler updated successfully",
    "body": "c62f7279-3d05-4cf..."
}

New API: Delete Schedule API

New or Updated API	New
API Endpoint	/sm/v1/scheduler/delete
Method	POST
DTD or XSD changes	Not Applicable

This API is used to delete an existing schedule.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
schedulerIds	Mandatory	List of strings	Provide the list of schedule IDs for deletion.

Sample: Delete a scheduleSample: Delete a schedule

API Request

curl -X POST
'<qualys_base_url>/sm/v1/scheduler/delete'
-H 'Content-Type: application/json'
-H 'Authorization: Bearer {{authToken}}'
-d '{
  "schedulerIds": [
    "c62f7279-3d05-4cf...."
  ]
}

Response

{
    "errorCode": "0",
    "message": "Scheduler deleted successfully",
    "body": [
        "c62f7279-3d05-4cfb...."
    ]
}

New API: Activate Schedule API

New or Updated API	New
API Endpoint	/sm/v1/scheduler/activate
Method	POST
DTD or XSD changes	Not Applicable

This API is used to activate a schedule.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
schedulerIds	Mandatory	List of strings	Provide the list of schedule IDs to activate these schedules.

Sample: Activate a scheduleSample: Activate a schedule

API Request

curl -X POST
'<qualys_base_url>/sm/v1/scheduler/activate'
-H 'Content-Type: application/json'
-H 'Authorization: Bearer {{authToken}}'
-d '{
  "schedulerIds": [
    "5ec11b6d-fea9-434...."
  ]
}

Response

{
    "errorCode": "0",
    "message": "Schedules activated successfully",
    "body": [
        "ff7c906f-394d-4e9...."
    ]
}

New API: Deactivate Schedule API

New or Updated API	New
API Endpoint	/sm/v1/scheduler/deactivate
Method	POST
DTD or XSD changes	Not Applicable

This API is used to deactivate a schedule.

Input ParametersInput Parameters

Parameter	Mandatory/ Optional	Data Type	Description
schedulerIds	Mandatory	List of strings	Provide the list of schedule IDs to deactivate these schedules.

Sample: Deactivate a scheduleSample: Deactivate a schedule

API Request

curl -X POST
'<qualys_base_url>/sm/v1/scheduler/deactivate'
-H 'Content-Type: application/json'
-H 'Authorization: Bearer {{authToken}}'
-d '{
  "schedulerIds": [
    "5ec11b6d-fea9-434...."
  ]
}

Response

{
    "errorCode": "0",
    "message": "Schedulers deactivated successfully",
    "body": [
        "5ec11b6d-fea9-43...."
    ]
}

API Support for Sharing Script Output with FIM

You can now share script output with the Qualys File Integrity Monitoring (FIM) module when executing scripts in CAR. We have introduced a new input parameter in the following APIs to help you configure this capability:

Execute Scripts On Demand API
Schedule Script Execution API

New Input Parameter

Parameter	Mandatory/ Optional	Data Type	Description
shareScriptResultWithFim	Optional	Boolean	Provide `true` or `false` to share the script output with FIM.

Execute Scripts On Demand API: Share Script Output with FIM

New or Updated API	Updated
API Endpoint	/sm/v1/scripts/{scriptId}/execute
Method	POST
DTD or XSD changes	Not Applicable

Use this API to execute and share the script output with FIM by using the new input parameter: shareScriptResultWithFim

Sample: Execute a scriptSample: Execute a script

API Request

curl -X POST 
"<qualys_base_url>/sm/v1/scripts/72648/execute"
--header "Content-Type: application/json"
--header "Authorization: Bearer <token>"
--data-raw '{
    "testMode": true,
    "testTags": [
      {
        "id": "751...",
        "UUId": "a3258427-cce3-4459..."
      }
    ],
    "user": {
      "id": "f0bbece3-a15d...",
      "name": "user name"
    },
    "executionPolicyBypassEnabled": false,
    "description": "Sample description",
    "rebootAfterScriptExecution": false,
    "rebootDelayInSeconds": null,
    "rebootDelayTimeUnit": null,
    "shareScriptResultWithFim": true,
    "params": [
      {
        "key": "string",
        "value": "string"
      }
    ]
  }'

Response

{
    "body": {
        "correlationUuid": "81761e17-470b-40ab-89db-ef02607e00ab"
    }
}

Schedule Script Execution API: Share Script Output with FIM

New or Updated API	Updated
API Endpoint	/sm/v1/scripts/scheduler
Method	POST
DTD or XSD changes	Not Applicable

Use this API to schedule script execution and share the script output with FIM by using the new input parameter: shareScriptResultWithFim

Sample: Schedule a script executionSample: Schedule a script execution

API Request

curl -X POST 
"<qualys_base_url>/sm/v1/scripts/scheduler"
--header "Content-Type: application/json"
--header "Authorization: Bearer <AuthToken>"
--data '{
    "activate": false,
    "assetTags": [],
    "assets": [
      {
        "UUId": "2dabc804-fcea-4....",
        "id": 44496319
      },
      {
        "UUId": "7bb9c14f-ccd0-49d6....",
        "id": 49526617
      }
    ],
    "description": "Sample description",
    "excludedAssets": [],
    "scripts": [
      {
        "id": 226213,
        "title": "Sample script title",
        "params": [
          {
            "key": "string",
            "value": "string"
          }
        ]
      }
    ],
    "title": "Sample title",
    "user": {
      "id": "ddf20f3a-cfd3-6fd....",
      "name": "User name"
    },
    "allTagsForAssetsEnabled": false,
    "rebootAfterScriptExecution": false,
    "rebootDelayInSeconds": null,
    "rebootDelayTimeUnit": null,
    "endDate": null,
    "startDate": "2025-05-21",
    "startTime": "07:23:00",
    "scheduleType": "ONE_TIME",
    "executionPolicyBypassEnabled": true,
    "shareScriptResultWithFim": true
}'

Response

{
    "errorCode": "0",
    "message": "Script scheduler created successfully",
    "body": {
        "id": "446f2f8b-f255-4934-92fc-b5d4f50102e3"
    }
}

Enhancements to Create and Import Script APIs

We have introduced the following new input parameters to enhance the Create and Import Script APIs:

subType: This parameter enables you to categorize your custom scripts as either Detection or Response. For more information, refer to Introducing Script Subtypes: Detection and Response.
typeName: This parameter enables you to specify the script type name, such as Custom Script and Custom QID.

Parameter Mandatory/ Optional Data Type Description

subType

Parameter	Mandatory/ Optional	Data Type	Description
subType	Mandatory (This parameter is mandatory only when the script type is Custom Script)	String	Provide a subtype value to label the script. Accepted values: Detection Response This parameter applies only to Custom Scripts. For Custom QID Scripts, the subType is automatically set to Detection, and for Control ID Remediation scripts, it is set to Response. You do not need to provide this parameter when creating these scripts.
typeName	Mandatory	String	Provide the name of the script type. You can fetch the script types using the following API: `GET` `/sm/v1/script-types` The available script types are: Custom Script Custom QID Control ID Remediation

Mandatory

(This parameter is mandatory only when the script type is Custom Script)

String

Provide a subtype value to label the script.

Accepted values:

Detection
Response

This parameter applies only to Custom Scripts.
For Custom QID Scripts, the subType is automatically set to Detection, and for Control ID Remediation scripts, it is set to Response. You do not need to provide this parameter when creating these scripts.

typeName

Mandatory

String

Provide the name of the script type.

You can fetch the script types using the following API:

GET /sm/v1/script-types

The available script types are:

Custom Script
Custom QID
Control ID Remediation

We have updated the version of these APIs to enable you to test the new APIs while maintaining the production environment with the old API version.
We recommend migrating to the latest versions of these APIs to ensure continued compatibility, support, and access to the latest features and security enhancements.

Create Scripts API: Introduced New Parameters

New or Updated API	Updated
API Endpoint (Old Version)	/sm/v5/script
API Endpoint (New Version)	/sm/v6/script
Method	POST
DTD or XSD changes	Not Applicable

Use this API to create and categorize the custom script using the subType parameter.

Sample: Create a custom scriptSample: Create a custom script

API Request

curl -X POST 
'<qualys_base_url>/sm/v6/script'
--header 'Accept: application/vnd.qualys.car.api.v6.0+json' 
--header 'Authorization: Bearer <authToken>' 
--header 'Content-Type: application/json' 
--data-raw 
'{
    "categoryId": 605,
    "content": "bHMgLWx0cg==",
    "description": "Sample description",
    "platform": "WINDOWS",
    "severity": "3",
    "threshold": 300,
    "thresholdTimeUnit": "SECOND",
    "title": "Sample title",
    "typeId": 1,
    "typeName": "Custom Script",
    "subType": "Detection",
    "languageId": 204,
    "scriptApprovalUserConsent": true,
    "hasParameters": false,
    "params": [
        {
            "key": "string",
            "value": "string"
        }
    ]
}'

Response

{
    "errorCode": "0",
    "message": "Script created successfully",
    "body": {
        "id": 100502
    }
}

Import Scripts API: Introduced New Parameters

New or Updated API	Updated
API Endpoint (Old Version)	/sm/v1/script-library/import
API Endpoint (New Version)	/sm/v2/script-library/import
Method	POST
DTD or XSD changes	Not Applicable

Use this API to import a custom script from the library and categorize the script using the subType parameter.

Sample: Import a custom scriptSample: Import a custom script

API Request

curl -X POST
'<qualys_base_url>/sm/v2/script-library/import'
--header 'Content-Type: application/json
--header 'Authorization: Bearer {{authToken}}'
--data '{
    "title": "Sample Title",
    "categoryId": 1,
    "id": 234564,
    "approved": true,
    "typeId": 1,
    "typeName": "Custom Script",
    "subType": "Detection"
  }'

Response

{
  "errorCode": "0",
  "message": "Script created from library successfully",
  "body": {
    "id": 86174
  }
}