Container Security Release 1.40 API

September 22, 2025

Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For these API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

With the Container Security 1.40 release, the following enhancements in APIs are made.

New Report Template - Compliance
Policy Tag Support for Centralized Policies

New Report Template - Compliance

With this release, Qualys Container Security has introduced a new report template - Compliance for your K8s Posture evaluation. To support this enhancement, the following APIs are updated.

Fetch a List of Reports in your Account
GET /csapi/v1.3/reports
Create a Report Request
POST /csapi/v1.3/reports
Create a Report Schedule
POST /csapi/v1.3/reports/schedule
Update an Active Report Schedule
PUT /csapi/v1.3/reports/schedule/{reportingSchedulingId}

Updated API: Fetch a List of Reports in Your Account

New or Updated APIs	Updated
API Endpoint (New version)	/csapi/v1.3/reports
Method	GET
DTD XSD Changes	No

Sample: Fetch a List of Reports in Your AccountSample: Fetch a List of Reports in Your Account

API Request

    curl -X 'GET' \
  '<qualys_base_url>/csapi/v1.3/reports?pageNumber=1&pageSize=50&sort=status%3Adesc' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <token>'

API Response
In the response below, see the new 'templateName' - CS_KUBERNETES_POSTURE - and 'displayColumns' values such as cid, controlName and so on which were used while creating a Compliance report.

    {
  "data": [
    {
      "reportUuid": "4c90c260-71b5-11f0-92c4-d75b653a5a10",
      "createdAt": "2025-08-05T04:33:13.000Z",
      "reportName": "Test",
      "description": null,
      "fileFormat": "csv",
      "templateName": "CS_KUBERNETES_POSTURE",
      "status": "COMPLETED",
      "isScheduled": 0,
      "filter": null,
      "displayColumns": [
        "cid",
        "controlName",
        "controlCriticality",
        "resourceType",
        "resourceName",
        "status",
        "clusterName",
        "version",
        "evidence",
        "remediationPath",
        "remediation",
        "firstScanned",
        "lastScanned"
      ],
      "expireOn": "2025-08-12T04:33:13.000Z",
      "emailNotification": 0,
      "recipient": "",
      "emailSubject": "",
      "customMessage": "",
      "sendAsAttachment": 0,
      "fileZipped": 0,
      "expireAfter": 7
    }
  ],
  "count": 1
}

Updated API: Create a Report Request

New or Updated APIs	Updated
API Endpoint (New version)	/csapi/v1.3/reports
Method	POST
DTD XSD Changes	No

Input ParametersInput Parameters

The Input Parameters below show the updated parameter used for creating a report request.

Parameter	Mandatory/Optional	Data Type	Description
displayColumns	Optional	string	Specify the columns to include in the report. Multiple columns should be comma-separated. The following column values are applicable. cid, controlName, controlCriticality, resourceType, resourceName, status, clusterName, version, evidence, remediationPath, remediation, firstScanned, lastScanned
templateName	Mandatory	string	Specify the name of the report template. With this release, 'CS_KUBERNETES_POSTURE' report template is supported.

Sample: Create a Report Request Sample: Create a Report Request

API Request to create a report

In the request below, see the new 'templateName' - CS_KUBERNETES_POSTURE - and 'displayColumns' values which are used to create a Compliance report.

   curl -X 'POST' \
  '<qualys_base_url>/csapi/v1.3/reports' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "description": "API test",
  "name": "Test2",
  "filter": null,
  "displayColumns": [
    "controlCriticality",
    "cid",
    "controlName",
    "resourceType"
  ],
  "templateName": "CS_KUBERNETES_POSTURE",
  "expireAfter": "1",
  "zip": "0",
  "emailNotification": "0",
  "sendAsAttachment": "0",
  "recipient": "[email protected]",
  "emailSubject": "Test email subject",
  "customMessage": ""
}'

API Response

    { 
"reportUuid": "095ef510-71b6-11f0-85b5-6d2c994600cb" 
}

Updated API: Create a Report Schedule

New or Updated APIs	Updated
API Endpoint (New version)	/csapi/v1.3/reports/schedule
Method	POST
DTD XSD Changes	No

Input ParametersInput Parameters

The following table shows the updated or new input parameters.

Parameter	Mandatory/Optional	Data Type	Description
displayColumns	Optional	string	Specify the columns to include in the report schedule. Multiple columns should be comma-separated. The following column values are applicable. cid, controlName, controlCriticality, resourceType, resourceName, status, clusterName, version, evidence, remediationPath, remediation, firstScanned, lastScanned
templateName	Mandatory	string	Specify the name of the report template. With this release, 'CS_KUBERNETES_POSTURE' report template is supported.

Sample: Create a Report ScheduleSample: Create a Report Schedule

API Request

    curl -X 'POST' \
  '<qualys_base_url>/csapi/v1.3/reports/schedule' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "Test4",
  "description": "",
  "templateName": "CS_KUBERNETES_POSTURE",
  "filter": null,
  "reportScheduleDetails": {
    "recurrenceType": "DAILY",
    "selectedDayOfWeeks": null,
    "monthlyType": null,
    "ordinalDayOfMonth": 1,
    "dayOfWeek": null,
    "ordinalDayOfWeek": null
  },
  "expireAfter": 7,
  "displayColumns": null,
  "zip": 0,
  "emailNotification": 1,
  "sendAsAttachment": 0,
  "customMessage": "",
  "recipient": "",
  "emailSubject": "",
  "eventEndTime": "2025-08-06T11:14:00Z",
  "action": "CREATE",
  "eventTime": "2025-08-05T04:50:00Z"
}'

API Response

    {
  "scheduleUuid": "13dd4ef0-71b7-11f0-85b5-6d2c994600cb"
}

Updated API: Update an Active Report Schedule

New or Updated APIs	Updated
API Endpoint (New version)	/csapi/v1.3/reports/schedule/{reportingScheduleID}
Method	PUT
DTD XSD Changes	No

Input ParametersInput Parameters

Parameter	Mandatory/Optional	Data Type	Description
displayColumns	Optional	string	Specify the columns to include in the report. Multiple columns should be comma-separated. The following column values are applicable. cid, controlName, controlCriticality, resourceType, resourceName, status, clusterName, version, evidence, remediationPath, remediation, firstScanned, lastScanned

Sample: Update an Active Report ScheduleSample: Update an Active Report Schedule

API Request

    curl -X 'PUT' \
  '<qualys_base_url>/csapi/v1.3/reports/schedule/13dd4ef0-71b7-11f0-85b5-6d2c994600cb' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "filter": null,
  "displayColumns": [
    "controlCriticality",
    "evidence",
    "controlName"
  ],
  "expireAfter": "30",
  "eventEndTime": "2026-08-05T04:47:07.577Z",
  "eventTime": "2025-08-05T04:55:07.577Z",
  "reportScheduleDetails": {
    "recurrenceType": "DAILY",
    "selectedDayOfWeeks": null,
    "monthlyType": null,
    "ordinalDayOfMonth": 1,
    "dayOfWeek": null,
    "ordinalDayOfWeek": null
  },
  "zip": "0",
  "emailNotification": "0",
  "sendAsAttachment": "0",
  "recipient": "",
  "emailSubject": "Test email subject",
  "customMessage": ""
}'

API Response

{
  "message": "Details updated successfully for reportScheduleId 13dd4ef0-71b7-11f0-85b5-6d2c994600cb"
}

Policy Tag Support for Centralized Policies

In this phase of Centralized Policy Management, you can get a list of all centralized policies based on a policy tag. To support this, Qualys Container Security has introduced a new filter value - policy.tags.name:<tag name>.

Updated API: Show a List of Centralized Policies

New or Updated APIs	Updated
API Endpoint (New version)	/csapi/v1.3/centralizedPolicy
Method	GET
DTD XSD Changes	No

Input ParametersInput Parameters

The Input Parameters below show the updated parameters used for showing a list of Centralized Policies.

Parameter	Mandatory/Optional	Data Type	Description
filter	Optional	string	Indicates the policy tag name assigned to the centralized policies. New value: policy.tags.name: <tag name>

Sample: Show a List of Centralized PoliciesSample: Show a List of Centralized Policies

API Request

    curl -X 'GET' \  
'<qualys_base_url>/csapi/v1.3/centralizedPolicy?filter=policy.tags.name:"tag a1"&pageNumber=1&pageSize=50&sort=created%3Adesc'\ 
-H 'accept: application/json' \  
-H 'Authorization: Bearer <token>

API Response

    {  "data": 
[   {   "uuid": "279d9326-9e11-4d32-a8ff-b0480efb521e",      
        "policyName": "test1",      
        "description": "",      
        "policyMode": "ACTIVE",      
        "createdBy": "john_doe",      
        "created": "1751350525902",      
        "updatedBy": "john_doe",      
        "updated": "1751350525902",      
        "policyType": "CICD",      
        "isDefault": false,      
        "assignedTags": [        
{       "uuid": "3b0ce1e8-eef0-4c6b-90a3-7d2ec4b1ffa2",          
        "id": 153722692,          
        "name": "tag a1",          
        "backgroundColor": "#000000",          
        "foregroundColor": "#000000",          
        "icon": "",          
        "criticalityScore": 0,          
        "tagType": null        
}      
]    
}  ],  
"count": 1,  
"groups": {},  
"aggs": null
}

Last updated: November, 2025