Release 3.3.0.0 API

November 26, 2024 (Updated on December 19, 2024)

Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

What's New?

New API - Download Reports

New or Updated API New
API Endpoint /rest/2.0/am/report/download
Method GET
DTD or XSD changes Not Applicable

Before this release, you could download the required report only using the CSAM UI.
With this release, we introduced a new API to download the specified report.


- You can download the reports only with the COMPLETED status.
The report download fails for the reports with the rest of the statuses.
- If you provide the report name that matches a single or multiple existing reports
with the COMPLETED status, the latest report with the COMPLETED status is downloaded.

Enhanced APIs - EASM APIs

With this release, we added new optional input parameters to the following APIs:
Create an EASM Profile | Update an EASM Profile Data

Patch an EASM Profile Data | Get the EASM Profile Data

Also, the excludeCDNAssets, defaultPurgeRuleFrequency, excludeDefamatoryDomain, and enableTyposquattedDomainGeneration new fields are added to the Get EASM Profile Data API.

Enhanced API - Create an EASM Profile

New or Updated API Updated
API Endpoint /easm/v2/profile
Method POST
DTD or XSD changes Not Applicable

With this release, the following new optional input parameters are added to the Create, Update, and Patch an EASM Profile Data APIs. You can provide them as part of the API request payload based on your requirements. See the following Input Parameter Details table: 

Input Parameters

The following new input parameters are applicable to the Create, Update, and Patch an EASM Profile Data APIs.

Parameter and Data Type

Description

excludeCDNAssets

(String)

Provide the value as 'true' if you want to view the CDN assets for EASM LighweightScan. Otherwise, provide the value 'false'. The default value is 'true'. 

The excludeCDNAssets parameter is supported only if the enableEASMSCAN parameter is set to true.

defaultPurgeRule
Frequency

(Numerical)

Provide the value within the 0-10 range. The default value is 3.

Example: If you provide the value 3, and the asset is not discovered through 3 EASM discoveries, it will be deleted from the CSAM account.

excludeDefamatory
Domain

(String)

Provide the value as 'false' if you want to view the defamatory domains.  The default value is 'true'.

 The excludeDefamatoryDomain parameter is supported only if the enableTyposquattedDomainGeneration parameter is set to 'true'.

enableTyposquatted
DomainGeneration

(String)

Provide the value as 'true' if you want to generate and view the typosquatted domains for the respective domain and organization seed values. The default value is 'false'.

Enhanced API - Update an EASM Profile Data

New or Updated API Updated
API Endpoint /easm/v2/profile/{profileName}
Method PUT
DTD or XSD changes Not Applicable

Refer to the Input Parameters table for detailed information about the newly added input parameters.

Enhanced API - Patch an EASM Profile Data

New or Updated API Updated
API Endpoint /easm/v2/profile/{profileName}
Method PATCH
DTD or XSD changes Not Applicable

Refer to the Input Parameters table for detailed information about the newly added input parameters.

Enhanced API - Get an EASM Profile Data

New or Updated API Updated
API Endpoint /easm/v2/profile
Method GET
DTD or XSD changes Not Applicable

With this release, you can learn the following details from the new fields that are added to the response:

  • excludeCDNAssets: The CDN assets are included in the EASM LighweightScan or not.
  • defaultPurgeRuleFrequency: The purge rule frequency of the assets. If the assets are not discovered through the EASM discoveries according to the stated count, they are deleted from the CSAM account.
  • excludeDefamatoryDomain: Whether viewing the defamatory domains is enabled or not.
  • enableTyposquattedDomainGeneration: Whether generation and viewing of the typosquatted domains for the respective domain and organization seed values is enabled of not. 

Enhanced API - Third Party Assets API with Webhook Findings

New or Updated API Updated
API Endpoint /rest/2.0/am/connector/asset/data/sync
Method POST
DTD or XSD changes Not Applicable

With this release, you can provide the 'Webhook Findings' information in the sample payload of this API. This section is introduced explicitly for ETM customers. We support the Vulnerability and Misconfiguration categories for the payload.

Using this API with the 'Webhook Findings' information, you get the details, such as Vulnerabilities, QDS, and Risk-Contributing findings. Also, if any misconfiguration finding in the form of EOL EOS Software exists, then Open Port detects it and calculates the Risk Score.

Important to Know!

  • When the category is VULNERABILITY:
    • subCategory must be either Confirmed, Information, or Potential.
    • findingStatus must be either New, Active, Fixed, or null.
    • severity must be in the range of 1-5.
  • When the category is MISCONFIGURATION:
    • findingStatus must be either PASS, FAIL, or null.
    • severity must be in the range of 1-5.

Enhanced APIs to Get the Scanner Assets from the CSAM Application

With this release, the following APIs are enhanced to get the Scanner Assets from the CSAM Application:

Get Host Details of All Assets | Get Host Details of Specific Asset | Get Count of Assets  

Enhanced API - Get Host Details of All Assets

New or Updated API Updated
API Endpoint /rest/2.0/search/am/asset
Method POST
DTD or XSD changes Not Applicable

Before this release, you could get the scanner assets only from the AssetView application.
With this release, we updated this API so that you can also get the scanner assets from the CSAM application.

Enhanced API - Get Host Details of Specific Asset

New or Updated API Updated
API Endpoint /rest/2.0/get/am/asset
Method GET
DTD or XSD changes Not Applicable

With this release, we have enhanced the host details API to get the details of a specific scanner asset using its assetid.

Enhanced API - Get Count of Assets

New or Updated API Updated
API Endpoint /rest/2.0/count/am/asset
Method POST
DTD or XSD changes Not Applicable

With this release, we have enhanced the get count of assets API to provide the count of scanner assets.

Enhanced APIs to Get the List of typosquatted and defamatory Domains

With this release, we enhanced the following APIs: Get List of Unresolved Domains | Get Count of Unresolved Domains

As a result, you can get the list of typosquatted (look-alike) and defamatory domains for the domain and organization seed values configured in the respective EASM profile.

Enhanced API - Get List of Unresolved Domains

New or Updated API Updated
API Endpoint /rest/2.0/am/domain/list
Method POST
DTD or XSD changes Not Applicable

With this release, we enhanced this API so that you can get the list of typosquatted (look alike) and defamatory domains for the domain and organization seed values configured in the respective EASM profile.

Important to Know

To filter data, the filters that must be used in the API body are:
asset.domain, permutation.name, permutation.category, permutation.types, 
whoIs.creationDate,  whoIs.expirationDate, whoIs.registrantCountry, 
whoIs.registrantOrg, whoIs.registrantEmailId, whoIs.registrar, and tags.name.

Enhanced API - Get Count of Unresolved Domains

New or Updated API Updated
API Endpoint /rest/2.0/am/domain/count
Method POST
DTD or XSD changes Not Applicable

With this release, you can get the count of the typosquatted (look alike) and defamatory domains for the domain and organization seed values configured  in the respective EASM profile.

Enhanced API - Get List of Vulnerabilities Discovered by EASM Scan

New or Updated API Updated
API Endpoint /rest/2.0/search/am/easm/scan/vulns
Method POST
DTD or XSD changes Not Applicable

With this release, new parameters are added to the Get List of Vulnerabilities discovered by the EASM Scan API that filters the list of vulnerabilities with specific criteria. 

Additionally, for all dates, you can provide datetime filter along with date filter in the API. For example, "lastFoundDate": "2024-10-18T12:04:19.000Z".

Important to Know

The following are the filters and their corresponding operators supported for this API:

  • vulnerabilities.status: IN, EQUALS, NOT_EQUALS
  • vulnerabilities.severity: EQUALS, LESSER, GREATER, GREATER_THAN_EQUAL, LESS_THAN_EQUAL
  • vulnerabilities.solution: CONTAINS
  • vulnerabilities.title: CONTAINS
  • vulnerabilities.rti: EQUALS, NOT_EQUALS

© 2025 Qualys, Inc. All rights reserved. Privacy Policy.