CyberSecurity Asset Management/ Global AssetView Release 3.7.3.0 API

September 23, 2026 (october 14, 2026)

Introduced a new API to retrieve asset IDs without fetching complete asset details, helping reduce unnecessary data retrieval. The asset SBOM API now returns the last updated date for SBOM data. Domain APIs have also been enhanced with DNS search tokens to filter and count unresolved domains based on DNS record details.

Before understanding the API release highlights, learn more about the API server URL to be used in your API requests by referring to the Know Your Qualys API Server URL section. For this API Release Notes, <qualys_base_url> is mentioned in the sample API requests.

New Feature

Get Asset IDs Without Fetching Complete Asset Details

What's New for You

You can now fetch only the IDs of assets that match your filter criteria, without fetching complete asset details.

We have introduced the new Get List of Asset IDs API, which allows you to retrieve up to 9,950 asset IDs in a single request without fetching complete asset details. This helps reduce unnecessary data retrieval when you need only asset IDs. 

You can use this API to retrieve the IDs of all assets in your inventory or apply filters to retrieve only the asset IDs that match your criteria. Once you have the asset IDs, you can use the Get Host Details of All Assets API to retrieve complete details for the selected assets.

New API: Get List of Asset IDs API

New or Updated API New
API Endpoint /rest/2.0/search/am/asset/ids
Method POST
DTD or XSD changes Not Applicable

Use this API to fetch all asset IDs in your inventory, or only those that match your filter criteria.

Input ParametersInput Parameters

Parameter Mandatory/
Optional		 Data Type Description
Authorization Mandatory String The JWT bearer token.
lastSeenAssetId Optional Long The ID of the last asset returned in the previous response. Use this parameter to fetch the next set of asset IDs.
assetLastUpdated Optional String Fetch the IDs of assets updated after this date and time. Specify the date in UTC format: yyyy-MM-ddTHH:mmZ.
pageSize Optional Integer The number of asset IDs to include in the response. The default and maximum value is 9950.
assetCategory Optional String The category of assets to fetch. The default value is All.
filters Optional Object Filter criteria in the request body to refine the asset IDs in the response. If you do not specify filters, the API returns the IDs of all assets in your inventory.

Sample: Fetch the IDs of all assets in your inventorySample: Fetch the IDs of all assets in your inventory

API Request

curl -X POST
'<qualys_base_url>/rest/2.0/search/am/asset/ids'
--header 'Authorization: Bearer <JWT Token>'
--header 'Content-Type: application/json'

API Response

{
  "responseMessage": "Valid API Access",
  "count": 9950,
  "responseCode": "SUCCESS",
  "lastSeenAssetId": 23456,
  "hasMore": 1,
  "assetIds": [
    10001,
    10002,
    ...
    23456
  ]
}

Sample: Fetch the IDs of assets that match a filterSample: Fetch the IDs of assets that match a filter

API Request

curl -X POST
'<qualys_base_url>/rest/2.0/search/am/asset/ids?pageSize=3'
--header 'Authorization: Bearer <JWT Token>'
--header 'Content-Type: application/json'
--data '{
  "filters": [
    {
      "field": "operatingSystem.category1",
      "operator": "EQUALS",
      "value": "Windows"
    }
  ]
}'

API Response

{
  "responseMessage": "Valid API Access",
  "count": 3,
  "responseCode": "SUCCESS",
  "lastSeenAssetId": 12345,
  "hasMore": 1,
  "assetIds": [
    12301,
    12302,
    12345
  ]
}

Enhancement

Get the Last Updated Date for an Asset SBOM

What Changed for You

You can now view when an asset's Software Bill of Materials (SBOM) was last updated. This makes it easier to track changes to SBOM data.

The List Software Components for Specific Asset ID API response now includes the sbomLastUpdatedDate field. This field indicates the date and time when the SBOM for the asset was last changed or updated.

Updated API: List Software Components for Specific Asset ID

New or Updated API Updated
API Endpoint /rest/2.0/am/asset/component/{assetId}
Method POST
DTD or XSD changes Not Applicable

Use this API to get the list of software components for a specific asset discovered from the SwCA scan.

Sample: List of software components for a specific assetSample: List of software components for a specific asset

API Request

curl -X POST 
'<qualys_base_url>/rest/2.0/am/asset/component/{assetId}'
--header 'Authorization: Bearer <JWT Token>'
--header 'Content-Type: application/json'

API Response

{
  "responseMessage": "Valid API Access",
  "count": 2,
  "responseCode": "SUCCESS",
  "hasMore": 1,
  "lastAssetComponentId": 1000000000002,
  "assetId": 12345678,
  "sbomLastUpdatedDate": "2026-01-15T10:15:30.000+00:00",
  "componentsList": [
    {
      "assetComponentId": 1000000000001,
      "name": "example-library",
      "version": "2.2",
      "technology": ".NET",
      "installPath": "/opt/example/application/2.2/lib",
      "firstFoundAt": 1700000000000,
      "lastFoundAt": 1700000000000
    }
  ]
}

Enhancement

Search Unresolved Domains using DNS Search Tokens

What Changed for You

You can now use DNS search tokens to retrieve only the unresolved domains that match specific DNS records.

These DNS search tokens allow you to quickly find and analyze relevant unresolved domains in your organization.

The following DNS search tokens are now supported in the Domain APIs:

Token Description
dns.source Search by the source of the DNS record.
dns.type Search by the DNS record type.
dns.value Search by the DNS record value.

You can use the DNS search tokens in the request body of the following Domain APIs:

Updated API: Get a List of Unresolved Domains API

New or Updated API Updated
API Endpoint /rest/2.0/am/domain/list
Method POST
DTD or XSD changes Not Applicable

Use this API to get a list of unresolved domains for a given DNS record.

Sample: Get a list of unresolved domainsSample: Get a list of unresolved domains

API Request with filter in JSON

curl X POST
'<qualys_base_url>/rest/2.0/am/domain/list'
--header 'Content-Type: application/json'
--header 'Authorization: <JWT token>'
--data '{
  "filters": [
    {
      "field": "dns.type",
      "operator": "EQUALS",
      "value": "AAAA"
    }
  ]
}'

API Request with filter in XML

curl X POST 
'<qualys_base_url>/rest/2.0/am/domain/list'
--header 'Content-Type: application/xml'
--header 'Authorization: <JWT token>'
--data '<FilterRequest>
    <filters>
        <Criteria field="dns.type" operator="EQUALS">
            <value>AAAA</value>
        </Criteria>
    </filters>
</FilterRequest>'

API Response

{
    "responseMessage": "Valid API Access",
    "responseCode": "SUCCESS",
    "hasMore": 0,
    "count": 1,
    "lastFetchDomainId": -66826159,
    "domainListData": {
        "domains": [
            {
                "domain": "<domain_name>",
                "subdomain": "<subdomain_name>",
                "dns": [
                    {
                        "source": "PASSIVE_DNS",
                        "type": "AAAA",
                        "value": "2600:1f18:7fff:f800::a"
                    }
                ],
                "whoIs": {
                    "registrar": "Gxxx xxS",
                    "registrantOrg": "Qualys, Inc.",
                    "registrantEmailId": "<email id>",
                    "creationDate": "2025-01-01"
                }
            }
        ]
    }
}

Updated API: Get the Count of Unresolved Domains API

New or Updated API Updated
API Endpoint /rest/2.0/am/domain/count
Method POST
DTD or XSD changes Not Applicable

Use this API to get the total count of unresolved domains for the given DNS record

Sample: Get the total count of unresolved domainsSample: Get the total count of unresolved domains

API Request with filter in XML

curl -X POST 
'<qualys_base_url>/rest/2.0/am/domain/count'
--header 'Content-Type: application/xml'
--header 'Authorization: <JWT Token>'
--data '<FilterRequest>
    <filters>
        <Criteria field="dns.type" operator="EQUALS">
            <value>AAAA</value>
        </Criteria>
    </filters>
</FilterRequest>'

API Response

{
    "responseMessage": "Valid API Access",
    "responseCode": "SUCCESS",
    "count": 1
}

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy.