Get Findings by Asset API

POST/etm/api/rest/v1/findings/asset/{assetId}

Use this API to get findings associated with a specific asset. You can filter, sort, and paginate the findings using the request body parameters.

Input ParametersInput Parameters

Parameter	Mandatory/Optional	Data Type	Description
assetId	Mandatory	Long	Provide a unique asset ID.
pageNumber	Optional	Integer	The page is to be returned. Starts from zero. Default: 0
pageSize	Optional	Integer	Provide the number of records per page to be included in the response. Default: 20 Maximum: 1000
havingQuery	Optional	String	Filter findings using a nested having QQL query.
searchAfter	Optional	Array/List	Provide a cursor for retrieving the next set of records after specified ID.
Authorization	Mandatory	String	Authorization token to authenticate to the Qualys Enterprise TruRisk Platform Prepend token with Bearer and one space. For example - Bearer authToken

Pagination – Important Notes

The searchAfter is a pagination token that enables APIs to fetch the next page of results from the exact point where the previous page ended. Note the following important factors while using pagination:

Do not include the searchAfter field in the initial API request.
The first request returns the first page of results.
Check the response for a searchAfter value.
If a searchAfter value is returned, include that exact value in the next request to retrieve the subsequent page.
For each additional page, use the latest searchAfter value from the previous response.
Continue this process until the response does not contain a searchAfter field, which indicates that there are no more results to retrieve.

The absence of the searchAfter field in a response signifies the end of the result set.

SampleSample

API Request

curl -X POST 
'<qualys_base_url>/etm/api/rest/v1/findings/asset/{asset_id}'
--header 'Content-Type: application/json'
--header 'Authorization: Bearer <JWT Token>'
--data '{
    "pageNumber": 0,
    "pageSize": 2,
    "havingQuery": "finding.severity:2",
    "searchAfter": [
        "5ec5ce96-7477-48f2-bc40-c6c7166658e3"
    ]
}'

Response

{
    "data":[
        {
            "findingId": "92b047ee-6a6d-4e6b-9877-5c18e9c67324",
            "title": "Microsoft SMB Server Remote Code Execution Vulnerability (MS17-010) and Shadow Brokers",
            "severity": "5",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": "2022-06-02T14:28:03.000Z",
            "lastFound": "2022-12-28T11:09:53.000Z",
            "assetId": "197168",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        },
        {
            "findingId": "abf99f1b-dffe-4bef-b8f1-732f0543e76d",
            "title": "Microsoft SMB Server Remote Code Execution Vulnerability (MS17-010) and Shadow Brokers",
            "severity": "5",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": "2022-06-02T14:28:03.000Z",
            "lastFound": "2022-12-28T11:09:53.000Z",
            "assetId": "197168",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        },
        {
            "findingId": "d9da55f1-dbd1-48fc-ae5a-ba42fa7a7c68",
            "title": "Alpine Linux Security Update for apache2",
            "severity": "4",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": "2022-06-02T14:28:03.000Z",
            "lastFound": "2022-12-28T11:09:53.000Z",
            "assetId": "199852",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        },
        {
            "findingId": "6b939b23-b54f-4157-8d3e-b2dca8ddffd9",
            "title": "Alpine Linux Security Update for apache2",
            "severity": "5",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": "2022-06-02T14:28:03.000Z",
            "lastFound": "2022-12-28T11:09:53.000Z",
            "assetId": "198436",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        },
        {
            "findingId": "d9ab0ff3-796b-4ed3-8043-2c46d7724177",
            "title": "CentOS Security Update for polkit (CESA-2022:0274) (PwnKit)",
            "severity": "4",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": "2022-06-02T14:28:03.000Z",
            "lastFound": "2022-12-28T11:09:53.000Z",
            "assetId": "197648",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        }
    ],
    "totalCount": 52768,
    "searchAfter": [
        "abf99f1b-dffe-4bef-b8f1-732f0543e76d"
    ]
}

Last updated: July, 2026