List Findings API

POST/etm/api/rest/v1/findings/list

Use this API to get a paginated list of findings.

Input ParametersInput Parameters

Parameter	Mandatory/Optional	Data Type	Description
page	Optional	Integer	The page to be returned. Starts from zero. Default: 0
pageSize	Optional	Integer	Provide the number of records per page to be included in the response. Default: 20
query	Optional	String	Provide QQL query `asset.criticalityScore:4`
havingQuery	Optional	String	Provide a secondary query applied at the finding level within an asset context.
searchContext	Optional	Enum	Provide query parsing context. Use FINDING for this endpoint. Default: FINDING
filters	Optional	Map	Filter the list by providing a query.
searchAfter	Optional	Array/List	Provide a cursor for retrieving the next set of records after specified ID.
includeNonReconciled	Optional	Boolean	Include unreconciled findings across scanners when set to true.
Authorization	Mandatory	String	Authorization token to authenticate to the Qualys Enterprise TruRisk Platform Prepend token with Bearer and one space. For example - Bearer authToken

Pagination – Important Notes

The searchAfter is a pagination token that enables APIs to fetch the next page of results from the exact point where the previous page ended. Note the following important factors while using pagination:

Do not include the searchAfter field in the initial API request.
The first request returns the first page of results.
Check the response for a searchAfter value.
If a searchAfter value is returned, include that exact value in the next request to retrieve the subsequent page.
For each additional page, use the latest searchAfter value from the previous response.
Continue this process until the response does not contain a searchAfter field, which indicates that there are no more results to retrieve.

The absence of the searchAfter field in a response signifies the end of the result set.

SampleSample

API Request

curl -X POST 
'<qualys_base_url>/etm/api/rest/v1/findings/list'
--header 'Content-Type: application/json'
--header 'Authorization: Bearer <JWT Token>'
--data '{
    "page": 0,
    "pageSize": 5,
    "query": "",
    "havingQuery": "finding.riskFactor.rti: Ransomware and (( finding.type: Misconfiguration OR finding.typeDetected: [`Confirmed`, `Potential`, `Sensitive Content`] ) and finding.status: [`NEW`, `ACTIVE`, `REOPENED`, `FAIL`] and finding.isIgnored: FALSE)",
    "searchAfter": [
        "8f60f333-5b26-4550-8465-d6ac3184d450"
    ]
}'

Response

{
    "data":[
        {
            "findingId": "92b047ee-6a6d-4e6b-9877-5c18e9c67324",
            "title": "Microsoft SMB Server Remote Code Execution Vulnerability (MS17-010) and Shadow Brokers",
            "severity": "5",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": 1654177683.000000000,
            "lastFound": 1672228193.000000000,
            "assetId": "197168",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        },
        {
            "findingId": "abf99f1b-dffe-4bef-b8f1-732f0543e76d",
            "title": "Microsoft SMB Server Remote Code Execution Vulnerability (MS17-010) and Shadow Brokers",
            "severity": "5",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": 1654177683.000000000,
            "lastFound": 1672228193.000000000,
            "assetId": "197168",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        },
        {
            "findingId": "d9da55f1-dbd1-48fc-ae5a-ba42fa7a7c68",
            "title": "Alpine Linux Security Update for apache2",
            "severity": "4",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": 1654177683.000000000,
            "lastFound": 1672228193.000000000,
            "assetId": "199852",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        },
        {
            "findingId": "6b939b23-b54f-4157-8d3e-b2dca8ddffd9",
            "title": "Alpine Linux Security Update for apache2",
            "severity": "5",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": 1654177683.000000000,
            "lastFound": 1672228193.000000000,
            "assetId": "198436",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        },
        {
            "findingId": "d9ab0ff3-796b-4ed3-8043-2c46d7724177",
            "title": "CentOS Security Update for polkit (CESA-2022:0274) (PwnKit)",
            "severity": "4",
            "status": "ACTIVE",
            "type": "VULNERABILITY",
            "firstFound": 1654177683.000000000,
            "lastFound": 1672228193.000000000,
            "assetId": "197648",
            "truConfirm.isApplicable": false,
            "sources": "CrowdStrike",
            "product.description": "NA",
            "riskAcceptanceIsIgnored": false,
            "technologyCategory": "Mac / Client",
            "protocol": "tcp",
            "typeDetected": "Potential",
            "riskAcceptance": "None",
            "originalRiskScore": "30",
            "isMitigated": "false",
            "vendorName": "CrowdStrike",
            "externalFindingId": "8800f02f2ea74c75a9524ae13ae087f7_965083b3cc083f48b87682a493a58d04",
            "finding.cveId": "CVE-2026-35385",
            "qds": "60",
            "qvss": "3.7",
            "riskFactor.cisaKnownExploits": "false"
        }
    ],
    "totalCount": 52768,
    "searchAfter": [
        "abf99f1b-dffe-4bef-b8f1-732f0543e76d"
    ]
}

Last updated: July, 2026